Legal

Privacy Policy

Last updated 28 September 2026.

Bosun helps people start and run businesses. This policy describes what Bosun stores, why, who processes it, and how to remove it. It describes what the software actually does.

What Bosun stores

• Your sign-in — your name and email address from Google, and nothing else from your Google account.
• Business details — what you tell Bosun about the business, what it reads on the business's public website, what it finds about the business on the public web and Google Maps, your corrections and answers, the plan you approve and its spending limit.
• Research reports — the research written for your business, the public sources it cites, and the charts it draws. Charts are stored with Cloudflare R2 and shown only to you.
• Files you add — records you choose to upload for research (for example sales exports, spreadsheets, appointment history or price sheets). They are kept in a file store that belongs to that business alone, provided by Google's Gemini API, and are read only when researching that business. Text records (such as CSV exports) are also kept with Cloudflare R2 so Bosun can count them exactly with code in a sandbox provided by Google's Gemini API; removing a file deletes both copies.
• Access tokens for accounts you connect — when you connect Google Business Profile, Facebook, or Instagram, Bosun stores the access token that account issues. Tokens are encrypted, and each business's credentials are kept in a separate encrypted scope so one business's access cannot be used for another.
• A record of every action taken — what was posted or sent, when, to which channel, what checks passed beforehand, and what it cost. This is what lets you audit what happened.
• Contact data you supply for outreach, together with a suppression list of addresses that must not be contacted again.

What Bosun does not store

• Passwords. There is no password field for a connected account anywhere in Bosun. Access is granted on the provider's own sign-in page.
• Payment card details.
• Any data from a Google or Meta account beyond the permissions you granted.

How connected-account data is used

Access granted through Google or Meta is used only to carry out the operating plan you approved for that business — publishing posts you have authorised, reading the profile and performance information needed to report back to you, and monitoring ad spend where you have asked for it.

Bosun does not sell this data, does not share it with third parties for advertising, and does not use it to train machine-learning models.

AI providers

Bosun uses Google's Gemini API and Cloudflare Workers AI to understand your business, research its market, draft plans and reports, and write copy. The business details, website text, research findings and any files you add are sent to them for that purpose. Access tokens for your connected accounts are never sent to them.

While Bosun is in private testing it uses Google's free Gemini API tier. Under Google's terms for that tier, content sent to the Gemini API — including files you upload — may be used by Google to improve its products. This policy will be updated when Bosun moves to a paid tier.

Keeping and deleting data

You can remove any file you added, at any time, from the business's page in Bosun; removing it deletes it from the file store. The record of actions is retained so past activity can be audited. You can ask for a business and all of its data to be deleted at any time by writing to boyarkinoo@gmail.com; connected-account tokens are destroyed immediately on request.

You can also revoke Bosun's access yourself at any time, without contacting anyone, from your Google account permissions or your Meta business settings. Revoking access stops Bosun acting on that account immediately.

Google user data

Bosun's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Security

Credentials are encrypted before storage, with a separate encryption scope per business. Access to stored credentials is logged. No system is perfectly secure, and this is stated as a description of practice rather than a guarantee.

Contact

Questions or deletion requests: boyarkinoo@gmail.com.