Privacy policy

Bosspal is a messaging platform operated by Dapperico Inc. (“we”, “our”, “us”), a Canadian corporation. We provide an AI-powered SMS receptionist that small businesses (“contractors”) use to handle customer conversations on their behalf.

This privacy policy describes how we collect, use, share, and protect personal information across the platform. If you are a customer texting one of our contractors, see also that contractor’s own privacy policy (linked from their public business page) for how they handle your data as the controller of your relationship with them.

How we obtain SMS consent.When you (the customer) initiate a text message to one of our contractors’ business-published phone numbers, we treat that inbound message as your consent to receive replies related to your inquiry (quotes, scheduling, payment confirmations, follow-ups). Contractors do not initiate outbound SMS to numbers that have not first messaged them, except for transactional messages tied to a service relationship you already have with them.

Opt-out. Reply STOP to any of our messages at any time to opt out of further messages from that contractor. We will send one confirmation message acknowledging the opt-out and will not send further messages until you re-initiate contact. Reply HELP for help.

Message and data rates may apply based on your mobile carrier plan. Message frequency varies depending on your interactions; you control how often we message you by responding (or not).

We do not sell, share, or transfer your phone number or SMS opt-in data to third parties for marketing purposes. Your phone number and SMS conversation data are used only to deliver the messaging service you initiated.

• From customers (text-message participants): phone number in E.164 format, name (if shared), the content and timestamps of messages exchanged, any appointment, payment, or quote details necessary to complete a transaction.
• From contractors (business users of the dashboard): email address, business name and corporation/registration number, owner name, business address, billing details (processed by Stripe), Twilio phone number metadata, configuration data (services, pricing, hours, policies, knowledge base).
• Automatically: log data, IP address, browser type, dashboard usage analytics, error reports.

• Deliver the messaging service you initiated
• Power AI-drafted replies that the contractor uses to respond to your inquiry
• Send appointment reminders, quotes, invoices, and payment links
• Process payments through our payment processor (Stripe)
• Operate, secure, and improve the platform
• Comply with legal obligations (TCPA, CASL, PIPEDA, and other applicable laws)

We do not use your data for advertising. We do not sell your data. We do not share it with third parties for their marketing purposes.

We rely on a small set of vetted third-party service providers to operate the platform. Each receives only the data needed for their specific function:

• Twilio Inc. — SMS and voice carrier delivery. twilio.com/legal/privacy
• Anthropic, PBC — AI models (Claude) that draft replies. anthropic.com/legal/privacy
• OpenAI, Inc. — embeddings and supplementary AI tasks. openai.com/policies/privacy-policy
• Stripe, Inc. — payment processing. stripe.com/privacy
• Resend — transactional email (quotes, invoices, receipts). resend.com/legal/privacy-policy
• Supabase — managed Postgres database hosting. supabase.com/privacy
• Clerk — authentication for the contractor dashboard. clerk.com/legal/privacy
• Vercel Inc. — dashboard hosting. vercel.com/legal/privacy-policy
• Railway Corp. — backend hosting. railway.com/legal/privacy

• Active conversations: retained while the underlying contractor relationship is active.
• Inactive customer phone numbers: automatically purged after 24 months of no activity.
• Voice call recordings (where recording was lawfully enabled): retained for a maximum of 90 days, then automatically deleted.
• Aggregated, de-identified data used to improve AI quality may be retained indefinitely. This data does not identify you.
• Records we are legally required to retain (tax records, dispute evidence, etc.) are kept for the applicable statutory period.

• Opt out of SMS: reply STOP to any message. Effective immediately; one confirmation message will follow.
• Request a copy of the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your data, subject to legal retention obligations.
• Lodge a complaint with your local data protection authority (in Canada: the Office of the Privacy Commissioner; in the U.S.: your state attorney general or the FTC; in the EU/UK: your national supervisory authority).

To exercise any of these rights, email privacy@bosspal.ai. We will respond within 30 days.

Our infrastructure includes sub-processors located in the United States and Canada. When personal information is transferred between jurisdictions, we rely on the standard contractual clauses and adequacy decisions applicable to that transfer. EU and UK data subjects may request a copy of the safeguards in place by contacting privacy@bosspal.ai.

We protect personal information with industry-standard safeguards including TLS in transit, encryption at rest, role-based access control, multi-tenant data isolation, audit logging, and regular security review. No system is perfectly secure, but we commit to notifying affected parties promptly in the event of a breach as required by law.

Bosspal is not directed to children under 13 (or 16 in the EU/UK). We do not knowingly collect data from children. If you believe we have inadvertently collected data from a child, email privacy@bosspal.ai and we will delete it.

We may update this policy. Material changes will be posted here with a revised “Last updated” date. For substantive changes affecting how we use SMS data, we will send a notice through the dashboard and require contractor re-acknowledgement before continuing the service.

Dapperico Inc.
Privacy questions: privacy@bosspal.ai
Support: support@bosspal.ai
Legal: legal@bosspal.ai