Last updated: October 2, 2026
This policy sets the rules for using the hosted Bosque service operated by Bosque Technologies Inc. ("Bosque", "we"). It is part of our Terms of Service. "You" means the organization that owns the workspace and everyone who uses it with your permission. You are responsible for your users' compliance.
It does not apply to Bosque software that you run yourself. That use is governed by the Elastic License 2.0.
1. Data you must not put in the Service
The Service is built for product planning, customer feedback, research, and knowledge. It is not designed, certified, or intended to protect the categories below. Do not upload, enter, or send them, or connect sources that contain them:
- Protected health information and patient data, including individually identifiable health information about patients, such as medical records, diagnoses, treatment, images, or scan data that can be linked to a person, whether or not a law such as HIPAA applies
- Payment card data, including full card numbers, security codes, and bank account credentials
- Government identification numbers, such as social security, social insurance, passport, driver's licence, and tax numbers
- Biometric and genetic data used to identify a person
- Authentication secrets for systems you don't control: passwords, private keys, and tokens
- Information about children under 16, including from research participants and feedback submitters
- Data that is classified, or that is subject to export control or other restrictions that the Service cannot meet
- Other special categories of personal data, such as political opinions, religious beliefs, sexual orientation, and criminal records, unless the person has consented and you have a lawful basis, and you really need them
- Precise location, financial, employment-screening, or other highly sensitive data where misuse or exposure could create a material risk of harm, unless we have agreed in writing that the Service is suitable for it
Business contact details of your customers and research participants, such as name, email address, phone number, organization, job title, and the products they use, are expected content. Collect only what you need, and tell the people concerned how you use it.
If you put prohibited data into the Service, you do so at your own risk. We may delete it, suspend access, and ask you to remove it, and you are responsible for any resulting obligations, including notices.
2. Content and conduct you must not engage in
You must not use the Service to:
- break the law, or help someone else to
- infringe or misappropriate anyone's intellectual property, privacy, publicity, or other rights, including by uploading, importing, or transcribing material you have no right to use, such as pirated documents, or videos and websites you have no right to copy
- collect or process personal data without a lawful basis and any required notice or consent, including through a public feedback portal
- send spam, phishing, or deceptive messages, or run scams
- upload or share malware, or content that harms systems or people
- create, store, or share content that is unlawful, harassing, threatening, hateful, sexually exploitative, or that promotes violence or self-harm
- impersonate a person or organization, or misrepresent who you are
- conduct unlawful surveillance, stalking, profiling, discrimination, or exploitation
- scrape, enrich, or assemble personal data at scale, or identify or re-identify a person, without a lawful basis and all required notices and consents
- misuse public links and portals to host content unrelated to your use of the Service
3. Using AI features responsibly
You must not use the AI features to:
- generate malware, or content designed to deceive or harm, such as fraud, disinformation, or impersonation
- make fully automated decisions that have legal or similarly significant effects on a person, such as employment, credit, housing, or insurance, without meaningful human review
- give professional advice that needs a licensed professional, such as medical, legal, or financial advice, without review by one
- try to bypass safeguards, extract hidden instructions, or manipulate the system into doing something not intended, including attempts at prompt injection against other users' workspaces
- develop or train a competing AI model or service with the outputs, or use the outputs to do so
- generate content that you know infringes someone's rights
- infer sensitive traits about a person, or rank, profile, or target people in a way that is unlawful, deceptive, discriminatory, or likely to cause material harm
You are responsible for checking AI output before you rely on it or share it.
4. Security and system integrity
You must not:
- probe, scan, or test the vulnerability of the Service, or breach or get around its security or authentication measures, without our prior written permission. To report a vulnerability, email hello@bosque.cc with the subject "Security"
- access data, workspaces, or accounts that are not yours, or try to
- interfere with or disrupt the Service, its infrastructure, or other users, including through denial-of-service attacks or excessive load
- bypass plan limits, rate limits, or usage controls
- use automated means such as bots, scrapers, or scripts to access the Service, except through our documented agent (MCP) access and integrations, and within their limits
- share credentials or tokens, or use another person's
- remove, alter, or conceal service notices, attribution, provenance, or usage measurements
- use the Service in a way that consumes unreasonable resources, degrades the Service for others, or circumvents storage, seat, AI, or other usage limits
- reverse engineer the hosted Service, except as the law allows or as the Elastic License 2.0 allows for the source code
5. Commercial misuse
You must not resell, sublicense, or provide the Service to third parties, or use it to build or benchmark a competing product or service. Use of the Service is for your organization's internal business purposes. If you want to offer Bosque to others, you need a commercial license: see our licensing guide.
6. Third-party services
When you connect third-party services, such as Google Drive, Microsoft, Notion, Confluence, or YouTube, you must follow their terms, and import only content you have the right to use.
7. Enforcement
We may investigate suspected violations. If we conclude a violation has occurred, we may, in our discretion and depending on severity:
- remove or disable content
- warn you
- limit, suspend, or terminate access to a workspace or account
- report the violation to law enforcement or the affected parties
- take other legal action
Where it is reasonable and lawful, we will give notice and a chance to correct the problem first. We may act immediately to protect the Service, our users, or others. We are not obliged to monitor the Service, but we may.
8. Reporting
To report a violation of this policy, email hello@bosque.cc with the subject "Abuse". To report a security issue, email hello@bosque.cc with the subject "Security".
9. Changes
We may update this policy, with notice as described in our Terms. The version on this page applies.