Privacy Policy

1. Who We Are

Business Operating System ("BOS", "we", "us", or "our") is a business management platform based in the United Kingdom. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our application at bosystem.co.uk.

We are committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data We Collect

We collect the following categories of personal data:

• Account information: your name, email address, and password (stored securely as a hash).
• Business information: business name, address, phone number, email, VAT number, and logo.
• Customer records: names, contact details, and addresses you enter for your own customers.
• Job and financial records: job bookings, invoices, estimates, earnings, and expenses you create.
• Payment information: subscription billing is handled by Stripe. We do not store your card details — these are held securely by Stripe under PCI-DSS compliance.
• Google Calendar data: if you connect Google Calendar, we access your calendar events solely to import them as jobs. We do not store raw Google Calendar data beyond what you import.
• Usage data: basic analytics such as page views and feature interactions, used to improve the platform.

3. How We Use Your Data

We use your data solely to:

• Provide, operate, and maintain the BOS platform.
• Process your subscription payments via Stripe.
• Send transactional emails (invoices, password resets, subscription notices).
• Provide customer support.
• Improve platform features and fix bugs.
• Comply with legal obligations.

We will never sell your data or use it for advertising purposes.

4. Legal Basis for Processing (UK GDPR)

• Contract performance: processing necessary to provide the service you signed up for.
• Legitimate interests: platform security, fraud prevention, and service improvement.
• Legal obligation: compliance with applicable UK law.
• Consent: for optional integrations such as Google Calendar, which you may revoke at any time.

5. Data Storage and Security

Your data is stored on secure cloud infrastructure provided by Base44 (our application platform) and Stripe (payment processing). All data is encrypted in transit using TLS and encrypted at rest.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure.

6. Data Sharing

We share your data only with the following third parties, strictly as necessary to operate the service:

• Stripe — payment processing and subscription management.
• Base44 — application hosting, database, and authentication infrastructure.
• Google — if you connect Google Calendar, or allow optional Google Analytics; governed by Google's Privacy Policy.

We do not share your data with any other third parties without your explicit consent.

7. Data Retention

We retain your data for as long as your account is active. If you delete your account, your personal data and all associated business records will be permanently deleted from our systems within 30 days, except where we are required by law to retain certain records (e.g. financial records for up to 6 years under UK tax law).

8. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten").
• Restrict processing of your data.
• Data portability — receive your data in a structured, machine-readable format.
• Object to processing based on legitimate interests.
• Withdraw consent at any time for consent-based processing (e.g. Google Calendar).

To exercise any of these rights, contact us at bosystemhelp@gmail.com. We will respond within 30 days.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

9. Cookies

Essential storage is used for authentication and your app settings. If you choose “Allow analytics”, we load Google Analytics to understand page usage. Choosing “Necessary only” leaves optional Google Analytics disabled. You can change this choice using the Cookie settings button below.

10. Children's Privacy

BOS is intended for use by businesses and individuals aged 18 and over. We do not knowingly collect personal data from anyone under 18.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via an in-app notice. The "Last updated" date at the top of this page will always reflect the most recent version.

12. Contact Us

For any privacy-related questions or requests, please contact us at:

BOS — Business Operating System
bosystemhelp@gmail.com