Privacy Policy

Last updated: 12 October 2026

This policy explains how Boss Systems Limited (NZBN 9429053973603), trading as BossAI, handles personal information. It covers our website at bossai.co.nz, the things we sell, and the platform we run for our customers.

We follow the Privacy Act 2020 and its information privacy principles.

1. There are two different relationships here

This is the most important thing on the page, because the answer to “whose information is it, and who decides what happens to it?” depends on which one you are in.

If you are our customer, or thinking about becoming one

When you visit our site, open one of our free tools, buy the Blueprint or subscribe, we are the agency responsible for your information under the Privacy Act. This policy is the one that governs it.

If you are a customer of a business that uses BossAI

If a plumber, clinic or salon answers your call, text or web chat using BossAI, your information is in their workspace. That business is the agency responsible for it, not us. We hold and process it on their instructions so their service works.

So if you want to see what a business holds about you, correct it, or have it deleted, ask that business — they can do all of it themselves, and they are the ones who decide. If you contact us instead we will pass your request to them and help them action it. Their own privacy statement, not this one, tells you what they collect and why.

2. What we collect about you, as our customer

• Account and contact details — your name, business name, email address, phone number, and the login details you create. If you choose to sign in with Google, Google confirms your name, email address and profile picture to us. We never see your Google password.
• Billing information — what you bought, when, and how much you paid. We never see or store your full card number; our payment processor handles the card and gives us back a token, the last four digits and the outcome.
• What you tell us during setup — your opening hours, services, prices and booking rules, so your workspace can be built from your answers.
• Support conversations — chat and email threads with us.
• Website and usage information — IP address, browser and device type, pages viewed, and how you found us (referring site, and any campaign tags such as UTM parameters or ad click identifiers in the link you followed).
• Free tools — the email address you give to unlock them, which resource opened them, the industry you pick in the prompt pack, the figures you settle on in the missed-call calculator (so we can send your result back to you), and a record of your agreement to the follow-up emails.

3. What sits in a customer workspace

A workspace holds the working records of a business, and we hold them for that business:

• contact records — name, phone, email, address, notes and tags;
• message threads across text, WhatsApp, web chat and social messaging;
• phone calls handled by the AI — a written turn-by-turn transcript, a summary, the caller’s number, and how the call ended. Our voice provider processes the call audio in order to produce that text. We do not store a recording of the call.
• web chat sessions, including the visitor’s IP address, browser and the page they were on;
• website form submissions, including the campaign tags and referring page that brought the person there, and an approximate city-level location worked out from their IP address or their phone’s country code;
• bookings, quotes, jobs, invoices, packages and the activity history behind them.

4. Why we use it

We use personal information to:

• provide, run, secure and support the service;
• build and configure a workspace after someone subscribes;
• take payment and manage subscriptions;
• send service messages — receipts, renewal notices, security notices and the weekly summary of enquiries caught;
• answer support questions, and investigate problems and misuse;
• improve the product, using aggregate patterns rather than reading individual workspaces;
• send marketing to people who asked for it — with an unsubscribe link in every message, honoured promptly;
• meet our legal and tax obligations.

We do not sell personal information, and we never have. We do not use the contents of a customer’s workspace to advertise to them or to their customers, and we do not use it to train AI models.

5. Artificial intelligence

The AI employees generate their replies through a model provider. The conversation — and the business information the agent needs in order to answer, such as services, prices and hours — is sent to that provider to produce each reply, and the reply comes back to us.

We do not permit our providers to use that content to train their models. Providers may hold it briefly to run the request and to guard against abuse.

Talk to BossAI, the spoken helper inside the dashboard, works the same way. While someone in a workspace is talking to it, their voice and the helper's replies go to a model provider, along with any figures the helper reads out for them, such as enquiry counts, tasks due and upcoming bookings. We do not record or keep the audio or the conversation. We keep only how long each workspace used the helper that day, and the wording of any question the helper could not answer, so we can add help for it.

The Blueprint coach, the spoken coach inside the web version of the BossAI Blueprint, works the same way: the buyer's voice and the coach's replies go to a model provider, along with the Blueprint section on screen. We keep only how much coach time the purchase has used and any question the coach could not answer, never the audio or the conversation.

6. Who else is involved

We use specialist providers to run the service. They receive only what they need for their part of it, and may use it only to provide that service to us:

We also disclose information where the law requires it, and to professional advisers under a duty of confidence. If our business is sold or restructured, customer information may transfer with it, subject to this policy.

7. Information going overseas

Most of the providers above are based outside New Zealand, mainly in Australia, the United States and the European Union, so personal information in the service is stored and processed overseas.

Before we use a provider we satisfy ourselves that it is required to protect the information in a way comparable to the Privacy Act, and we put contractual terms in place to that effect, as principle 12 requires. Once information is overseas it may also be accessible to authorities in that country under their own laws.

If you are one of our customers, please make sure your own privacy statement tells your customers that you use an overseas-hosted system — that is your disclosure to make, not ours.

8. Cookies and tracking

We use a small number of cookies and similar technologies:

• Sign-in — to keep you signed in to your workspace. Necessary; the service cannot work without it.
• Free tools — one cookie so you do not have to give your email again on your next visit. It holds a one-way scrambled version of your address, not the address itself.
• Your browser’s own storage — for small conveniences such as remembering which steps of a checklist you have ticked. That stays on your device.
• Support chat — so a conversation with us survives a page reload.
• Visitor statistics — Google Analytics, on BossAI’s own website only: never inside a workspace, and never on the quotes, bookings, forms and job pages a business sends its own customers. It records which pages are visited, how you arrived (for example the campaign in a link) and your approximate location, with a cookie so a return visit is counted once. We send Google page addresses with any private links removed, keep the data for 14 months, and do not link it to Google accounts. You can opt out with Google’s browser add-on or an ad blocker.
• Advertising measurement — Meta’s pixel, on BossAI’s own website only. It is never inside a workspace, and never on the quotes, bookings, forms and job pages a business sends its own customers. It tells Meta which of our pages were visited and whether someone started a purchase or signed up for the free tools, so we can see which of our Facebook and Instagram ads work. When you pay for a plan or the Blueprint, our server also tells Meta about the purchase: what was bought and its price, the pixel’s cookie, your IP address and browser, and a one-way scrambled version of your email address and country, so Meta can match the sale to the ad you came from. We never send Meta your name or your email address itself. Meta may connect this to a Facebook or Instagram account you are signed in to, under Meta’s own privacy policy. You can opt out in your Facebook ad settings, your browser settings or with an ad blocker. Nothing on our site breaks if you do.

9. How long we keep it

• Workspace data — for as long as the subscription runs, then 60 days after it ends so you can ask for a copy or come back, and then it is deleted. Ask us within that window if you want it gone sooner. This matches section 5 of our Terms of Service.
• Billing and tax records — seven years, as New Zealand tax law requires.
• Marketing contacts — until you unsubscribe or ask us to remove you.
• Support conversations — while they are useful for supporting you, then deleted on a routine cycle.

10. Keeping it safe

We take reasonable steps to protect personal information: encryption in transit, access controls, each workspace separated from every other one, and secrets such as integration tokens kept where no ordinary user can reach them.

No system is perfectly secure. If we have a privacy breach that is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and the people affected as soon as practicable, as the Privacy Act requires. If the breach is inside a customer’s workspace we will tell that customer promptly so they can meet their own obligations.

11. Your rights

You have the right to ask for the personal information we hold about you, and to ask us to correct it if it is wrong. Email support@bossai.co.nz and we will respond within 20 working days, which is the limit the Privacy Act sets. There is no charge. We may need to confirm who you are first.

If you are a customer of a business that uses BossAI, send that request to that business — see section 1.

You can unsubscribe from marketing at any time using the link in any message.

If you are not happy with how we have handled your information, tell us first and we will try to put it right. You can also complain to the Office of the Privacy Commissioner.

12. Children

The service is sold to businesses and is not intended for anyone under 18. We do not knowingly collect information from children. If you think we have, tell us and we will delete it.

13. Changes to this policy

We may update this policy. We will post the new version here with a new “last updated” date, and if a change materially affects our customers we will email the address on the account.

14. Contact

Boss Systems Limited, NZBN 9429053973603, trading as BossAI, bossai.co.nz.

Wellington, New Zealand.

For a privacy request, or anything else about this policy, open a chat or email support@bossai.co.nz. Notices under our Terms of Service go to contact@bossai.co.nz.