Privacy Policy

Last updated: March 22, 2026  |  Effective: March 22, 2026

KZENOFFRAME STUDIO LLC ("we", "us", "our") operates the bossbot.uk website and the BossBot WhatsApp AI assistant service. This policy explains how we collect, use, store, and protect personal data when you use our services.

1. Data We Collect

We collect the following categories of personal data:

• Business owner data: Name, email address, phone number, business name, and service details provided during onboarding.
• End-user (patient/customer) data: Phone number, name (as provided via WhatsApp), message content, appointment details, and conversation history.
• Technical data: IP address, browser type, and access timestamps for our web dashboard.
• Billing data: Payment information processed by Stripe (we do not store card numbers directly).

2. How We Store Your Data

• Encryption at rest: AES-256-GCM for all message content and personal identifiers.
• Encryption in transit: TLS 1.3 for all API communications.
• Database: Encrypted SQLite with per-client isolation.
• Backups: Encrypted and stored separately with 30-day retention.

3. Who Has Access

Access to personal data is strictly limited to:

• The clinic/business owner who contracted BossBot for their business.
• BossBot AI system (automated processing only — no human reads your messages).
• BossBot administrators may access system logs for debugging, but conversation content remains encrypted and inaccessible without the client's encryption key.

We never sell, rent, or share personal data with advertisers or data brokers.

4. Data Retention

• Active accounts: Data is retained for the duration of the service agreement.
• Conversation logs: Configurable retention period (default 12 months, adjustable per LGPD/GDPR requirements).
• After account cancellation: All data is deleted within 30 days, or exported upon request within 24 hours.
• ZeroTrace audit logs: Retained for the legally required compliance period (minimum 5 years for healthcare data where applicable).

5. Your Rights (GDPR & LGPD)

You and your end-users have the right to:

• Access: Request a full copy of all stored personal data.
• Rectification: Correct any inaccurate personal data.
• Deletion: Request complete erasure of personal data ("right to be forgotten").
• Portability: Receive data in a structured, machine-readable format (JSON export).
• Consent withdrawal: Withdraw consent at any time without affecting prior processing legality.
• Objection: Object to processing based on legitimate interests.

To exercise any of these rights, contact: [email protected]

We respond to all data requests within 15 business days (LGPD) or 30 days (GDPR).

6. ZeroTrace Audit Logging

Every access to personal data within BossBot is recorded in our ZeroTrace cryptographic audit chain. This is a tamper-proof, append-only ledger that creates a hash-linked record of every data access event. ZeroTrace enables:

• Verifiable proof of who accessed what data and when.
• Tamper detection — any modification to audit records is mathematically detectable.
• Compliance audits for GDPR Article 30 and LGPD Article 37 record-keeping requirements.

7. Third-Party Services

We use the following third-party services to operate BossBot:

• WhatsApp Cloud API (Meta): Message delivery. Subject to WhatsApp Privacy Policy.
• Google Gemini AI: Natural language processing for generating responses. Conversation data is sent to Google's API for processing but is not used to train Google's models (per our enterprise agreement).
• Stripe: Payment processing. Subject to Stripe Privacy Policy. We never store credit card numbers.
• Telegram Bot API: Escalation notifications to business owners.

8. Cookies

Our website uses only essential functional cookies (language preference, session). We do not use tracking cookies or third-party analytics cookies.

9. Children's Privacy

BossBot is a B2B service. We do not knowingly collect data from individuals under 16. If a minor's data is inadvertently collected through WhatsApp conversations, the business owner is responsible for obtaining parental consent as required by applicable law.

10. Changes to This Policy

We may update this policy periodically. Material changes will be communicated via email to all active account holders at least 15 days before taking effect.

11. Contact

For privacy-related questions, data requests, or complaints:

If you believe your data protection rights have not been adequately addressed, you have the right to lodge a complaint with your local supervisory authority (e.g., ANPD in Brazil, CNIL in France, ICO in the UK).