Privacy policy

1. Who this applies to

This policy covers visitors to bo.ge (and its subdomains) and customers using BackOffice ("we", "us", "our").

2. What we collect

• Account data — name, email, workspace metadata. Used to operate the service.
• Workspace records — the entities and rows you create. We store these to run the product. We don't read them for marketing or AI training.
• Product usage — aggregated event metadata (page views, feature use) from inside the app. Stays on infrastructure we control.
• Marketing-site measurement — on this public website (not inside the app) we record how pages are used: pages opened, how far you scroll, what you click, whether a form was started, and errors or slow loads. What you type is never recorded. This is stored on our own infrastructure, and also sent to Google Analytics and, for advertising, to Meta and LinkedIn — see cookies below.
• Billing — card details processed by Stripe (we never see the PAN). Invoices and contact info live with us.

3. What we don't do

• We don't sell your data, ever.
• We don't train AI models on your records.
• We don't ship session recordings to third-party tools (Hotjar, Heap, FullStory, etc.) — replays of this website stay on our own infrastructure.
• We don't send anything from inside your workspace to advertising platforms. The measurement described below applies to this public marketing site only.
• We don't fingerprint visitors across sites.

4. Cookies and tracking on this website

Inside the product: a single first-party authentication cookie plus a fewlocalStorage entries for session state.

On this marketing website there are two categories you control, andboth are on until you choose otherwise. You can change them at any time from Privacy choices in the footer.

• Analytics — an anonymous replay of your visit (pages, scrolling, clicks; typed input is masked) sent to our own servers, plus Google Analytics. We keep a random identifier in your browser's localStorage so repeat visits can be recognised. It is not linked to your name or email, and it is not shared with anyone.
• Advertising — a Meta (Facebook) pixel and a LinkedIn Insight Tag, which set third-party cookies and let us measure which ads bring people here. Turning this off stops both loading.

Google's tag loads on every visit, but only reads or writes cookies for the categories you allow — with both switched off it sends anonymous, cookieless signals. Recordings are deleted after 30 days and event data after 90.

5. Subprocessors

Each is contractually bound to the same standards we hold ourselves to.

• Cloudflare — DNS, CDN, edge proxy.
• Cloudflare R2 — blob storage (media uploads, exports).
• Stripe — billing.
• Google — Google Analytics, for measurement of this marketing website only. Not used inside the product.
• Meta — advertising measurement on this marketing website only, and only while the advertising category is switched on. Not used inside the product.
• LinkedIn — advertising measurement and retargeting on this marketing website only, and only while the advertising category is switched on. Not used inside the product.
• Anthropic / OpenAI — LLM inference for AI features. Per-call data is sent only when you invoke an AI surface, never for background analysis.

6. Your rights

Access, export, deletion, and correction. Emailprivacy@bo.ge and we'll respond within 30 days. EU and UK GDPR plus CCPA rights are honoured for all customers regardless of residence.

7. Data location

Production data sits in the EU by default (Frankfurt). R2 blobs are replicated to regional edges. We don't transfer customer-row data outside the region without a written addendum.

8. Security disclosures

Found a vulnerability? Email security@bo.ge. We run a no-litigation policy for good-faith research and will publicly credit fixes (with permission). Encrypt sensitive details with our PGP key, available on request.

9. Changes

We update this policy when material changes happen. The "Last updated" date at the top is the source of truth; significant changes also trigger an email to account owners.

10. Contact

Privacy questions: privacy@bo.ge. General contact: our contact page.