Bossreach · Terms of Service · Privacy Policy · Data Processing Addendum · Subprocessors · Acceptable Use Policy
Bossreach Privacy Policy
Operator: Final Boss Games, operating Bossreach ("we")
Effective: October 9, 2026 · Last updated: October 11, 2026
Privacy contact: privacy@bossreach.io · [mailing address]
1. Who this covers, and our role
| You are... | Our role | What applies |
|---|---|---|
| A user of Bossreach (a customer's staff member) or a visitor to bossreach.io | We decide how your data is used ("controller"; CCPA "business") | This policy |
| A contact in a customer's CRM, a person a customer emails, or a visitor or form-filler on a customer's website built with Bossreach CMS | We process your data for that customer, on their instructions ("processor"; CCPA "service provider") | The customer's privacy policy. Contact them first; we will forward requests we receive |
| A business contact that Final Boss Games itself reaches out to using Bossreach (for example for our own games or projects) | Controller | This policy, Section 4 |
2. Data we collect about users and visitors
| Data | Source | Why | Kept for |
|---|---|---|---|
| Name, work email, profile photo, organisation, role | You, or your Google sign-in | Account and access control | While your account exists; deleted within 30 days after you ask us |
| Request logs (time, IP address, browser) | Automatically, by our hosting provider | Security, abuse prevention, debugging | A few days in Cloudflare's logs; IP addresses used to limit request rates are kept for at most one hour |
| Settings, API keys you add (encrypted), usage events | You / automatically | Run the Service | While your organisation exists |
| Contact form and support messages | You | Answer you | Until we no longer need them to answer you, or you ask us to delete them |
3. How we use it
To provide and secure the Service, communicate with you about your account, respond to support requests, improve the Service using aggregated statistics, and comply with law. We do not sell or share your data for cross-context behavioural advertising, and we do not use it to train AI models.
4. Business contacts we email for our own outreach
When Final Boss Games uses Bossreach for its own outreach, we may collect business contact information from public sources: company websites, public business directories and registers, public social profiles, and business-data providers (Hunter, Apollo, People Data Labs).
- Data: name, business email, job title, company, company website and public social profile URL, and our message history with you, including whether an email was delivered, opened or clicked.
- Why: to contact you about a possible business relationship (our legitimate interest in business-to-business outreach).
- Kept for: until you ask us to stop or to delete it, or until we no longer need it. If you unsubscribe or ask to be erased, we keep only your email address and the opt-out on a suppression list so we never contact you again.
- Your choices: every email has a one-click unsubscribe link. You can also email privacy@bossreach.io to see or delete your data.
5. Who we share data with
- Service providers (subprocessors) listed at bossreach.io/legal/subprocessors, under contracts that limit their use of the data. This includes AI providers for optional features, which receive only what is needed for the task and do not train on it.
- The customer you work for, if you are a user in their organisation.
- Legal and safety: when required by law or to protect rights and safety.
- Business transfer: if the Service or its operator is reorganised (for example into a company) or sold, data may transfer to the successor under this policy.
6. Cookies and similar technology
bossreach.io uses only strictly necessary browser storage for sign-in and settings. It runs no analytics and no advertising trackers, so there is nothing to consent to and no cookie banner. Email open and click tracking (where a customer has it on) uses a tiny image and link redirects; you can block it by turning off remote images in your email app.
7. Your rights
Depending on where you live (including California under the CCPA/CPRA, and the EU/UK under GDPR), you can ask to:
- know and access the personal data we hold about you, and get a portable copy;
- correct it;
- delete it;
- opt out of sale or sharing (we do neither) and limit use of sensitive data (we do not collect it);
- object to or restrict processing, and withdraw consent;
- not be discriminated against for using these rights.
How: email privacy@bossreach.io. We will confirm your identity (usually by replying from the email address involved) and respond within 45 days (California) or one month (EU/UK). An authorised agent can act for you with your signed permission. EU/UK residents may complain to their data protection authority.
Legal bases (EU/UK): contract (to provide the Service to users), legitimate interests (security, product improvement, B2B outreach), consent (where we ask for it), legal obligation.
8. International transfers
We are based in the United States and our providers process data in the US and elsewhere. For EU/UK data we rely on the EU Standard Contractual Clauses and UK Addendum, or the EU-US Data Privacy Framework where a provider is certified.
9. Security
We use encryption in transit, encrypted secret storage, role-based access and per-organisation separation. No system is perfectly secure, and we hold no security certifications. We will notify affected people and customers of a data breach as the law requires.
10. Children
Bossreach is a business service for adults. We do not knowingly collect data from anyone under 16. Contact us and we will delete it.
11. California notice at collection (summary)
Categories collected in the last 12 months: identifiers (name, email, IP address), professional information (job title, company), internet activity (usage and email engagement events), and inferences we do not create. Sources: you, your organisation, public websites and directories, business-data providers. Purposes and retention: Sections 2 to 4. Sold or shared: none. Sensitive personal information: none.
12. Changes
We will post changes here, update the date, and email account owners about material changes at least 30 days before they apply.
Changes log
| Date | Change |
|---|---|
| 2026-10-04 | Earlier version published at bossreach.io/privacy. |
| October 11, 2026 | We no longer record a terms acceptance per user. |
| October 9, 2026 | Rewritten: operator name, role table, own-outreach section, full subprocessor link, rights, transfers, California notice. |
Bossreach is operated by Final Boss Games · [mailing address] · privacy@bossreach.io