Legal

Privacy Policy

BrandBoss^™ · Effective 23 September 2026

1. Who we are

BrandBoss^™ is a product of Bossit Limited, a New Zealand company. We are committed to protecting your personal information in accordance with the Privacy Act 2020 (NZ).

Privacy enquiries: hello@brandboss.nz

2. What information we collect

We collect only what is necessary to run your brand repository and manage your account.

Account & profile

Your name, email address, account creation date, plan tier, and access status (e.g. paid, trial, or admin-granted). If you purchased a plan, we also store a Stripe customer ID and session ID — not your card details.

Authentication

Your email and a securely hashed password (we never see your actual password), login timestamps, and session tokens. If you sign in with Google, we store your Google account identifier.

Brand content you upload

Logo and asset files (SVG, PDF, PNG, JPG, EPS, AI and similar), colour values, typeface details and uploaded font files, brand stories, dos and don'ts, descriptions, notes, and email signature settings. This content belongs to you or your client — we store and serve it on your behalf.

Access & viewer records

Email addresses you grant viewer access to, share links and any password protection you apply, plus a log of views and downloads (time, file, and a hashed identifier for the viewer) so account holders can see how their brand is being used.

Email records

A log of transactional emails we have sent (verification, invitations, receipts, account notices) including the recipient address, template used, and delivery status. Unsubscribe tokens and suppressed addresses are also stored.

3. What we do not collect

• No advertising pixels or third-party marketing trackers.
• No credit card numbers, expiry dates or CVVs — these are handled entirely by Stripe and never reach our systems.
• No financial account numbers or IRD numbers (unless you type one into your own brand notes).

AI features (BrandBrain, colour and asset suggestions) run in real time through the Lovable AI gateway. Prompts and responses are not stored unless you save the result into your brand. Your information and brand assets are never used to train AI models. We block external crawlers from accessing user-uploaded brand content.

4. Payments

All payments are processed securely by Stripe, a PCI DSS-compliant payment provider. Bossit Limited does not store, see, or have access to your card details. We only retain a Stripe customer ID and session ID for account management. Stripe's own privacy policy applies to payment data: stripe.com/nz/privacy.

5. How we use your information

• To create and manage your account, brands, and plan access
• To store, convert, preview and deliver your brand files to the people you authorise
• To generate brand guides, email signatures and download packs
• To send transactional emails (verification, receipts, invitations, important notices)
• To show account holders activity and access history for their brands
• To respond to support enquiries and comply with our legal obligations under New Zealand law

We do not sell or share your information, and we do not use it for marketing beyond this product.

6. Third-party services

• Stripe — payment processing: stripe.com/nz/privacy
• Supabase — secure database and file storage (AWS infrastructure): supabase.com/privacy
• Lovable / AI gateway — AI assistance, not stored unless you save it: lovable.dev/privacy
• Cloudflare — domain security, DDoS protection and content delivery: cloudflare.com/privacypolicy
• Resend — transactional email delivery: resend.com/legal/privacy-policy

Each provider's own privacy policy applies to data they process on our behalf.

7. Where your data is stored

Your data is stored on secure cloud infrastructure provided by Supabase, running on AWS servers, with industry-standard encryption at rest and in transit. Brand files are held in private, access-controlled storage. Files are only reachable through signed, time-limited links issued to people you have authorised, or through a share link you choose to publish.

8. How long we keep your data

We retain your account information and brand content for as long as your account is active. If you close your account or request deletion, we will remove your personal data and uploaded assets within 30 days, except where we are required to retain certain records by law (e.g. financial transaction records). Email delivery logs and access logs are retained for 6 months for troubleshooting and compliance purposes.

9. Your rights under the Privacy Act 2020

• Access the personal information we hold about you
• Correct any information that is inaccurate or out of date
• Request deletion of your personal information (subject to legal retention requirements)
• Ask how your information is being used

To exercise any of these rights, contact hello@brandboss.nz. We will respond within 20 working days as required by the Act.

10. Data breaches

In the event of a privacy breach that is likely to cause serious harm, we will notify affected users and the Office of the Privacy Commissioner (OPC) as required under the Privacy Act 2020.

11. Contact & complaints

If you have a privacy concern or complaint, please contact us first at hello@brandboss.nz. If we are unable to resolve your concern, you may contact the Office of the Privacy Commissioner at privacy.org.nz.