Privacy Policy
Last updated: October 14, 2026
This policy explains what personal data AI Bosala collects when you use our website and mobile app, why we collect it, who we share it with, and what your rights are. The service is intended for people aged 16 or older.
Who we are
AI Bosala ("we", "us") runs the AI Bosala website and mobile app, and is the controller of the personal data described in this policy. Please send all privacy questions and requests to contact@bosala.ai.
Data we collect and why
The table below shows what we collect, what we use it for, and the legal basis under the GDPR.
| What we collect | Why | Legal basis |
|---|---|---|
| Account details: name, username, email, password (stored hashed), profile picture, language, time zone, preferred currency, login times and failed-login counters. If you sign in with Google or Apple, we receive your name, email, picture link and their account ID. | Create and run your account, sign you in, protect it from unauthorised access. | Contract (providing the service); legitimate interests (account security). |
| Your activity: saved tools, followed categories, daily check-ins and streaks, course enrolments and progress, notifications and notification preferences. | Provide and personalise the features you use. | Contract. |
| Radar alerts: the tools and categories you follow, when you last opened your Radar page, whether you switched Radar alerts and the optional Radar email on, and, if you switched the email on, when you did and when we last sent it. If you use the app without signing in, these are linked to your device. | Tell you, in the app, by notification and only if you ask for it by email, when a tool you watch goes offline or comes back, or when a new tool is added to a category you follow. | Contract (the alerts you ask for). The Radar email is optional and stays off until you switch it on: consent. |
| "Find the right tool" searches: the text you search for, kept only as anonymous daily counts (no account, device, IP address or time of day; text that looks personal, such as an email address or a link, is not kept). If you ask us to add a tool, we keep your request text and, if you choose to give one, your email address. | Improve what we offer and answer your request for a missing tool. | Legitimate interests (the anonymous counts). Your request (the optional email address: consent). |
| Chat messages (app): your conversations with the in-app assistant, linked to your account, or to your device if you are not signed in. The assistant is rule-based; messages are not sent to an external AI service. | Run the assistant, show your chat history and let you delete it. | Contract. |
| Subscription and payment (website): email, plan, customer references at the payment provider, and card type, last four digits and issuing bank as returned by the provider. We do not receive your full card number. | Process payments, manage your subscription, keep accounting records. | Contract; legal obligation (accounting and tax records). |
| Messages to us: contact form content and emails. | Reply to your enquiry. | Legitimate interests; contract if it concerns your account. |
| Newsletter: email address and the date you consented. | Send the newsletter (double opt-in, with an unsubscribe link in every email). | Consent. |
| Device data (app): hashed install ID, platform, OS and app version, device model, language and time zone, session tokens (hashed) and push notification token. | Run the app, keep you signed in, deliver push notifications, fix technical problems. | Contract; consent for push notifications (you can turn them off in your device settings). |
| Security and server data: IP address, browser or app type and request details in server logs and short-lived rate-limit counters; error reports. | Keep the service secure, prevent abuse, fix errors. | Legitimate interests. |
| Website analytics: pages viewed and device and browser information. Only runs after you consent. | Understand and improve the website. | Consent. |
| App analytics and crash data: usage events (such as screen views, searches including the search text, tool opened, chat message sent, sign-in), an app-instance ID, and crash reports. | Understand how the app is used, improve it, fix crashes. | Legitimate interests. Analytics is on by default in the app; you can object at any time or ask us at contact@bosala.ai to switch it off. |
Tool website checks: to tell you when a tool you watch goes offline, we automatically visit the public web address of tools that someone watches and note whether it can be reached. These checks involve no personal data about you or anyone else; we store only the result for the tool.
You are not required to give us this data, but without account details we cannot provide account features. We do not sell your personal data.
International transfers
Some of our providers are located outside the EU/EEA (for example in the United States). Where personal data is transferred outside the EU/EEA, we rely on safeguards such as the European Commission's standard contractual clauses or the EU-US Data Privacy Framework, where applicable. You can ask for more information at contact@bosala.ai.
How long we keep data
| Data | Retention |
|---|---|
| Account | Until you delete your account. Deactivated accounts are kept until reactivated or deleted. Accounts that are never verified are deleted after 30 days. |
| Chat conversations | Deleted automatically after 12 months; you can delete them at any time before that. |
| Unused guest and device records | Deleted after 12 months without use. |
| Notifications and daily content | Read notifications 90 days and all notifications 180 days; personalised daily content 60 days. |
| Followed tools and categories, Radar settings | Until you unfollow them or delete your account. The Radar email can be switched off at any time, and every Radar email has an unsubscribe link. |
| Searches and tool requests | Anonymous search counts 180 days; the email address of a tool request 90 days and the request itself 12 months. |
| Newsletter | Until you unsubscribe or delete your account. |
| Payment records | When you delete your account we anonymise payment records and keep the transaction facts (amount, date, plan and payment-provider reference) for as long as accounting and tax rules require; card details and customer codes are removed. |
| Contact messages | As long as needed to handle your request. |
| Security data and technical records | Short periods, as needed for security and troubleshooting. |
| Analytics and crash data | According to the retention settings of our analytics providers. |
Deleting your account: you can delete it in the app (Settings), on the website at /account/delete, or by emailing contact@bosala.ai. Deletion is permanent and cannot be undone. If you signed in with Apple, we revoke the sign-in link with Apple.
Your rights
You have the following rights regarding your personal data:
Access
You can ask whether we process your data and request a copy of it.
Rectification
You can edit your profile in your account settings, or ask us to correct inaccurate or incomplete data.
Erasure
You can delete your account and data as described above, subject to exceptions required by law (such as accounting records).
Data portability
You can receive the data you gave us in a structured, machine-readable format, from your account settings ("Download my data") where available, or by emailing us.
Restriction
You can ask us to restrict the processing of your data in certain cases, for example while you contest its accuracy.
Objection
You can object to processing based on our legitimate interests, including analytics in the app.
Withdrawing consent
Where we rely on your consent (analytics cookies, newsletter, push notifications) you can withdraw it at any time, without affecting what happened before: through "Cookie settings", the unsubscribe link in the newsletter, or your device's notification settings.
How to exercise your rights: use your account settings, /account/delete to delete your account, or email us at contact@bosala.ai. We respond within one month of receiving your request, and may ask you to confirm your identity.
Children
The service is intended for people aged 16 or older. We do not knowingly collect personal data from anyone under 16, and if we learn that we have, we will delete it.
Security
We take reasonable measures to protect your data, including encrypted connections (HTTPS), storing passwords only in hashed form, and limiting access to personal data to those who need it. No online service is completely secure, so we cannot guarantee absolute security.
Automated decisions
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. Personalisation, such as daily picks and suggested content, is not such a decision.
Changes to this policy
We may update this policy from time to time. For material changes we will give notice on the website or in the app. The date of the latest update is shown at the top of this page.
Complaints
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live, work, or where the alleged infringement took place. We would welcome the chance to address your concerns first, by email.
Contact us
For questions about this policy or to exercise your rights, please contact us:
- Email: contact@bosala.ai
- Website: https://bosala.ai/
Effective Date: October 14, 2026