BOSKI Privacy Policy

BOSKI ("BOSKI," "we," "us," or "our"), operated by Whitestone Labs, Inc., respects your privacy. This Privacy Policy explains what information we collect, how we use it, how we protect it, when we share it, and the choices you have when using BOSKI.

BOSKI is a personal AI agent and productivity application that helps users delegate tasks, manage goals, organize work, plan activities, and connect supported third-party services such as Google Calendar and, if enabled, email services. BOSKI may help users create plans, summarize information, draft actions, schedule events, and perform user-authorized tasks.

This Privacy Policy is intended to describe how BOSKI accesses, uses, stores, and shares personal information, including Google user data, when a user chooses to connect Google services.

Contact: BOSKI (Whitestone Labs, Inc.), 1111B S Governors Ave Suite 90298, Dover, DE 19904, United States. Email: privacy@endgoal.app.

We collect information that you provide directly, information generated through your use of BOSKI, and limited information from connected services when you choose to connect them.

Account information:

• Name, email address, profile image, account identifiers, authentication information, account preferences, and settings.
• Information received from Google Sign-In or another authentication provider when you choose to sign in through that provider.

Product information you add:

• Goals, tasks, milestones, notes, reflections, delegated instructions, onboarding answers, workspace preferences, activity history, calendar-related plans, and other content you intentionally submit to BOSKI.
• AI-agent instructions, prompts, task requests, approvals, outputs, and related operational history needed to provide the service.

Google Calendar information:

• If you choose to connect Google Calendar, BOSKI may request the OAuth scope https://www.googleapis.com/auth/calendar.events.
• This permission allows BOSKI to view and edit events on your calendars after you grant consent through Google's OAuth consent screen.
• Calendar data may include event titles, descriptions, start and end times, time zones, locations, attendees where needed, event identifiers, calendar identifiers, event status, update metadata, and goal-related events created, updated, or synchronized through BOSKI.

Email information, if enabled:

• If BOSKI offers email integrations and you choose to connect an email account, BOSKI may access only the email information needed to provide user-facing agent features that you request or approve.
• Depending on the enabled features and permissions you grant, this may include message metadata, sender and recipient information, subject lines, snippets, message bodies, attachments, labels, threads, drafts, and send or reply actions.
• BOSKI does not access email unless you connect an email service and grant the required permission. BOSKI does not sell email data, use email data for advertising, or use email data to train generalized AI or machine learning models.

Usage, device, and analytics information:

• We may collect product analytics and basic technical information such as screens viewed, features used, approximate time of usage, browser type, device type, operating system, referring page, IP address, approximate location derived from IP address, error logs, performance diagnostics, and cookie or similar identifiers.
• We use analytics to understand product performance, debug issues, improve reliability, and protect the service. We do not use Google Calendar or email data for advertising or retargeting.

Communications:

• If you contact us, we may collect your email address, name, message content, support history, and any information you choose to provide.

We use information to operate, secure, maintain, and improve BOSKI.

We may use information to:

• Create and manage your account.
• Authenticate you and keep your account secure.
• Display your workspace and product content.
• Save goals, tasks, onboarding answers, preferences, delegated instructions, and activity.
• Provide personal AI agent features that you request, configure, or approve.
• Create, view, update, and synchronize goal-related Google Calendar events.
• Read, summarize, organize, draft, send, or otherwise process email only when you enable email features and authorize the relevant action.
• Debug errors, improve reliability, and analyze product performance.
• Respond to support, privacy, or deletion requests.
• Prevent fraud, abuse, spam, unauthorized access, and security incidents.
• Comply with legal obligations and enforce our terms and policies.

We only request access to permissions that are necessary for BOSKI features. If we introduce new uses of Google user data that are materially different from those described in this Privacy Policy, we will update this Privacy Policy and obtain any required consent before using that data for the new purpose.

Where applicable (including under the EU/EEA General Data Protection Regulation), we process personal information on the following legal bases:

• Contract performance: Account creation, providing BOSKI features, processing delegated tasks, managing subscriptions.
• Consent: Connecting Google Calendar or email integrations (via OAuth), receiving optional communications.
• Legitimate interests: Product analytics, debugging, security monitoring, fraud prevention, service improvement -- balanced against your rights and freedoms.
• Legal obligation: Complying with applicable laws, responding to lawful requests, tax and accounting requirements.

You may withdraw consent at any time by disconnecting integrations, adjusting your settings, or contacting privacy@endgoal.app. Withdrawal does not affect the lawfulness of processing performed before withdrawal.

BOSKI may use artificial intelligence systems to help interpret your instructions, generate outputs, recommend next steps, summarize information, and prepare or perform tasks that you delegate.

When an integration is connected, BOSKI may use relevant connected-service data to perform user-facing actions, such as planning a schedule, creating a calendar event, preparing a draft email, summarizing a thread, or helping track progress toward a goal.

For sensitive actions, BOSKI may ask for confirmation before completing the action. Some features may allow users to configure automated or semi-automated behavior. You are responsible for reviewing settings, instructions, drafts, and actions before relying on them.

BOSKI does not use Google Calendar data, Gmail data, or other Google user data to train generalized AI or machine learning models. We may use de-identified, aggregated, or operational information to maintain security, measure reliability, and improve product functionality where permitted by law and applicable platform policies.

BOSKI's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

This means:

• We use Google user data only to provide or improve user-facing features that are visible in BOSKI.
• We do not sell Google user data.
• We do not transfer Google user data to advertising platforms, data brokers, or information resellers.
• We do not use Google user data for serving ads, retargeting, personalized advertising, or interest-based advertising.
• We do not use Google user data to determine creditworthiness, eligibility, lending, insurance, employment, or similar decisions.
• We do not use Google user data to train generalized AI or machine learning models.
• We do not allow humans to read Google user data unless you give explicit permission for a specific support or troubleshooting purpose, access is necessary for security or abuse prevention, access is necessary to comply with law, or the data has been aggregated or de-identified for internal operations.
• We require employees, contractors, service providers, and successors who may process data on our behalf to comply with privacy, confidentiality, and security obligations.

We do not sell your personal information.

Service providers:

• We may share information with trusted service providers that help us operate BOSKI, including cloud hosting, authentication, database storage, analytics, error monitoring, security monitoring, email delivery, customer support, and infrastructure tools.
• These providers may process information only as necessary to provide services to BOSKI and must protect the information they process.

Legal, safety, and security reasons:

• We may disclose information if reasonably necessary to comply with law, protect rights and safety, detect or prevent fraud or abuse, investigate security incidents, or enforce agreements and policies.

Business transfers and consent:

• If BOSKI is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction. Where required, we will notify users or obtain consent before transferring Google user data in a way not already permitted by this Privacy Policy and applicable Google API policies.
• We may also share information when you direct us to do so or give us consent.

We keep personal information for as long as reasonably necessary to provide BOSKI, maintain your account, comply with legal obligations, resolve disputes, enforce agreements, maintain security, and support legitimate business operations.

Indicative retention periods:

• Account data: retained while your account is active and for up to 30 days after account deletion, unless longer retention is required by law.
• Google Calendar and email data: retained only as long as the relevant integration is connected and needed to provide user-facing features. After disconnection, integration-related data is deleted within 30 days, except where retention is required for backup, security, legal compliance, or dispute resolution.
• Usage analytics and logs: retained for up to 12 months for product improvement and debugging purposes.
• Support communications: retained for up to 24 months after resolution to provide continuity and improve support quality.

If you delete your account or request deletion, we will delete or de-identify personal information unless retention is required or permitted by law, security, fraud prevention, backup integrity, or legitimate operational needs.

You may:

• Access, update, or correct your account information.
• Delete content you added to BOSKI.
• Request deletion of your account.
• Request deletion of Google Calendar, email, or other integration-related data stored by BOSKI.
• Disconnect Google Calendar, email, or other integrations.
• Revoke BOSKI's Google access through your Google Account permissions page.
• Opt out of certain analytics or cookies where available.
• Request a copy of your personal data in a portable format.
• Contact us with privacy questions or requests.

Revoking access may disable related features. To make a privacy or deletion request, contact privacy@endgoal.app.

We use reasonable administrative, technical, and organizational safeguards designed to protect information against unauthorized access, loss, misuse, alteration, disclosure, or destruction.

These safeguards may include:

• Encryption in transit.
• Encryption at rest where supported by our infrastructure.
• Access controls and least-privilege access practices.
• Authentication protections.
• Monitoring and logging.
• Secure infrastructure providers.
• Internal confidentiality obligations.
• Security review of systems that process user data.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we work to protect user data using commercially reasonable safeguards.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify affected users and relevant supervisory authorities without undue delay, as required by applicable law.

BOSKI is operated from the United States. If you access BOSKI from outside the United States, your information may be processed in the United States and other countries where our service providers operate.

Where required by applicable law, we rely on appropriate transfer mechanisms, such as Standard Contractual Clauses approved by the European Commission, to ensure that personal data transferred internationally is adequately protected.

BOSKI may use cookies, local storage, and similar technologies to keep you signed in, remember preferences, improve security, understand product usage, measure performance, and debug errors.

Categories of cookies we may use:

• Essential cookies: Required for authentication, security, and core functionality. These cannot be disabled.
• Analytics cookies: Help us understand how users interact with BOSKI so we can improve the product.
• Preference cookies: Remember your settings, language, and display preferences.

BOSKI does not currently respond to Do Not Track browser signals. You can manage cookie preferences through your browser settings.

BOSKI is not directed to children under 13 (or under 16 in jurisdictions where required), and we do not knowingly collect personal information from children under 13. If we learn that we have collected such information without appropriate consent, we will take reasonable steps to delete it.

Depending on your location, you may have rights to know what personal information we collect, access personal information, correct inaccurate personal information, delete personal information, object to or restrict certain processing, receive a copy of your information in a portable format, withdraw consent where processing is based on consent, and appeal a decision regarding a privacy request.

We may need to verify your identity before fulfilling certain requests.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising as defined by certain U.S. state privacy laws.

California residents (CCPA/CPRA):

If you are a California resident, you have the right to know what personal information we collect, request deletion of your personal information, opt out of the sale or sharing of personal information, and not be discriminated against for exercising your privacy rights. We do not sell or share personal information as defined by the CCPA/CPRA. To exercise your rights, contact privacy@endgoal.app.

EU/EEA residents (GDPR):

If you are in the EU/EEA, you have the rights described above, plus the right to lodge a complaint with your local data protection authority. If you are in the EU/EEA and wish to contact our EU representative, please email support@whitestonelabs.org.

BOSKI uses AI systems to assist with tasks you delegate, but does not make automated decisions that produce legal effects or similarly significant effects on you without human involvement. You retain control over reviewing and approving actions before they are finalized. If you believe an automated process has affected you, contact privacy@endgoal.app.

We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify users, such as by updating the effective date, posting a notice in BOSKI, or sending an email where appropriate.

If we materially change how we access, use, store, or share Google user data, we will update this Privacy Policy and obtain any consent required by Google API policies or applicable law before using Google user data for the new purpose.

For privacy questions, data access requests, correction requests, deletion requests, or Google integration data requests, contact BOSKI at privacy@endgoal.app.

Mailing address: BOSKI (Whitestone Labs, Inc.), 1111B S Governors Ave Suite 90298, Dover, DE 19904, United States.