Privacy Policy

Information We Collect

Boss App collects information needed to create and operate merchant accounts. This includes business name, owner or staff names, phone number, WhatsApp number, email address, business location, package selection, products, stock records, sales, expenses, customer orders, customer contact details entered by the merchant, payment records, support messages, and device or usage information needed to keep the service reliable.

• Account data — business name, business ID, owner and staff names, phone, WhatsApp number, email, business location.
• Business records — products, stock levels, sales, expenses, debts, customer orders, receipts and reports created by the merchant.
• Customer data entered by merchants — customer names, phone or WhatsApp numbers and order history, used to serve that merchant's own customers.
• Communication data — messages, notification templates and support conversations processed to deliver a requested communication.
• Technical data — device model, app version, crash and performance diagnostics, and sign-in activity used to keep accounts secure.

How We Use Information

We use collected information to provide the BOSS service, create merchant and staff accounts, sync business records across a merchant's devices, send service notifications, support account recovery, issue receipts or reminders when requested, deliver the WhatsApp Business Platform features a merchant has enabled, improve app performance, prevent fraud and abuse, and comply with applicable legal obligations. We do not use merchant or customer data for advertising.

WhatsApp Business Platform Data

BOSS App uses WhatsApp Business Platform APIs to allow merchants to connect their WhatsApp Business accounts, manage customer conversations, send approved notifications, and automate customer communication. We only process data required to provide requested services and we do not sell or share user data with third parties.

• A merchant connects their own WhatsApp Business account; BOSS App never takes ownership of it and the merchant can disconnect it at any time.
• We process only the phone numbers, message content, template status and delivery results needed to send and receive the messages a merchant has asked us to handle.
• Message content is processed to deliver, display and log the conversation for the merchant. It is not used to build advertising profiles and is not sold.
• Merchants are responsible for obtaining the consent required to contact their own customers and for following the WhatsApp Business Messaging Policy and Meta Platform Terms.
• Data received through WhatsApp Business Platform APIs is handled under the same security controls described in this policy, and is deleted on request as described below.

Data Sharing

Boss App does not sell merchant or customer data, and does not share it with third parties for their own marketing. We share limited information only with the infrastructure providers that operate the service on our behalf — Google Firebase (authentication, database, storage and hosting) and Meta's WhatsApp Business Platform for merchants who enable the WhatsApp integration. Those providers process the data under contract and only to deliver the service. We may also disclose information when required by law, regulation or court order, or to protect the rights and safety of Boss App, merchants, customers or the public.

Data Security Practices

We use technical and organisational safeguards proportionate to the sensitivity of business records.

• All traffic between the app and our backend is encrypted in transit using HTTPS/TLS.
• Data at rest is stored in Google Cloud infrastructure with encryption applied by the platform.
• Access is enforced by server-side security rules and authenticated callable functions, so a device can only read or write records belonging to its own merchant account.
• Passwords are stored only as salted hashes; session tokens are held in the device's encrypted keystore (Android EncryptedSharedPreferences / iOS Keychain).
• Staff accounts are role-scoped, so a staff member sees only what their role allows, and owners can revoke staff sessions at any time.
• App Check attestation is used to reject requests that do not come from a genuine BOSS App installation.
• Merchants remain responsible for protecting their own devices, staff access, passwords and exported reports.

Data Retention

We keep account and business information for as long as needed to provide the service, meet legal or accounting requirements, resolve disputes, prevent fraud and support merchant operations. When an account is deleted, we remove personal information that is no longer needed; a limited set of records may be retained where the law requires it, and only for as long as necessary.

How to Request Data Deletion

You can ask us to delete your account and the personal information held in it at any time, free of charge.

• Email support@bossapp.co.tz from the address registered on the account, with the subject line "Delete Boss App Account".
• Include the business name, business ID if available, owner name, and the registered phone or WhatsApp number so we can identify the account.
• We verify that the request comes from the account owner or an authorised representative before acting on it. We may ask for additional proof of ownership.
• Once verified, we delete or disable the merchant account and remove personal information that is no longer required to run the service — including any WhatsApp conversation data held for that account.
• We aim to complete verified deletion requests within 30 days and confirm by email when the deletion is done.
• Full step-by-step instructions are on the Delete Account page.

Your Rights

You may request access to, correction of, export of, or deletion of your personal information by contacting support@bossapp.co.tz. You may also object to or ask us to restrict certain processing. We may need to verify your identity and account ownership before acting on a request, and we will respond within 30 days.

Changes to This Policy

We may update this policy as the service changes or as legal and platform requirements evolve. The date at the top of this page shows when it was last updated, and material changes will be communicated in the app or by email.

Contact

For privacy questions, data requests or concerns, contact support@bossapp.co.tz. Postal and support details are on the Contact page.