Privacy Policy

This policy applies to inbosmode.com, to ALICE on that site, to the BOSmode platform and its BOScall, BOSmind, BOShub and BOSguard modules, and to the outbound telephone calls we place from them. It covers website visitors, people who ask ALICE to call them back, prospective customers, customers and the individual users within a customer’s workspace.

It does not cover third-party websites you reach from ours, or a customer’s own handling of data inside their workspace — for that, see section 2 and the customer’s own privacy notice.

Where you have signed a separate agreement with us that deals with data protection, that agreement governs to the extent it conflicts with this policy.

BOSmode LLC (“BOSmode”, “we”, “us”) operates the AI voice-sales platform at inbosmode.com. Our role under data-protection law changes depending on whose data is involved, and the distinction decides who you should approach.

We are the controller

For everyone who uses our public website and talks to ALICE, for people who request a call-back from us, for prospective customers, and for the account, billing and security records of our own customers. We decide what is collected and why, and this policy is the notice for that processing. Come to us directly.

We are a processor

For everything a paying customer loads into their own workspace — their lead lists, the numbers they dial, their call recordings and transcripts, their agents' activity. That customer is the controller. We act on their documented instructions, and their privacy notice, not this one, tells the people in those lists what is happening. If you were called by a BOSmode customer's AI agent and want your data removed, ask that business; if you cannot identify them, contact us and we will route the request.

Independent controllers

Our payment processors handle your payment as controllers in their own right under their own policies, and telecommunications carriers handle call-routing metadata under theirs.

The registered address and company registration number of BOSmode LLC are not yet stated in this document: [TO BE COMPLETED: registered address and company registration number]. Where UK or EU law requires one, an Article 27 representative and, if appointed, a Data Protection Officer must also be named: [TO BE COMPLETED: EU/UK representative and DPO contact details]. Until these are filled in, use support@inbosmode.com for every enquiry.

The categories below are exhaustive for the public site as of the date at the top of this page. We do not collect special-category data (health, biometrics for identification, political or religious beliefs, and so on) and we ask that you do not volunteer it to ALICE.

Giving us your details is entirely voluntary. Nothing is required to read the website. If you decline to give an email address or phone number we simply cannot send you the material you asked for or call you back; there is no other consequence.

Where UK or EU data-protection law applies, each purpose below is matched with the Article 6 basis we rely on for it. Where we rely on consent you can withdraw it at any time (section 13), and where we rely on legitimate interests you can object (also section 13).

Holding the conversation with ALICE and answering your questions

Data: conversation content, technical data. Basis: taking steps at your request prior to entering a contract (Art. 6(1)(b)), and our legitimate interest in operating a self-service sales channel (Art. 6(1)(f)).

Placing the call-back you asked for

Data: phone number, transcript snapshot, dial status. Basis: your consent, given by submitting the number (Art. 6(1)(a)). Withdrawing consent stops future calls; it does not undo a call already placed.

Following up by email about what you discussed

Data: email address, discovery answers, summary. Basis: your consent (Art. 6(1)(a)), or our legitimate interest in responding to a business enquiry you initiated (Art. 6(1)(f)). Every marketing email carries an unsubscribe route.

Qualifying and prioritising enquiries

Data: intent score, summary, discovery answers. Basis: our legitimate interest in directing sales effort efficiently (Art. 6(1)(f)). See section 6 for what this scoring does and does not decide.

Providing the platform to customers, and billing for it

Data: account, billing and audit data. Basis: performance of the contract with you or your organisation (Art. 6(1)(b)), and compliance with tax and accounting obligations (Art. 6(1)(c)).

Security, abuse prevention and rate limiting

Data: IP address, user-agent, request counters, audit logs. Basis: our legitimate interest in protecting the platform — and in particular in stopping an automated dialler being weaponised against third parties (Art. 6(1)(f)).

Debugging, monitoring and improving the service

Data: technical data, error records, aggregate usage. Basis: our legitimate interest in a service that works (Art. 6(1)(f)).

Complying with law and defending legal claims

Data: whatever the obligation or claim relates to. Basis: legal obligation (Art. 6(1)(c)) and legitimate interest in establishing or defending claims (Art. 6(1)(f)).

We do not use your conversation with ALICE to train third-party foundation models on our own initiative. Our AI providers process the content to generate a response under their own terms; those terms, not this policy, govern anything they retain.

ALICE is an artificial agent, not a person. This section is the specific AI disclosure that the rest of the policy builds on.

Your typed messages leave our servers

In chat mode your messages are sent to our server and on to OpenAI, which generates the reply.

Your microphone audio goes to OpenAI directly

In voice mode, our server mints a short-lived session key and your browser then streams your microphone audio straight to OpenAI's Realtime service over WebRTC. The audio does not pass through a BOSmode server on the standard tier. OpenAI also transcribes that audio to text as part of the session.

The Premium voice tier adds a BOSmode-operated bridge

On the Premium tier, session signalling is routed through a bridge service we operate on our own infrastructure and on to our telephony server, and the synthesised voice you hear is generated by ElevenLabs.

We keep the text, not the audio

We do not retain a recording of your voice on our own systems. What we store is the text transcript snapshot described in section 3.2. Anything the providers in section 9 retain is governed by their terms.

A human may read it

Transcript snapshots, summaries and scores are visible to BOSmode platform operators, who read them to follow up on enquiries, to check ALICE is behaving correctly, and to investigate abuse. Assume a person will read what you say to ALICE.

AI output can be wrong

Anything ALICE tells you about pricing, capability, timelines or results is indicative only, may be inaccurate or fabricated, and is not advice or a contractual commitment. Verify anything you intend to act on.

If you would rather none of this happen, do not start a conversation with ALICE. The rest of the website is fully readable without it, and you can reach a human at support@inbosmode.com instead.

We are explicit about this because it is easy to gloss over. ALICE evaluates your conversation and produces an intent score from 0 to 100, plus a written summary. That is profiling as UK and EU law define it: an automated evaluation of personal aspects of you, in this case your likely interest in and suitability for our product.

• What it is used for: ordering and prioritising sales follow-up, and helping an operator decide whether an enquiry is worth a human call.
• What it does not do: it does not deny you access to anything, does not set a price you are offered, does not affect credit, employment or any legal right, and does not on its own stop us calling you back — the call-back queue runs on your request, not on your score.
• Article 22: because the score has no legal effect on you and no similarly significant effect, we do not consider it to be a decision based solely on automated processing of the kind Article 22 prohibits. A human operator remains in the loop for every decision that actually matters, such as whether to offer you a contract.
• Your position either way: you can ask us what score and summary we hold about you, tell us it is wrong and have it corrected, object to the profiling entirely, and ask for a human to review any assessment. Use the route in section 13.

The dialler also applies automated gates before a call is placed — suppression-list checks and permitted calling-window checks. Those gates only ever stop a call; they never cause one.

If you submit a phone number through the “call me” flow, you are asking us to place a real outbound telephone call to that number, and that submission is the consent we rely on. The number is queued immediately and drained by our automated dialler, typically within minutes during permitted calling hours. The call is placed and conducted by an AI agent.

Only submit a number you are entitled to answer. Do not submit anyone else’s number. Doing so is a breach of our Terms of Service and may be unlawful where you are.

To withdraw consent, email support@inbosmode.com with the number, or simply tell the agent on the call not to call again. We will remove the number from the queue and record the objection so it is not dialled again. Withdrawal is as easy as giving consent and costs you nothing.

Call-back requests are rate limited per IP address and capped platform-wide each day. Those counters exist to stop the dialler being abused against third parties and are themselves a security measure under section 12.

Occasionally we hold personal data that did not come from the person it describes. There are two cases.

• Someone submitted your number or email to us. The source is the person who filled in the form on our public site, and the categories are those in sections 3.1 and 3.5. If you were contacted this way and did not ask to be, tell us at support@inbosmode.com and we will delete the record and suppress the number.
• A customer uploaded a list containing you. Here we are a processor, the customer is the controller and the source is that customer. We will pass your request to them and, on their instruction, delete or suppress your record.

We do not buy personal data from data brokers, and we do not enrich our own landing-page records from third-party sources.

We do not sell personal data, and we do not share it for cross-context behavioural advertising. The following processors and service providers are the complete set used in connection with the public site and ALICE.

OpenAI

Generates ALICE's replies and transcribes voice sessions. Receives your chat messages and, in voice mode, your live microphone audio — your browser connects to OpenAI directly. United States.

ElevenLabs

Speech synthesis for the Premium voice tier — generates the voice ALICE speaks with. United States.

LiveKit

Real-time audio transport for certain voice sessions and interactive forms.

Supabase

Hosted PostgreSQL database and authentication. Stores lead records, transcript snapshots, discovery briefs and account data.

Vercel

Hosts and serves the web application, and processes the request metadata inherent in serving traffic.

Resend and SendGrid

Transactional and follow-up email delivery. Receive your email address and the content of the message.

BOSmode-operated telephony (Asterisk and ViciDial on dedicated servers)

Places the outbound call-back and carries the audio. Operated by us on infrastructure we control.

Upstream SIP carriers

Necessarily handle call-routing metadata such as the numbers involved, the time and the duration of the call, as independent controllers under their own terms.

Stripe, PayPal and Authorize.Net

Payment processing for paid plans and checkouts. Which of them handles a given payment depends on the merchant configuration for that workspace. They act as independent controllers for the payment itself under their own privacy policies, and we do not store your full card number.

We may also disclose personal data:

• to law enforcement, regulators or courts, where compelled by valid legal process or where disclosure is necessary to establish or defend legal claims;
• to our professional advisers — lawyers, accountants, auditors — under a duty of confidence; and
• to a buyer or successor in the event of a merger, acquisition or sale of assets, in which case this policy continues to apply to the data transferred until you are told otherwise.

Adding a processor is a change to this policy. If a new one is introduced, this list is updated in the same change.

Several of the providers in section 9 are established outside the United Kingdom and the European Economic Area, principally in the United States. Your data will therefore be transferred out of your country when you use ALICE, and — where voice mode is used — that transfer happens directly from your own browser to OpenAI.

Where such a transfer is subject to UK or EU law, we rely on the transfer mechanism the relevant provider offers, in practice the European Commission’s Standard Contractual Clauses together with the UK International Data Transfer Addendum, or an applicable adequacy decision such as the EU-US Data Privacy Framework where the provider is certified under it. Those mechanisms sit in each provider’s own data-processing terms.

We have not published a transfer impact assessment, and we do not claim that these safeguards make every transfer risk-free. If you want to know which mechanism applies to a specific provider, ask us at support@inbosmode.com and we will tell you what we have.

We are deliberately precise here, because the honest position is not the one a policy of this kind usually states.

Landing-page lead records, transcript snapshots, scores and summaries

There is no automated deletion schedule for these records today. No purge job exists in the codebase. In practice they are kept until you ask us to delete them, or until we decide we no longer need them and delete them manually. We will not state a fixed period here until a scheduled deletion job actually runs, at which point this section will be updated to state it.

Call-back and dial-status records

Kept alongside the lead record above and subject to the same position. Suppression entries recording that you asked not to be called are retained deliberately, because deleting them would allow you to be dialled again.

Account, billing and tax records

Kept for the life of the account and then for the period required by applicable tax, accounting and limitation law.

Security and audit logs

Kept for as long as needed to investigate abuse and to defend claims.

Customer workspace data

Retained and deleted on the customer's instruction, under their own agreement with us. We do not set the period.

A deletion request under section 13 overrides all of the above for the data it covers, except where we are legally required to keep something or need it to defend a legal claim.

We take measures appropriate to the risk. We describe only what is actually implemented, and we make no certification claim in this document.

• Traffic to the platform is served over HTTPS with HTTP Strict Transport Security enforced across the site.
• Access to lead records in the database is restricted at the row level, so they are reachable only through privileged server-side credentials and not by ordinary signed-in users.
• Voice sessions use short-lived, single-session credentials rather than long-lived keys exposed to the browser.
• Call-back submission is rate limited per IP address and capped platform-wide per day, and the dialler applies suppression-list and calling-window gates before any number is dialled.
• Administrative access to platform data is limited to BOSmode operators, and privileged actions are recorded in audit records.

No system is perfectly secure, and we do not guarantee that ours is. If you believe you have found a vulnerability, report it to support@inbosmode.com rather than testing it against live data — see the Security page.

Subject to where you are, you have the following rights over the data we hold about you as controller.

Access

A copy of the personal data we hold about you, including your transcript snapshot, your intent score and summary, and the technical data recorded with your submission.

Rectification

Correction of anything inaccurate — including an AI-generated summary or score that misrepresents what you said.

Erasure

Deletion of your data where we no longer need it, where you withdraw the consent it rested on, or where you successfully object.

Restriction

A freeze on processing while a dispute about accuracy or legitimate interests is resolved.

Portability

The data you gave us, in a structured, commonly used, machine-readable form, where processing rests on consent or contract and is automated.

Objection

An objection to processing based on our legitimate interests, including the profiling in section 6. An objection to direct marketing is absolute and we will always honour it.

Withdrawal of consent

At any time, without giving a reason and without affecting the lawfulness of what we did before you withdrew.

Human review

A request that a person, not a model, looks at any assessment we have made about you.

The platform is a business tool. It is not directed at children and we do not knowingly collect personal data from anyone under 16. We do not knowingly permit a child’s number to be submitted to the call-back queue.

If you believe a child has given us data, contact support@inbosmode.com and we will delete it and suppress any number involved.

If a personal data breach occurs and it is likely to result in a risk to people’s rights and freedoms, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, as UK and EU law require.

Where the breach is likely to result in a high risk to you, we will also tell you directly, without undue delay, describing what happened, what data was involved and what you can do about it. Where we act as a processor for a customer, we will notify that customer without undue delay so they can meet their own obligations.

We use only strictly necessary browser storage. We run no analytics, advertising or cross-site tracking scripts, and no third party sets a cookie through our site. Every key we set, why it is set and how to change your choice is listed in the Cookie & Storage Policy.

Consent to browser storage is a separate question from consent to be recorded or telephoned. Accepting a cookie notice does not give us permission to call you; only submitting your number does.

We may update this policy as the product changes. The date at the top always reflects the current version. Where a change materially affects people whose data we already hold — a new processor, a new purpose, a new retention position — we will notify those we have an email address for before it takes effect, and where the change requires your consent we will ask for it rather than assume it.

Questions, objections and data-rights requests: support@inbosmode.com. This is our only monitored address for these purposes.

If you are unhappy with how we have handled your data, tell us first — we would rather fix it. You also have the right to complain to your national data protection authority without contacting us at all.