Privacy Policy

Bosla ("Bosla", "we", "us") provides a bilingual customer communication and order-management platform for online sellers. This Privacy Policy explains what information we collect, how we use it, and the choices available to you when you use our website, dashboard, and connected integrations (the "Service").

We act as a data controller for information about the seller accounts and team members who use Bosla, and as a data processor for the end-customer messages and order data that sellers route through the platform. Sellers remain responsible for the lawful handling of their own customers' data.

We collect the following categories of information:

• Account data — name, email, phone number, company details, role, and authentication data (including MFA) for seller team members.
• Business profile — store name, store URL, support channels, brand voice, and team details provided during onboarding.
• Channel & integration data — credentials and tokens for connected channels (WhatsApp, Instagram, Messenger, TikTok, Telegram) and stores (Shopify, Salla, Zid, custom API). These are encrypted at rest.
• Conversation & order data — messages, attachments, contact details, and orders that flow through the unified inbox, including content processed by AI to generate replies.
• Usage & device data — log data, IP address, browser/device information, and push notification tokens.

We use information to:

• Provide, operate, and secure the Service and your account.
• Deliver and receive messages across connected channels and synchronize orders from connected stores.
• Generate AI-assisted replies in the seller's configured brand voice, when AI is enabled on a conversation.
• Send transactional notifications (e.g. order updates, delivery status).
• Provide support, prevent abuse, and meet legal obligations.

When AI auto-reply is enabled on a conversation, recent message history and the seller's business profile are sent to our AI model provider to generate a suggested or automated reply. We do not use your customers' message content to train third-party foundation models. AI can be disabled per conversation at any time.

We share data with infrastructure and integration providers strictly to operate the Service, including:

• Meta Platforms (WhatsApp Cloud API, Instagram, Messenger) for messaging.
• Store platforms (Shopify, Salla, Zid) for order and product sync.
• Cloud hosting, object storage, email, and SMS providers.
• AI model providers for reply generation.

Each provider processes data only as needed to deliver its function. We do not sell your personal data.

We retain account and conversation data for as long as your account is active and as needed to provide the Service. When you disconnect a store or close your account, we delete or anonymize the associated personal data within 30 days, except where retention is required by law or for legitimate business records. For connected Shopify stores, we honor Shopify's data-protection webhooks: a customer data-erasure request (customers/redact) and a store-erasure request (shop/redact) delete the corresponding data, and a customer data-access request (customers/data_request) is fulfilled through the store owner.

We protect data with encryption in transit and at rest, encrypted per-seller integration credentials, encrypted database backups, tenant-level data isolation, role-based access control, MFA, least-privilege staff access with access logging, and a security incident response process. We process the minimum personal data needed to provide the Service. No method of transmission or storage is completely secure, but we work to protect your information using industry-standard safeguards.

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, contact us at the address below. End customers should direct requests to the seller they interacted with, who controls that data.

The Service is intended for businesses and is not directed to individuals under 18. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time. When we make material changes, we will update the date above and, where appropriate, notify you through the Service.

For privacy questions or requests, contact us at [email protected].