Privacy notice

Who we are

We are Bosla ("Bosla", "we", "us"). We are responsible for the personal data described in this notice. You can reach us about privacy through the contact page on this website, choosing "Privacy request".

What this notice covers

This notice covers the Bosla website, the Bosla app on the web and on your phone's home screen, and our support. It applies to everyone who uses Bosla, including people invited into a household by someone else.

What we collect

Information you give us

• Your account: your name, email address, phone number if you add one, profile photo if you add one, and your language.
• Your household: its name, country, currency, pay cycle and the people in it with their roles.
• What you enter: accounts and balances, spending and income, transfers, bills, budgets, goals, debts, investments, shopping lists and prices, children's jars and chores, notes and vault notes.
• Files you choose to upload: receipt photos, statements and documents in the vault.
• Bank alert emails you choose to forward to your Bosla address.
• Questions you ask Ask Bosla, and your choice about what Ask Bosla may share.
• Messages you send us through Help, the contact page or email.

Information collected when you use Bosla

• Sign-in and security records: when you signed in and from which device type, to keep your account safe.
• Error reports: if something breaks, the error message, the screen and the app version, without your financial data.
• Usage counts, only if you say yes: which screens are used, your language and a random device id that is not linked to your account. Never amounts, names or shop names.

Information from others

• Payment providers tell us whether a payment succeeded and the plan bought. They never give us your full card number.
• If an employer gives you Bosla through the Workplace plan, they tell us your work email so we can invite you. They never see your money.

We do not connect to your bank and we never ask for bank passwords, PINs or card numbers.

Why we use it

• To provide Bosla: to show your safe-to-spend amount, budgets, goals and everything else you use, and to keep it in sync across your devices and with your household. (Legal basis: our contract with you.)
• To read what you ask us to read: receipts, statements and bank emails you choose to send, and questions you ask Ask Bosla. (Contract.)
• To take payments for paid plans. (Contract.)
• To keep Bosla safe: preventing fraud and abuse, protecting accounts and fixing errors. (Our legitimate interest in running a secure service.)
• To support you when you write to us. (Contract and legitimate interest.)
• To improve Bosla using usage counts, only if you said yes. (Consent, which you can withdraw at any time.)
• To measure outcomes, such as how financial health scores change, only as totals for groups of five or more households, so no household can be identified. (Legitimate interest.)
• To meet legal duties, such as keeping payment records. (Legal obligation.)

We do not sell your data, rent it, or use it for advertising. We do not make decisions about you that have legal or similar effects based only on automated processing.

Bosla AI

Bosla AI uses Google Gemini through our paid account.

• Receipts and statements: the photo or file you choose is sent once to be read. You check the result before it is saved.
• Bank emails: the text of an alert is sent only when our own simple reading cannot understand it.
• Ask Bosla: a short summary of your totals is sent with each question, and shop names only if you allowed it. We do not store your questions or Bosla AI's answers on our servers; your chat stays on your device.
• Under our agreement with Google, this content is not used to train AI models. Bosla does not use your data to train AI either.
• You can use your own AI key instead, in Settings, so requests go through your own account with the AI provider.

Who can see your information

• People in your household, according to their role. Children see only their own goals. Viewers can look but not change anything. Vault notes are seen only by the people you choose, when you choose.
• Bosla staff can see account details only (email, plan, country and dates) to run the service and help you. They cannot see your entries, receipts, balances or vault. Every time staff open a household's details, it is recorded. If you send us a message, we read what you wrote.
• Service providers that run parts of Bosla for us, under contracts that only let them use your data to provide their service:

• Authorities, only when the law requires it, and we will tell you unless we are not allowed to.
• If Bosla is ever sold or merged, your data would move with it under this notice, and we would tell you first.

Where your data is kept

Your data is stored by Supabase on Amazon Web Services in Mumbai, India, and some providers above work from other countries. Your data may therefore be processed outside the country where you live. When it is, we rely on the safeguards the law requires, such as contracts with standard data protection terms. Before full launch we plan to keep data in regions that meet each country's rules, and we will update this notice when we do.

How we protect it

• Data is encrypted in transit and at rest.
• The privacy lock lets you lock shop names, notes, receipt photos, statements and vault notes on your device before they are saved. The key is never sent to us.
• Access is limited by role, both in your household and in our team, and staff access is logged.
• You can lock the app on your phone with your face, fingerprint or a PIN.

No system is perfectly secure. If a breach affects your data, we will tell you and the authorities as the law requires.

How long we keep it

• Your account and household data: for as long as you use Bosla. When you delete a household or your account, it is removed straight away from the live service and from backups within 30 days.
• Guest accounts that are not turned into a full account: 30 days.
• Forwarded bank emails: not stored. We keep only the amount, date, shop and last four card digits as a proposed entry.
• Payment records: as long as tax and accounting law requires.
• Support messages: up to 3 years after the conversation closes.
• Usage counts and error reports: up to 14 months.

Your rights and choices

Depending on where you live, including under UAE, Omani and Nigerian data protection laws and the GDPR, you may have the right to:

• see the data we hold about you and get a copy,
• correct it,
• delete it,
• take it with you in a common format,
• object to or limit some uses, and
• withdraw consent at any time, without affecting what happened before.

Most of this you can do yourself: download your data in Settings → Your data, change it anywhere in the app, and delete your household or account in Settings → Delete. For anything else, send a privacy request through the contact page. We will answer within one month. You can also complain to the data protection authority where you live.

Children

Bosla accounts are for adults. A parent or guardian can add a child to their household and give them a child role, which shows only the child's own goals. We do not knowingly let children open accounts on their own.

Cookies

The website and app use only what they need to work: keeping you signed in, remembering your language, country and settings. We do not use advertising or tracking cookies. See the Cookies notice for details.

Changes to this notice

We will update this notice when Bosla changes. If a change is important, we will tell you in the app or by email before it takes effect. The date at the top shows the latest version.

Contact

Questions or requests: use the contact page and choose "Privacy request".