Effective date: October 2, 2026 Last updated: October 2, 2026
This Privacy Policy explains how Bosque Technologies Inc. ("Bosque", "we", "us") collects, uses, shares, and protects personal information when you visit our website at https://bosque.cc or use our hosted Bosque service (together, the "Service"), and the choices and rights you have.
1. Who this policy covers
Bosque is a workspace where organizations plan products, collect customer feedback, keep research, and build a knowledge library with an AI assistant. That means we handle personal information in two different roles:
| Role | Whose information | What it means |
|---|---|---|
| Controller (we decide why and how it's used) | People who visit our website, create an account, contact us, or pay us | This policy explains how we use it. |
| Processor (we handle it for our customer) | Anything an organization puts into its workspace, such as its customers' details, research participants, and people who send feedback through a portal | Our customer, the organization that owns the workspace, decides why and how it is used. We process it on its instructions under our Data Processing Addendum. |
If you are a customer of one of our customers, for example you submitted feedback through a portal, were interviewed, or appear in a customer record, the organization that owns the workspace is responsible for your information. Please contact that organization first for questions and requests. We will help them respond.
Self-hosted Bosque. If an organization runs Bosque on its own infrastructure, we do not receive its data, and this policy does not apply to that install. Bosque does not send telemetry or usage data from self-hosted installs to us. That organization is responsible for the data in it.
2. Information we collect
Information you give us
- Account information. Your name, email address, profile picture, and sign-in details when you create an account. If you sign in through a third-party identity provider, we receive what the provider shares with us, such as your name and email address.
- Profile and workspace details. Your job title and department, your workspace's name, branding, industry, team type, and website, and your role and membership in a workspace and its organization.
- Billing information. If you subscribe, our payment processor collects your payment details. We do not store full card numbers. We receive and keep a customer reference, billing contact name and email, plan, status, and invoice history.
- Communications. Messages you send us, such as support requests, and our replies.
- Transaction and agreement records. Records of subscriptions, cancellations, acceptance of terms, notices, and other events needed to administer the customer relationship and establish or defend legal rights.
Content in your workspace
Your workspace holds content that you and your colleagues add, including documents and files, articles, backlog items, comments, goals, roadmap material, chat messages and attachments, and notes. It can also include:
- Customer records: names, email addresses, phone numbers, organizations, job titles, specialties, cities and countries, products and device models and serial numbers, interactions, and testimonials
- Research material: interview recordings, transcripts, notes, and highlights, which can include what research participants say and their voices
- Feedback submissions: the text, attachments, and the name, email address, and company of people who send feedback through a portal
We process this content to run the Service for the workspace owner, as its processor. We do not look at it except as needed to provide the Service, keep it secure, give support you ask for, or comply with the law.
Information from integrations you connect
If a workspace administrator connects services such as Google Drive, OneDrive, SharePoint, Notion, Confluence, Microsoft Teams, or YouTube, we receive the content and account details those services share, based on the permissions granted. For the Microsoft Teams bot, we also keep a link between a Teams user and a Bosque account, based on email address, and the conversations the bot has.
Information collected automatically
- Usage and technical data. IP address, browser and device type, pages and features used, time stamps, and error and performance information, collected in our logs and by our infrastructure providers so that we can run, secure, and troubleshoot the Service.
- Security and access records. Records of access to workspaces, such as sign-ins, role changes, and when a person was added or removed, and logs of calls made through agent (MCP) access tokens.
- Cookies and similar technologies. See Section 8.
3. How we use information
| Purpose | Examples | Legal basis (where GDPR or similar law applies) |
|---|---|---|
| Provide the Service | Create accounts and workspaces, authenticate you, store and show your content, power search and the AI assistant, send service messages | Performance of a contract |
| Process payments | Start and renew subscriptions, issue invoices, prevent fraud | Performance of a contract; legal obligation |
| Secure the Service and prevent abuse | Detect and stop unauthorized access, enforce our policies, troubleshoot | Legitimate interests |
| Support | Answer your questions and requests | Performance of a contract; legitimate interests |
| Improve the Service | Understand which features are used and fix problems, using aggregated or de-identified information, never by training AI models on your workspace content | Legitimate interests |
| Communicate with you | Service announcements, security notices, and changes to our terms. We send marketing email only where the law allows, and you can opt out at any time | Legitimate interests; consent where required |
| Comply with the law | Tax, accounting, and responding to lawful requests | Legal obligation |
| Establish and defend rights | Keep records of assent, investigate disputes, enforce our agreements, and make or defend legal claims | Legitimate interests; legal obligation where applicable |
Where we rely on legitimate interests, we balance them against your rights and interests.
4. AI processing
The Service includes AI features: an assistant that answers questions using your library, AI writing help in the editor, and generated summaries, feedback themes, digests, and transcripts. To provide them, we send the content needed for the request, such as your prompt and the relevant passages of your documents, to AI providers listed on our Subprocessors page. Today that is OpenAI. Documents you add to your library are also converted into numerical representations (embeddings) so they can be searched, using the same provider.
- We do not use your workspace content to train AI models, and our agreements with these providers are meant to prevent them from using it to train theirs. We choose providers and settings accordingly and describe changes on the Subprocessors page.
- Content is sent to a provider only when a feature that needs it is used.
- Web search is optional. If it is turned on, the question you ask, and context needed to answer it, is sent to the provider's search tool.
- AI output can be inaccurate. See our Terms of Service.
5. How we share information
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
We share information only as follows:
- Service providers (subprocessors). Companies that help us run the Service under contracts that restrict their use of the information. They provide hosting and database services, authentication, AI processing, payment processing, file uploads, document and audio processing, and connectors. See Subprocessors.
- Within your workspace and organization. Information you add is visible to others in your workspace according to its roles and permissions. Your name, picture, and activity are visible to those people.
- People you share with. Public links, feedback portals, shared roadmaps, and shared pages show their content to anyone with the link. Workspace administrators control these.
- Integrations and agents you connect. When you connect a third-party service or issue an agent token, we send or make available the information needed for it to work.
- Legal and safety. To comply with law, legal process, or enforceable government requests; to enforce our terms; and to protect the rights, property, and safety of us, our users, and the public. Where lawful, we will tell the affected customer.
- Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred, subject to this policy or a notice of change.
- With your consent or at your direction.
- Aggregated or de-identified information that does not identify you.
6. International transfers
We and our providers may process information in the United States, Canada, the European Economic Area, and other countries, which may have different data protection laws than where you live. Where required, we use approved transfer mechanisms, such as the standard contractual clauses and the UK addendum, or other lawful safeguards, with our providers and customers.
7. How long we keep information
| Information | How long |
|---|---|
| Account and profile information | While your account is active, and for a short time afterwards to close it out and for legitimate record-keeping |
| Workspace content | While the workspace is active and for a limited period afterwards as needed to close the account, permit an export where available, meet legal obligations, resolve disputes, and complete ordinary deletion processes |
| Backups | Until overwritten or removed through our and our providers' ordinary backup-rotation and disaster-recovery processes |
| Billing records | As long as tax, accounting, and other legal requirements demand |
| Security and access logs | For a limited period set by our providers and our security needs |
| Communications with us | As long as needed to handle your request and keep a record of it |
We may keep information longer where the law requires, to resolve disputes, investigate abuse, establish or defend legal claims, or enforce our agreements. We isolate and restrict information retained for those purposes where reasonably practicable. When a Clerk user account is deleted, we mark the user as deleted and revoke their access to workspaces. Content they contributed to a workspace stays in that workspace, because it belongs to the workspace owner.
8. Cookies and similar technologies
We use only what's needed to run the Service:
- Essential cookies. Our authentication provider, Clerk, sets cookies that keep you signed in and protect your session. The Service doesn't work without them.
- Local storage and similar browser storage. Used to remember interface preferences, such as sidebar state and display choices, and to keep a local copy of Knowledge Base pages so they load quickly. The local copy is cleared when you sign out.
We do not use advertising cookies or third-party analytics trackers on the Service. If we add analytics, we will update this policy and, where the law requires, ask for your consent first. You can block or delete cookies in your browser settings, but the Service may then not work correctly.
9. Security
We use reasonable administrative, technical, and organizational measures to protect personal information, such as access controls between workspaces and by role, encrypted connections, scoped and revocable access tokens, and access logs. Our providers add their own safeguards. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If you find a vulnerability, please report it by email to hello@bosque.cc with the subject "Security".
If a breach affects personal information, we will notify the people and authorities that we are required to, as the law requires.
10. Your rights and choices
Depending on where you live, you may have the right to:
- access the personal information we hold about you and get a copy
- correct inaccurate information
- delete your information
- restrict or object to some processing
- receive your information in a portable format
- withdraw consent you gave us, at any time
- opt out of the sale or sharing of personal information (we do neither)
- not be discriminated against for exercising your rights
- complain to a data protection authority
How to exercise them. Email our Privacy Officer at hello@bosque.cc. We may need to verify your identity or authority, and we will respond within the time the law requires, normally within 30 days. You can update much of your account information yourself through your account settings. Requests may be subject to lawful exceptions, and we may retain information that we are legally required or permitted to keep.
Requests about workspace content. If your request concerns information in a customer's workspace, we will usually refer you to that customer, as it is responsible for the data. We will help them respond, and we won't respond to you directly about that content except as the law requires.
Region-specific information.
- European Economic Area and United Kingdom. For information where we are the controller, you have the rights above under the GDPR and UK GDPR. You can complain to your local supervisory authority.
- California. You have the rights described under the CCPA and CPRA, including to know, delete, correct, and limit use of sensitive information. We do not sell or share personal information as those laws define them.
- Canada. You have rights of access and correction and can withdraw consent under PIPEDA and applicable provincial laws, including British Columbia's Personal Information Protection Act and Quebec's private-sector privacy law. You can contact our Privacy Officer and then the Office of the Privacy Commissioner of Canada or the applicable provincial authority.
- Automated decisions. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
11. Children
The Service is for business use and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it. Workspace owners must not submit information about children unless the Acceptable Use Policy allows it.
12. Third-party sites and services
The Service links to and connects with websites and services we don't control, and this policy doesn't apply to them. Read their privacy policies before you use them.
13. Changes to this policy
We may update this policy. If a change is material, we will tell you in the Service or by email before it takes effect, and we will change the date at the top. We keep earlier versions available on request.
14. Contact us
Bosque Technologies Inc. Vancouver, British Columbia, Canada Privacy Officer, questions, complaints, and requests: hello@bosque.cc
If we are required to appoint a data protection officer or a representative in the EEA or the UK, we will list them here.