Who looks after your data
The controller of your data is Robert Rogge, a self-employed person (autónomo), NIF ESX7114024D, Sella 11, 17800 Olot, Spain. For anything about your data, write to hello@bossa.day.
What we keep, and why
| What | Why | On what basis |
|---|---|---|
| Your email address, and how you sign in (Google, Apple or an email code) | To give you an account and send what the account needs: sign-in codes, receipts, the renewal reminder | Our contract with you |
| Your list and your settings | To keep them the same on all your devices | Our contract with you |
| Your plan, its dates and its payments | To know whether your account can use Bossa | Our contract with you |
| Your billing country and, for businesses, the VAT number | To charge the right VAT and make lawful invoices | A legal obligation |
| The devices signed in to your account | So you can see them and sign them out from your dashboard | Our contract with you |
| Your emails to us | To answer them | Our legitimate interest in helping you |
Your card details go to Stripe and never reach us. We only see what Stripe shows: the card’s brand, its last four digits and when it expires.
When you sign in with Google or Apple, we take only your email address from them.
Your list
- Your list is stored on our servers so it can reach your other devices. It’s encrypted on its way and where it’s stored.
- It isn’t end-to-end encrypted, so it could technically be read on the server. We don’t read it, and we never use it for anything but syncing. We’d only open it if you asked us to, to fix a problem you’ve reported.
- We never use your list to train AI, to profile you, or to show you anything.
- The desktop apps also keep your list on your computer, with daily backups there.
This website
- We count visits to this website with Plausible, which uses no cookies and keeps no personal data. It tells us how many people came and from where, never who.
- The app itself counts nothing and reports nothing about how you use it.
- When they start, the desktop apps ask our server whether there’s a newer version. That request carries no details about you or your list.
- What you choose in the setup wizard is kept in your own browser until you create your account, so it can come with you.
Cookies
The website sets no cookies. Signing in sets one cookie that keeps you signed in, and nothing else. On the checkout and billing pages, Stripe’s card field may set its own cookies to prevent fraud. All of these are necessary for what you asked for, so there’s no cookie banner.
Who helps us
These companies process data for us, only to provide Bossa, under data processing agreements:
| Company | What it does | Where |
|---|---|---|
| Supabase | Accounts, sign-in and the stored lists | EU |
| Stripe | Payments and invoices | EU and US |
| Resend | Sending our emails | EU and US |
| Cloudflare | Serving the website and the web version | Worldwide |
| Plausible | Counting website visits, without cookies | EU |
| Google and Apple | Signing in, if you choose them | US |
Where data leaves the EU, it’s protected by the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses. We don’t sell or share your data with anyone else.
How long we keep it
- Your account and list: for as long as you have an account.
- If your plan ends and you don’t come back: your list stays read-only for a while, then we delete it.
- If you delete your account: we delete it and your list at once, and from our backups within 30 days.
- Invoices and payment records: as long as Spanish tax law requires, currently up to six years.
Your rights
You can ask us to show you the data we have about you, correct it, delete it, limit what we do with it, object to it, or give it to you in a form you can take elsewhere. Most of this you can do yourself: your dashboard shows your account and lets you delete it, and Bossa exports your list as plain text. For the rest, write to hello@bossa.day and we’ll answer within a month.
If you’re unhappy with how we handle your data, you can complain to Spain’s data protection authority, the Agencia Española de Protección de Datos (aepd.es), or to the one where you live.
Changes
If we change this policy in a way that matters, we’ll email you before it takes effect.