Privacy Policy

Last updated: 22 September 2026

This policy explains how Boss Systems Limited (NZBN 9429053973603), trading as BossAI, handles personal information. It covers our website at bossai.co.nz, the things we sell, and the platform we run for our customers.

We follow the Privacy Act 2020 and its information privacy principles.

1. There are two different relationships here

This is the most important thing on the page, because the answer to “whose information is it, and who decides what happens to it?” depends on which one you are in.

If you are our customer, or thinking about becoming one

When you visit our site, open one of our free tools, buy the Blueprint or subscribe, we are the agency responsible for your information under the Privacy Act. This policy is the one that governs it.

If you are a customer of a business that uses BossAI

If a plumber, clinic or salon answers your call, text or web chat using BossAI, your information is in their workspace. That business is the agency responsible for it, not us. We hold and process it on their instructions so their service works.

So if you want to see what a business holds about you, correct it, or have it deleted, ask that business — they can do all of it themselves, and they are the ones who decide. If you contact us instead we will pass your request to them and help them action it. Their own privacy statement, not this one, tells you what they collect and why.

2. What we collect about you, as our customer

• Account and contact details — your name, business name, email address, phone number, and the login details you create.
• Billing information — what you bought, when, and how much you paid. We never see or store your full card number; our payment processor handles the card and gives us back a token, the last four digits and the outcome.
• What you tell us during setup — your opening hours, services, prices and booking rules, so your workspace can be built from your answers.
• Support conversations — chat and email threads with us.
• Website and usage information — IP address, browser and device type, pages viewed, and how you found us (referring site, and any campaign tags such as UTM parameters or ad click identifiers in the link you followed).
• Free tools — the email address you give to unlock them, which resource opened them, and the industry you pick in the prompt pack.

3. What sits in a customer workspace

A workspace holds the working records of a business, and we hold them for that business:

• contact records — name, phone, email, address, notes and tags;
• message threads across text, WhatsApp, web chat and social messaging;
• phone calls handled by the AI — a written turn-by-turn transcript, a summary, the caller’s number, and how the call ended. Our voice provider processes the call audio in order to produce that text. We do not store a recording of the call.
• web chat sessions, including the visitor’s IP address, browser and the page they were on;
• website form submissions, including the campaign tags and referring page that brought the person there, and an approximate city-level location worked out from their IP address or their phone’s country code;
• bookings, quotes, jobs, invoices, packages and the activity history behind them.

4. Why we use it

We use personal information to:

• provide, run, secure and support the service;
• build and configure a workspace after someone subscribes;
• take payment and manage subscriptions;
• send service messages — receipts, renewal notices, security notices and the weekly summary of enquiries caught;
• answer support questions, and investigate problems and misuse;
• improve the product, using aggregate patterns rather than reading individual workspaces;
• send marketing to people who asked for it — with an unsubscribe link in every message, honoured promptly;
• meet our legal and tax obligations.

We do not sell personal information, and we never have. We do not use the contents of a customer’s workspace to advertise to them or to their customers, and we do not use it to train AI models.

5. Artificial intelligence

The AI employees generate their replies through a model provider. The conversation — and the business information the agent needs in order to answer, such as services, prices and hours — is sent to that provider to produce each reply, and the reply comes back to us.

We do not permit our providers to use that content to train their models. Providers may hold it briefly to run the request and to guard against abuse.

6. Who else is involved

We use specialist providers to run the service. They receive only what they need for their part of it, and may use it only to provide that service to us:

We also disclose information where the law requires it, and to professional advisers under a duty of confidence. If our business is sold or restructured, customer information may transfer with it, subject to this policy.

7. Information going overseas

Most of the providers above are based outside New Zealand, mainly in the United States and the European Union, so personal information in the service is stored and processed overseas.

Before we use a provider we satisfy ourselves that it is required to protect the information in a way comparable to the Privacy Act, and we put contractual terms in place to that effect, as principle 12 requires. Once information is overseas it may also be accessible to authorities in that country under their own laws.

If you are one of our customers, please make sure your own privacy statement tells your customers that you use an overseas-hosted system — that is your disclosure to make, not ours.

8. Cookies and tracking

We use a small number of cookies and similar technologies:

• Sign-in — to keep you signed in to your workspace. Necessary; the service cannot work without it.
• Free tools — one cookie so you do not have to give your email again on your next visit. It holds a one-way scrambled version of your address, not the address itself.
• Your browser’s own storage — for small conveniences such as remembering which steps of a checklist you have ticked. That stays on your device.
• Support chat — so a conversation with us survives a page reload.
• Marketing measurement — where enabled, to understand which campaigns bring people to our site. You can opt out with your browser settings or an ad blocker; nothing on our site breaks if you do.

9. How long we keep it

• Workspace data — for as long as the subscription runs, then 60 days after it ends so you can ask for a copy or come back, and then it is deleted. Ask us within that window if you want it gone sooner. This matches section 5 of our Terms of Service.
• Billing and tax records — seven years, as New Zealand tax law requires.
• Marketing contacts — until you unsubscribe or ask us to remove you.
• Support conversations — while they are useful for supporting you, then deleted on a routine cycle.

10. Keeping it safe

We take reasonable steps to protect personal information: encryption in transit, access controls, each workspace separated from every other one, and secrets such as integration tokens kept where no ordinary user can reach them.

No system is perfectly secure. If we have a privacy breach that is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and the people affected as soon as practicable, as the Privacy Act requires. If the breach is inside a customer’s workspace we will tell that customer promptly so they can meet their own obligations.

11. Your rights

You have the right to ask for the personal information we hold about you, and to ask us to correct it if it is wrong. Email support@bossai.co.nz and we will respond within 20 working days, which is the limit the Privacy Act sets. There is no charge. We may need to confirm who you are first.

If you are a customer of a business that uses BossAI, send that request to that business — see section 1.

You can unsubscribe from marketing at any time using the link in any message.

If you are not happy with how we have handled your information, tell us first and we will try to put it right. You can also complain to the Office of the Privacy Commissioner.

12. Children

The service is sold to businesses and is not intended for anyone under 18. We do not knowingly collect information from children. If you think we have, tell us and we will delete it.

13. Changes to this policy

We may update this policy. We will post the new version here with a new “last updated” date, and if a change materially affects our customers we will email the address on the account.

14. Contact

Boss Systems Limited, NZBN 9429053973603, trading as BossAI, bossai.co.nz.

For a privacy request, or anything else about this policy, open a chat or email support@bossai.co.nz. Notices under our Terms of Service go to contact@bossai.co.nz.