Privacy Policy

1. Who we are

Bossary is operated by Ortomate Ltd., 12 Jessie Street, Wellington, New Zealand (“we”, “us”). We are the agency responsible for your personal information under the New Zealand Privacy Act 2020. You can reach us at hello@bossary.xyz.

2. Information we collect

• Account information — your email address and name, provided when you sign in with Google or an email magic link.
• Content — glossaries, terms, definitions, and related data you create or import.
• Billing information — handled by Stripe. We store only your Stripe customer and subscription identifiers, never card numbers.
• Usage data — basic technical logs (e.g. request logs, AI feature usage counts) needed to operate the service and enforce plan limits.

3. How we use your information

• To provide, maintain, and improve Bossary.
• To authenticate you and secure your account.
• To process subscription payments through Stripe.
• To provide AI features: when you use AI drafting or consistency checks, the relevant glossary content is sent to Anthropic's API to generate the response. We do not use your content to train models.
• To respond to support requests.

4. Public content

If you set a glossary's visibility to public or unlisted, its published terms are accessible to anyone with the link (and, for public glossaries, indexable by search engines). Private glossaries are only visible to your account.

5. Service providers

We share data with a small number of processors to run the service:

• Supabase (database, authentication, hosting of your content)
• Vercel (application hosting)
• Stripe (payments)
• Anthropic (AI features, only when you use them)
• Google (only if you choose Google sign-in)

These providers may store data outside New Zealand. We only use providers with safeguards comparable to those required by the Privacy Act 2020.

6. Retention and deletion

We keep your data while your account is active. You can export your glossaries to CSV at any time. To delete your account and its data, email hello@bossary.xyz and we will action the request within 20 working days.

7. Your rights

Under the Privacy Act 2020 you may request access to, and correction of, the personal information we hold about you. If you have concerns about how we handle your information, contact us first; you may also complain to the Office of the Privacy Commissioner (privacy.org.nz).

8. Security

Data is encrypted in transit, access to production systems is restricted, and content is isolated per account with database row-level security. No system is perfectly secure; we will notify you of any notifiable privacy breach as required by law.

9. Changes

We may update this policy from time to time. Material changes will be flagged on this page with a new “last updated” date.