Bosun privacy policy

Effective 8 November 2026 · Slobal, Ireland

This policy says what personal data Bosun processes, why, who receives it, how long it is kept and how you use your rights.

Controller

Taher Laskar trading as Slobal, Ireland

Contact

support@slobal.com

Mail and bank access

Read-only

Supervisory authority

Irish Data Protection Commission

1. Who we are

Taher Laskar trading as Slobal runs the Bosun service at this address. Bosun runs the routine work of a small company, such as posting, mail filing and bookkeeping support, and asks its users for the decisions.

For your account, your sign-in and your use of the service, Taher Laskar trading as Slobal is the controller. For the content a workspace holds, the organisation that owns the workspace is the controller and Taher Laskar trading as Slobal acts as its processor under a data processing agreement. The agreement and the other legal documents of a workspace are in the app under Settings, Legal documents.

Contact: support@slobal.com.

2. What data we process

• Account data. The name, email address and role of each team member, the sign-in session, and a record of what each member does in the workspace. Bosun holds no password. Sign-in goes through the identity provider of the service.
• Workspace content. What you and your team add or create: posts and drafts, brand material, files, records of people and companies, invoices, messages to the agent and the agent's answers.
• Connected account data. Only for an account you connect, and only through the permission you approve. See sections 4 and 7. A connected mailbox gives us the sender, recipients, subject, date and attachment names of messages. We read the text of a message only to find a receipt, a subscription, an invoice or a contract, and we do not keep the message text as a record. A connected bank account gives us the account details, balances and booked transactions, with the other party's name and the payment reference. A connected calendar gives us events.
• Usage and billing data. The plan, the customer and subscription references of our payment provider, invoices and credit use. We never hold card numbers. If the operator turns product analytics on, Bosun counts set-up steps under a salted identifier that does not reveal the workspace. It never sends posts, drafts, names or email addresses. A workspace owner can switch this off under Settings, Privacy and analytics. A short feedback question stores your score, your comment and your user ID.
• Logs and technical data. Request records, an audit log of actions in each workspace, and error reports. Error reports are scrubbed of secrets, email addresses, internet addresses, query strings and request bodies before they leave Bosun.
• Visitors of this website. This page runs no script, sets no cookie of its own and uses no analytics.

3. Why we use data and on what basis

We do not sell personal data. We do not use it for advertising.

4. Read-only access and approvals

• Mail access is read-only. Gmail uses the gmail.readonly scope and Microsoft 365 uses Mail.Read. Bosun never sends mail from your mailbox and never marks, moves or deletes a message in it.
• Bank access is read-only, through a bank data provider, and ends after the consent period of 90 days unless you renew it. Bosun has no call that makes a payment and never moves money.
• Bosun does not pay, sign, file or cancel anything on your behalf, and does not delete data you hold at another service. The agent has no tool for these actions.
• Other actions, such as publishing a post you connected a channel for, follow the approval mode the workspace owner sets. Without a setting, a person must approve. The agent cannot approve its own work.
• Bosun does send its own email, such as invitations, booking confirmations and sequences you set up. It sends them through the email provider of the service, not through your mailbox.

5. Inbound content is treated as data

Text from outside, such as the body of an email or the text of a web page, is wrapped as data with a random marker for each run, the marker sequences inside it are neutralised and its length is capped. After the agent reads such text in a run, the tools that change things are taken away for that run. Text from outside cannot give the agent an instruction.

6. AI processing

Bosun sends content to language model providers only to produce what you asked for. For the agent this is your message, the brand summary, the items the answer needs, the workspace memory and the last 12 messages of the conversation. For mail filing it is the sender, subject and attachment names of a message, and the text of a message that looks like a receipt, a subscription, an invoice or a contract. The agent in the chat does not receive mail text. Stored secrets are removed from what goes to a provider. A workspace owner can use its own provider key under Settings, AI providers.

Bosun does not train or fine-tune models. We do not use Google user data to build or improve a general model. The providers appear in the live list described in section 8, with a link to the terms of each.

7. Google API Services User Data Policy

Bosun's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Scopes we request. For a mailbox: gmail.readonly. For a calendar: calendar.readonly, and calendar.events only if you turn on Allow changes, which lets Bosun change only the events it created. Any other Google service you connect shows its scope on the Google consent screen.

What the Limited Use requirements mean for the data we receive from Google:

• We use it only to provide or improve the user-facing features you see in Bosun, such as the Inbox, filing rules, receipts, subscriptions and the calendar.
• We transfer it only as needed to provide those features, to follow the law, or as part of a merger, acquisition or sale of assets. Sending text to a provider named in section 6 is part of providing the feature.
• We do not use it for advertising, including retargeting and interest-based advertising, and we do not sell it.
• No person at Bosun reads it unless you give consent for specific items, for example by opening a time-limited support access grant, or it is needed for security such as investigating abuse, or the law requires it.
• We do not use it to develop, improve or train a general AI or machine learning model.

You can disconnect a mailbox or calendar in the app at any time. Bosun then stops reading and deletes its access token at once. You can also remove Bosun in the permissions page of your Google Account. Items already made from the data stay in the workspace until you delete them.

8. Who receives data

We use providers, called sub-processors, in these categories: hosting and storage, email delivery, language models and other AI services, payments, error monitoring, and the providers behind the accounts you connect, such as Google, Microsoft, your bank data provider, calendar, advertising, shop and social platforms. A provider receives data only for the feature that needs it. Disconnecting an account ends that flow.

The live list is generated from the configuration of the service. Any member of a workspace can see it in the app under Settings, Sub-processors, with the legal name, region and terms link the operator recorded for each provider. We do not publish a separate list here that could go out of date.

9. International transfers

Where data is stored depends on how the service is set up. The data region the operator set and the region recorded for each provider are shown in the app under Settings, Legal documents and Sub-processors. Some providers process data in other countries.

10. How long we keep data

• Data stays until you delete it, unless the workspace owner sets a limit. Under Settings, Data and privacy an owner can set a retention period for captured items, interactions, link clicks, comments, job history, webhook events, notifications, learning examples and funnel conversations. Bosun removes older data of these kinds every hour.
• By default, messages in the agent chat are kept for 90 days and the records of what the agent did for 400 days.
• An export archive is kept for 7 days. The download link works for 10 minutes.
• When you disconnect a mailbox, the access token is deleted at once. The items made from it stay until deleted or until a retention period removes them.
• When a workspace is deleted, the owner sets a waiting period of 1 to 30 days, 7 by default, and can cancel until it ends. Then Bosun destroys the encryption key of the workspace, deletes its files and rows including its audit trail and credit ledger, and removes its name. A short record that a deletion took place stays at instance level. Without the key, encrypted data cannot be read. A backup made before the deletion can still hold an encrypted copy until that backup expires.
• When one person is erased, Bosun deletes their records and blanks their name where a record must stay. A signature keeps its steps as evidence with the name, address and signature blanked. Our payment provider keeps its own payment records as the law requires of it.

11. Your rights and how to use them

• Access and portability. Settings, Data and privacy, Request an export. You receive an archive with one JSON file for each table, your files and a manifest. Secrets are left out.
• Erasure. Open a person in People and choose Erase permanently. To delete a whole workspace use Settings, Danger zone.
• Correction. Edit the record in the app, or write to us.
• Restriction, objection and withdrawal of consent. Write to us. You can also disconnect accounts, and change the email types you receive under Settings, Email preferences.

If you are a member of someone else's workspace, that organisation is the controller of its content, and you can ask it first. We answer a request within the time that data protection law sets, which is one month in most cases. You can also complain to your data protection authority. In Ireland this is the Data Protection Commission.

12. Security

These measures are in the product today:

• Secrets and connection tokens are encrypted with AES-256-GCM. Each workspace has its own key, wrapped by a key derived from the master key of the service. Only the last four characters of a secret are ever shown.
• Sign-in uses an external identity provider. Session cookies are HttpOnly, Secure and SameSite Lax. By default a session ends after 60 minutes idle or 12 hours in total. Requests that change data pass a same-site check.
• Every workspace table has row-level security that is forced for the application role, so one workspace cannot read another's rows.
• Bosun writes an audit log of actions in each workspace and limits requests per address and per workspace.
• Bosun has not been audited against a security standard and holds no certification.

13. Cookies

Bosun sets a session cookie and, for ten minutes while you sign in, a login cookie. A referral link sets one cookie for 30 days that records the referral code, and the sign-up code box sets one for 30 minutes. All are HttpOnly. The app also stores your light or dark theme choice in your browser. There are no advertising cookies and no analytics cookies. This page sets none of its own.

14. Children

Bosun is a business service. It is not for children, and we do not knowingly collect data about children.

15. Changes to this policy

When our use of data changes, we change this text and its effective date. This version is effective 2026-11-08.

16. Contact

Taher Laskar trading as Slobal. Email: support@slobal.com.