Bosmos Privacy Policy

Effective Date: September 30, 2026

Bosmos, Inc. ("Bosmos," "we," "us," or "our") provides software that helps business teams organize conversations, understand relationships, and follow up on opportunities across the services they choose to connect.

This Privacy Policy explains what information Bosmos collects, how we use it, when we share it, how long we keep it, and the choices available to you. It applies to our websites, applications, integrations, and related services (collectively, the "Services").

1. Information we collect

Information you provide

We collect information you provide when you create an account, set up a workspace, use the Services, or contact us. This may include:

your name, email address, profile image, company, role, and contact details;
information about your business, services, customers, and working preferences;
prompts, searches, instructions, drafts, notes, and messages you enter;
workspace membership, permissions, and settings;
support requests and other communications with Bosmos; and
billing details such as billing name, plan, subscription status, and payment status.

Payment card information is handled by our payment processor. Bosmos does not store complete payment card numbers.

Information from connected services

You can choose to connect services such as Gmail, Google Calendar, Google Contacts, Microsoft Outlook, Microsoft Calendar, GoHighLevel, and Slack. The provider will show you the permissions requested before you approve a connection.

Depending on the service and permissions you choose, Bosmos may receive account identifiers, contacts, messages, calendar events, CRM records, activity history, deal information, invoice information, and other content needed to provide the connected feature. Connecting a service is optional. Bosmos does not access a connected account until an authorized user approves the connection.

Product and device information

We collect information about how the Services are used, including pages viewed, features used, actions completed, device and browser type, approximate location derived from an IP address, timestamps, errors, and performance information.

2. Gmail and Google Workspace data

When you connect Gmail, Bosmos may access:

your Gmail address and Google account identifier;
message and thread identifiers;
sender and recipient addresses;
subject lines, dates, labels, and message headers;
message snippets and message content; and
conversation history needed to display or process a thread.

Bosmos uses Gmail data only to provide or improve user-facing features you request, including organizing conversations, identifying contacts and follow-ups, searching connected mail, displaying relevant context, producing summaries and classifications, generating relationship signals and rankings, recommending next steps, and preparing responses for your review.

Bosmos requests permission to send email so you can send a message from your connected Gmail account. Before a message is sent, you can review and edit the recipient, subject, attachments, and body. Bosmos does not delete Gmail messages or change mailbox state unless a feature clearly explains the action and an authorized user initiates it.

Google Calendar and Google Contacts are separate features. If you enable them, Bosmos uses calendar information to provide meeting context and contact information to improve names and profile details in your workspace.

Bosmos does not sell Google user data or data derived from it. Bosmos does not use Google user data or derived data for advertising, creditworthiness, insurance, employment, or eligibility decisions. Bosmos does not use, and does not permit its service providers to use, Google user data or data derived from it to train, retrain, develop, or improve a general-purpose, foundation, or shared artificial intelligence or machine-learning model. Google user data is processed only to provide the specific user-facing features requested by the authorized user or customer.

Bosmos' use and transfer of information received from Google Workspace APIs complies with the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

3. Microsoft 365 and Outlook data

When you connect a Microsoft account, Bosmos may access:

your Microsoft account identifier, email address, and basic profile details;
message and conversation identifiers;
sender and recipient addresses;
subject lines, dates, folders, draft status, message previews, and message content;
calendar events and related meeting information; and
contacts and people information.

The Microsoft permissions Bosmos may request include basic sign-in and profile permissions, offline access, Mail.ReadWrite, Mail.Send, Calendars.Read, Contacts.Read, and People.Read. The Microsoft consent screen shows the current permissions before you approve them.

Bosmos uses Microsoft 365 and Outlook data only to provide or improve user-facing features you request, including synchronizing and organizing conversations, searching connected mail, displaying threads and meeting context, identifying contacts and follow-ups, producing summaries and classifications, generating relationship signals and rankings, recommending next steps, preparing drafts, and sending messages that an authorized user directs Bosmos to send.

Bosmos uses Microsoft permissions only for the connected features described to you. Bosmos does not delete Outlook messages or change mailbox state unless a feature clearly explains the action and an authorized user initiates it.

Bosmos does not sell Microsoft 365 or Outlook data or data derived from it. Bosmos does not use this data for advertising, creditworthiness, insurance, employment, or eligibility decisions. Bosmos does not use, and does not permit its service providers to use, Microsoft 365 or Outlook data or derived data to train, retrain, develop, or improve a general-purpose, foundation, or shared artificial intelligence or machine-learning model. This data is processed only to provide the specific user-facing features requested by the authorized user or customer.

4. Derived data and artificial intelligence features

Bosmos may use connected data, workspace records, and instructions to generate derived data. Depending on the features you use, derived data may include:

message, contact, company, or opportunity classifications;
relationship signals, relationship strength or warmth indicators, and interaction trends;
relevance, priority, confidence, engagement, or opportunity scores;
rankings of contacts, conversations, tasks, or opportunities;
summaries, inferred topics, inferred interests, and status indicators;
suggested follow-ups, recommended actions, and other recommendations; and
generated searches, reports, notes, and message drafts.

These outputs are generated from patterns in the information available to the feature, such as the timing, frequency, participants, and content of communications, calendar activity, CRM information, workspace activity, and instructions supplied by users. The factors used and their relative importance vary by feature and available data.

Bosmos uses derived data to organize information, prioritize work, surface relevant context, and assist users with communications and decisions. Generated outputs may be incomplete, inaccurate, or inappropriate. Users can review, correct, disregard, or override them. A user must review a generated draft before sending it.

Bosmos does not use automated processing to make decisions that produce legal or similarly significant effects about individuals. The Services do not make automated decisions about employment, lending, housing, insurance, legal rights, or access to essential services. If this changes, Bosmos will provide any notice, consent, human review, explanation, and appeal rights required by law before using the new processing.

Where applicable, you may object to profiling, request restriction of the processing, correct the underlying data, and request human review of an outcome by contacting us.

5. How Bosmos uses information

We use information to:

create, maintain, and secure accounts and workspaces;
provide the features and integrations you choose to use;
synchronize and organize authorized business information;
display conversations, contacts, meetings, and related context;
create the derived data described in Section 4;
respond to searches and instructions;
prepare summaries, drafts, and recommended next steps;
send a message when an authorized user directs us to do so;
process subscriptions and provide customer support;
monitor reliability, prevent abuse, and investigate security problems;
comply with law and enforce our agreements; and
improve the usability and performance of the Services using product usage information that excludes connected mailbox content and credentials.

6. Controller and processor roles

Bosmos acts as a controller when it determines why and how personal information is processed. This generally includes account and profile information, billing and subscription records, Bosmos website and product usage information, support communications, service security, fraud prevention, direct communications from Bosmos, and information processed to meet our legal obligations.

When a business customer uses the Services to process connected mailbox, CRM, calendar, contact, or other workspace data on its instructions, that customer is generally the controller or business and Bosmos acts as its processor or service provider. The customer is responsible for its instructions, notices, permissions, and other obligations to the people whose information it processes. Bosmos processes that data under the applicable customer agreement and data processing terms.

Bosmos may act as an independent controller for limited processing needed to secure the Services, prevent fraud or abuse, comply with law, or establish, exercise, or defend legal claims. If the terms of a customer agreement or data processing addendum conflict with this general description, those terms govern the processing covered by that agreement.

7. Lawful bases for EEA and UK processing

If European Economic Area or United Kingdom data protection law applies and Bosmos acts as a controller, we rely on one or more of these lawful bases:

Contract: to create and manage your account, provide the Services and integrations you request, process subscriptions, and respond to service requests.
Legitimate interests: to secure and improve the Services, prevent fraud and abuse, troubleshoot problems, provide support, understand product usage, and operate our business, where those interests are not overridden by your rights and interests.
Consent: for optional integrations, non-essential cookies, marketing, or other processing where consent is required. You may withdraw consent at any time, without affecting processing that occurred before withdrawal.
Legal obligation: to comply with tax, accounting, regulatory, law enforcement, and other applicable legal requirements.

When Bosmos acts as a processor, the customer determines the lawful basis for processing customer-controlled data.

8. Cookies and analytics

We use cookies, local storage, session storage, and similar technologies to keep you signed in, remember preferences, understand feature usage, secure the Services, and detect problems. Where required by law, Bosmos asks for consent before using non-essential analytics technologies.

Bosmos uses PostHog and Vercel Analytics for product analytics. Bosmos does not send connected mailbox content, message bodies, message previews, subject lines, sender or recipient addresses, attachments, OAuth credentials, access tokens, or refresh tokens to product analytics or session replay providers.

You can control cookies through your browser and, where available, Bosmos's cookie controls. Disabling necessary storage may prevent parts of the Services from working correctly.

9. How Bosmos shares information

Bosmos does not sell personal information or connected account data. Bosmos does not share personal information for cross-context behavioral advertising.

Subprocessors and service providers

Bosmos uses subprocessors and service providers only for defined business and technical purposes. Current provider categories include:

Vercel for application hosting, infrastructure, analytics, and AI request routing;
Supabase for authentication, databases, and storage;
OpenAI and DeepSeek, depending on the configured model, for processing specific AI-assisted requests routed through the Vercel AI Gateway;
PostHog for product analytics and session replay, subject to the exclusions in Section 8; and
Braintree for payment processing.

Providers may process information only to perform contracted services for Bosmos, subject to applicable data protection, security, and confidentiality requirements. Bosmos evaluates providers that process personal information and requires appropriate contractual protections. When Bosmos acts as a processor, it remains responsible for its subprocessors as provided by the applicable data processing agreement. Bosmos provides notice of a material new subprocessor when required by that agreement or applicable law.

User-directed integrations

Google, Microsoft, GoHighLevel, Slack, and similar services are user-directed integrations, not Bosmos subprocessors when they process information under their own terms. When you ask Bosmos to obtain information from or perform an action through an integration, Bosmos exchanges the information needed to complete that request. The connected provider's privacy terms also apply to its handling of information.

Workspace administrators

If you use Bosmos through a company workspace, its authorized owners or managers may access workspace membership, settings, activity, shared records, and other information available to their role.

Legal and safety reasons

We may disclose information when reasonably necessary to comply with law, respond to valid legal process, investigate fraud or abuse, protect the security of the Services, or protect the rights and safety of Bosmos, our users, or others.

Business transactions

Information may be disclosed to advisers and prospective parties during a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to confidentiality safeguards and applicable law. A successor may receive information only if it agrees to honor this Privacy Policy or provides the notice and choices required by law.

Google Workspace API data, including data derived from it, will not be transferred to an acquirer or successor without the user's explicit prior consent. If that consent is not obtained, Bosmos will delete the Google Workspace API data rather than transfer it.

10. Human access to connected mailbox data

Bosmos personnel do not access connected mailbox content unless:

you authorize review of specific content for support;
access is necessary to investigate abuse or a security incident; or
access is required by law.

Production access is limited to authorized personnel with a business need and is subject to access controls.

11. Data retention

Bosmos retains personal information only for as long as needed to provide the Services, maintain security, comply with law, resolve disputes, and enforce agreements. Retention depends on the type of information, the feature involved, the status of the account or workspace, and applicable legal requirements.

For active connected mailboxes, Bosmos retains access and refresh tokens while the connection is active or until a token expires or is replaced. Bosmos retains synchronized message metadata, snippets, thread references, saved outputs, and derived data while needed to provide the active account or workspace with the requested features. Full message content fetched for an on-screen or requested operation is processed for that operation; the synchronized mailbox records Bosmos maintains include message metadata, snippets, and thread identifiers.

When a person is removed from a workspace, Bosmos immediately removes that person's workspace access and stored Google and Microsoft mailbox tokens. The removed person's retained mailbox content is inaccessible through the workspace. Thirty days after removal, Bosmos deletes the retained incoming message records and removes email-derived evidence, reasoning, subject lines, and provider message identifiers from retained contact and sent-message records.

Deleting an account or workspace removes its associated active-system records, subject to technical completion of the deletion request. Bosmos may retain limited records when required for security, fraud prevention, tax, accounting, legal compliance, or the establishment, exercise, or defense of legal claims. Bosmos does not retain OAuth tokens or mailbox content merely for billing or general business records.

12. Managing connections and deleting information

You can manage access to a connected account through the provider's permissions page. Revoking Bosmos through Google or Microsoft prevents Bosmos from using that authorization for future access. Revoking a provider authorization does not delete or change messages in the provider's service and does not, by itself, delete information previously stored in Bosmos.

You can delete your Bosmos account through the available account controls. A workspace owner can delete a workspace or transfer ownership as allowed by the Services. You may also contact us to request deletion of personal information or connected data. Legal exceptions may apply.

13. Security

Bosmos uses administrative, technical, and organizational safeguards designed to protect information. These include encryption in transit and at rest, authentication and access controls, workspace-based authorization, software and dependency review, and incident response practices.

No service can guarantee absolute security. If Bosmos learns of unauthorized access to connected account data, we will investigate, take steps to contain the incident, and provide notifications when required by law or applicable provider requirements.

14. Your rights and choices

Depending on your location and Bosmos's role, you may have the right to request access, correction, deletion, restriction, objection, or portability of your personal information. You may withdraw consent where processing is based on consent and object to processing based on legitimate interests, including profiling based on those interests.

You can:

update your profile and workspace settings;
manage or revoke integrations;
review, correct, or disregard generated outputs;
delete saved content;
delete your account; and
contact us about a privacy request or automated-processing concern.

If Bosmos processes your information for a customer as its processor or service provider, we may direct your request to that customer or assist the customer in responding. We may need to verify your identity and authority before completing a request. We will not discriminate against you for exercising a privacy right.

EEA and UK residents may lodge a complaint with the data protection authority where they live or work or where an alleged violation occurred. UK residents may contact the Information Commissioner's Office.

15. International processing and transfers

Bosmos is based in the United States. Information may be processed in the United States and other countries where Bosmos and its service providers operate. Those countries may have data protection laws different from the laws where you live.

Where EEA, UK, or Swiss law requires a transfer mechanism, Bosmos uses an applicable adequacy decision, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, or another lawful safeguard. Where required, Bosmos assesses relevant transfer risks and uses supplementary technical, contractual, or organizational measures. You may contact us for information about the safeguard applicable to a transfer.

16. California privacy notice

California residents may have rights to know, access, correct, delete, and obtain a copy of personal information, subject to applicable exceptions. Bosmos does not sell personal information and does not share personal information for cross-context behavioral advertising.

The categories we may collect include identifiers, commercial information, internet or network activity, professional information, user-provided content, connected account information, and inferences and other derived data described in Section 4. We use and disclose these categories for the purposes described in this policy.

17. People under 18

The Services are intended for business users who are at least 18 years old or the age of legal majority where they live, whichever is higher. People under 18 may not create an account or use the Services. Bosmos does not knowingly collect personal information directly from a person under 18. If you believe a person under 18 has provided personal information directly to Bosmos, contact us so we can investigate and delete it as appropriate.

Business communications connected by a customer may incidentally contain information about a person under 18. In that situation, Bosmos processes the information on the customer's instructions, and the customer is responsible for having a lawful basis and complying with protections that apply to children.

18. Information about other people

Connecting a business account may allow Bosmos to process information about people who communicate with you. Customers and users are responsible for having the authority and lawful basis to provide that information, giving required notices, respecting communication preferences, and using the Services in accordance with applicable law.

19. Changes to this policy

We may update this Privacy Policy as the Services or legal requirements change. If a change materially affects how we use connected account data, we will provide notice and request additional consent when required before applying the new use.

The effective date at the top identifies the latest version.

20. Contact us

For privacy questions or requests, contact:

Bosmos, Inc.

285 W Wieuca Rd NE, STE 69184, Atlanta, GA 30342, United States

Email: info@bosmos.org

Website: https://www.bosmos.ai