Privacy Policy

Effective date: September 21, 2026

This Privacy Policy explains how BotBoss (“BotBoss,” “we,” “us,” or “our”) collects, uses, stores, shares, and protects information when you use the BotBoss platform, website, and related applications and integrations (collectively, the “Service”), including our integrations with Intuit QuickBooks, Google Workspace (Gmail and Google Drive), and bank and financial account data accessed through Plaid.

By using the Service you agree to the practices described here. If you do not agree, do not use the Service.

1. Who we are

BotBoss provides an AI-assisted finance and operations platform that connects to the business systems you authorize — including accounting systems such as Intuit QuickBooks, productivity systems such as Google Workspace, and bank and financial accounts you link through Plaid — and helps you and your team review, analyze, and act on that data.

Contact: legal@botboss.com

2. Information we collect

a. Information you provide

• Account and contact details (name, email, organization).
• Configuration and preferences you set in the Service.
• Content you submit, including messages, questions, and files.

b. Information from connected systems

When you connect a third-party system, you authorize BotBoss to access data from that system on your behalf via that provider’s API. For Intuit QuickBooks, this may include:

• Company and organization profile information.
• Accounting data such as accounts, transactions, invoices, bills, payments, customers, vendors, items, and reports.
• Other data fields exposed by the QuickBooks API and covered by the scopes you approve during authorization (OAuth).

We only request the access scopes needed to provide the features you use, and we access your QuickBooks data solely to provide and improve the Service for you.

For Google Workspace (Gmail and Google Drive), this may include:

• Gmail message content, metadata, labels, and attachments (read-only).
• Drafts created in your Gmail account on your behalf.
• Google Drive file content and metadata (read-only).

We access only the data within the OAuth scopes you approve. See Section 9 for the full scope description and capability boundaries.

For bank and financial account data accessed through Plaid, this may include:

• Account information such as account name, type, and a masked (last-four) account number.
• Transaction history, balances, and related metadata.

You link your own financial accounts through Plaid Link, which authenticates you directly with your bank; BotBoss never receives or stores your online-banking username or password. Our access is read-only. See Section 10 for details.

c. Information collected automatically

• Usage and diagnostic data (log events, timestamps, feature usage).
• Device and connection metadata (IP address, browser type) used for security and reliability.

We do not knowingly collect data from anyone under the age of 18. The Service is intended for business use.

3. How we use information

We use information to:

• Provide, operate, and maintain the Service.
• Connect to and synchronize data from systems you authorize, including QuickBooks, Google Workspace, and Plaid.
• Generate analyses, summaries, answers, and recommendations you request.
• Secure the Service, prevent abuse, and troubleshoot issues.
• Communicate with you about your account and the Service.
• Comply with legal obligations.

We do not sell your personal information or the data we access from your connected systems (including your QuickBooks data, Google user data, and Plaid financial data), and we do not use that data for advertising.

4. Artificial intelligence and third-party processing

The Service uses large language models (LLMs) and related AI technology to process your requests and produce analyses and responses. To do this, relevant content — which may include data retrieved from QuickBooks, Google Workspace, Plaid, or other connected systems — is transmitted to and processed by trusted third-party AI providers (Anthropic, and OpenAI for audio transcription) acting as our subprocessors under contractual data protection and confidentiality obligations.

These providers process the data only to return results to BotBoss and are contractually restricted from using your data to train their general-purpose models, except as permitted under their applicable terms and our configuration. We limit the data sent to what is reasonably needed to fulfill your request.

5. How we share information

We share information only as follows:

• Service providers / subprocessors — infrastructure, hosting, and AI providers who process data on our behalf under confidentiality and data protection terms. They are listed in “Subprocessors” below.
• At your direction — with people, channels, or systems you choose to connect or share with (for example Slack, Microsoft Teams, or your email), and with the connected systems you authorize, such as QuickBooks, Google Workspace, or Plaid.
• Legal and safety — when required by law, regulation, legal process, or to protect the rights, property, or safety of BotBoss, our users, or others.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

We do not sell or rent your personal information to third parties.

Subprocessors

We currently use the following subprocessors to provide the Service:

We will update this list before a new subprocessor begins processing your data.

6. Data storage and security

We store data on secure, access-controlled infrastructure and apply technical and organizational safeguards including encryption in transit, encryption of sensitive credentials at rest, tenant isolation, access controls, and audit logging. No method of transmission or storage is perfectly secure, but we work to protect your information using commercially reasonable measures appropriate to its sensitivity.

7. Data retention and deletion

We retain information for as long as your account is active or as needed to provide the Service, and thereafter as required to comply with legal obligations, resolve disputes, and enforce agreements.

You may:

• Disconnect QuickBooks at any time from within the Service or from your Intuit account. Disconnection stops further data access.
• Disconnect Google at any time from within the Service (Connectors → Google → Disconnect) or directly from your Google Account at myaccount.google.com/permissions. Disconnection stops further data access.
• Disconnect a bank or financial account (Plaid) at any time from within the Service. Disconnection stops further data access; you can also review and manage the connections you have made through Plaid at my.plaid.com.
• Request deletion of your account and associated data by emailing legal@botboss.com. We will delete or de-identify your data within a reasonable period, except where retention is legally required.

8. Intuit QuickBooks data

Our access to and use of Intuit QuickBooks data complies with applicable Intuit developer terms and data-handling requirements. We access QuickBooks data only with your authorization, use it only to provide the Service to you, and do not disclose it to third parties except as described in this Policy (including subprocessors and as you direct). You can revoke our access at any time through Intuit.

9. Google Workspace data (Gmail and Google Drive)

When you connect a Google account to BotBoss, we access your Google Workspace data using OAuth scopes you approve. The exact scopes and their capabilities are:

• gmail.readonly — read-only access to your Gmail messages and metadata.
• gmail.compose — ability to create and manage email drafts in your Gmail account.

Together, these two scopes allow BotBoss agents to read your mail and create drafts on your behalf. BotBoss only exposes read and draft-creation tools to its agents and enforces this limit in code: it never sends, deletes, or modifies your messages, even though the gmail.compose scope would technically permit sending. There is no send capability anywhere in the product.

• drive.readonly — read-only access to files and metadata in your Google Drive. BotBoss cannot create, upload, delete, move, or share files in your Drive.

How this data is used. Gmail and Google Drive data is accessed solely to let your BotBoss agents assist you — for example, to answer questions about your email or documents, draft replies, or summarize information you direct the agent to review. Access is per-user: each user’s Google connection is independent and data is used only on that user’s behalf.

Revoking access. You can disconnect the Google connector at any time from within the BotBoss app (Connectors → Google → Disconnect). You can also revoke BotBoss’s access directly from your Google Account at myaccount.google.com/permissions. Disconnection immediately stops further data access.

Google API Services User Data Policy — Limited Use. BotBoss’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We do not use Google user data to serve advertising.
• We do not sell Google user data.
• We do not transfer Google user data to third parties except as necessary to provide or improve the user-facing features of the Service, to comply with applicable law, or in connection with a merger, acquisition, or sale of assets (subject to confidentiality obligations).
• We do not use Google user data to train generalized AI or machine-learning models.

10. Bank and financial account data (Plaid)

BotBoss uses Plaid Inc. (“Plaid”) to let you securely connect your bank and financial accounts. When you link an account, Plaid Link authenticates you directly with your financial institution; BotBoss never sees or stores your online-banking username or password.

What we access. With your authorization, we access read-only financial data such as account details (name, type, and a masked last-four account number), balances, and transaction history. We use this data to provide features such as cash-position and burn analysis, bank-statement retrieval for your records, and reconciliation against your accounting system.

Read-only — no money movement. Our Plaid integration is strictly read-only. BotBoss does not initiate payments or transfers, does not move money, and cannot make any changes to your accounts.

Storage. Access tokens issued by Plaid are stored encrypted, and the financial data we retrieve is stored on access-controlled, tenant-isolated infrastructure and used only to provide the Service to you.

Plaid’s role. Plaid acts as the secure conduit between BotBoss and your financial institution. Plaid’s own collection and use of your information is governed by Plaid’s privacy policy, available at plaid.com/legal (see Plaid’s End User Privacy Policy). You can review and manage the connections you have made through Plaid at my.plaid.com.

Revoking access and your choices. You can disconnect a linked financial account at any time from within the BotBoss app; disconnection stops further data access. We do not sell your financial account data, use it to serve advertising, or use it to train generalized AI or machine-learning models.

11. Your rights

Depending on your jurisdiction, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise these rights, contact legal@botboss.com. We will respond consistent with applicable law.

12. International transfers

We may process and store information in countries other than where you are located. Where required, we use appropriate safeguards for cross-border transfers.

13. Changes to this Policy

We may update this Policy from time to time. We will post the updated version here and revise the “Effective date” above. Material changes will be communicated as required by law.

14. Contact us

Questions about this Privacy Policy or our data practices:

Email: legal@botboss.com