BOSS-IQ
Back to BOSS-IQ

BOSS-IQ Privacy Policy

Controller: Blueprint IQ Yazılım ve Danışmanlık Anonim Şirketi (“Blueprint IQ AŞ”, “we”, “us”, “our”) — the operator of the BOSS-IQ service. Product: BOSS-IQ, available at https://boss-iq.io Registered office: Levazım Mah., Beşiktaş / İstanbul / Türkiye Company identifiers: MERSİS 0178185623100001 · Trade Registry No. 1123478 · Tax ID (VKN) 1781856231 · Tax Office: Beşiktaş Contact for privacy matters: privacy@boss-iq.io Last updated: [DATE] · Effective: [DATE on adoption]

1. Who this policy is for

This Privacy Policy explains what personal data BOSS-IQ collects, why we process it, who we share it with, how long we keep it, and the rights you have. It applies to:

  • the business owner / operator who signs up for and uses BOSS-IQ (“you”, the “boss”);
  • expert reviewers you invite to review strategy documents; and
  • visitors to boss-iq.io.

BOSS-IQ is a business-to-business strategic-planning tool. When you upload your company’s information, you are responsible for ensuring you have the right to share that information with us for processing as described here.

2. A plain-language summary

  • We are an AI-powered service. You are interacting with an artificial-intelligence system that analyzes your business information and generates strategy documents. AI output can be inaccurate — see Section 9.
  • We use trusted sub-processors to run the service. Your content is shared, under contract, with the third-party providers listed in our public sub-processor list for the specific purposes stated there. We do not sell your data.
  • We retain your data and may use it to evaluate and improve our AI systems — only if you opt in. This use is off by default and separable from the service; see Section 5.
  • Some of the data you provide is sensitive. If you use voice input, your voice audio is biometric-class data. See Section 3.4.
  • You have rights over your personal data, including access and erasure. See Section 8.

3. What we collect

3.1 Identity and account data

When you sign up and set up your organization profile, we collect: your name, email address, company name, city, and industry/sector. We also log the IP address of visitors for security and operational purposes. Account sign-in is handled by our authentication provider (see the sub-processor list).

3.2 Business content you upload or enter

To deliver the service, you provide business content — which may include financial information, strategy materials, HR information, competitive intelligence, and any documents (PDF, DOCX, PPTX, spreadsheets, images) you upload, plus the messages and answers you type during a session.

Important — how your content is processed: Your uploaded content is processed as submitted, in full, by our AI sub-processors (for example, for AI reasoning, document parsing, and search indexing). We do not currently redact or minimize personal information out of your content before it is sent to those providers. You should avoid uploading personal data of third parties that you are not authorized to share. See Section 6 (sub-processors) and Section 11 (your responsibilities).

3.3 Expert-reviewer data

If you invite an expert reviewer to review a strategy document, we collect that reviewer’s name and email address so we can send them a review link and process their feedback.

3.4 Voice audio (only if you use the microphone)

If you choose to use voice input, your spoken audio is captured in your browser and sent directly to our speech-to-text sub-processor to be transcribed. Voice recordings are biometric-class / special-category personal data under GDPR Article 9 and KVKK Article 6. We do not receive or store the raw audio on our own servers; our backend only issues a short-lived, single-use access token to enable the transcription. We will ask for your explicit consent before enabling voice input, and you can use BOSS-IQ fully without it.

3.5 Usage, billing, and technical data

We process operational logs, AI interaction records (the inputs and outputs of the AI agents that serve you), session state, and billing/checkout metadata. Card payment data is handled by our payments provider acting as Merchant of Record; we do not store card numbers.

4. Why we process your data (purposes & lawful bases)

Purpose What it covers Lawful basis (GDPR Art. 6 / KVKK Art. 5)
Provide the service AI analysis, research, document generation, voice transcription, exports, expert review Performance of a contract (GDPR Art. 6(1)(b) / KVKK Art. 5(2)©)
Operate, secure, and support the platform Authentication, logging, fraud/abuse prevention, troubleshooting, billing Legitimate interests / contract / legal obligation (GDPR Art. 6(1)(b),©,(f) / KVKK Art. 5(2))
Evaluate and improve our AI systems Retaining interaction data and using it to assess and improve the quality of our AI (see Section 5) Your explicit, opt-in consent (GDPR Art. 6(1)(a) / KVKK açık rıza Art. 5(1)) — applied uniformly to all users. This use is off unless you opt in, and you can withdraw at any time; see Section 5.
Voice transcription (if you use the microphone) Converting your spoken audio to text Explicit consent (GDPR Art. 9(2)(a) / KVKK Art. 6) — special-category data
Comply with law Tax, accounting, regulatory and legal obligations Legal obligation (GDPR Art. 6(1)© / KVKK Art. 5(2)(ç))

We capture your acceptance of this Privacy Policy and our Terms of Service at signup through an affirmative action (an unchecked box you tick), and we record the version and timestamp of what you agreed to.

5. AI improvement and data retention for AI

We retain the interaction data generated when you use BOSS-IQ (including the documents you provide and the AI inputs and outputs they produce), and we may use this data to evaluate and improve our AI systems.

To be precise and honest about what this means today:

  • We do not sell your data.
  • We do not currently train machine-learning models on your data — there is no model-training pipeline in operation. What exists is a retained archive of interaction data that we may use in the future to evaluate and improve our AI, on the lawful basis set out in Section 4.
  • Our AI sub-processors operate under their commercial terms, under which they do not train their models on data submitted through their business APIs. See the sub-processor list and Section 6.

Your control over this use (opt-in for everyone). The AI-improvement use is separate from providing you the service and is off by default for all users, in every country. We will use your data for AI improvement only if you give separate, explicit consent — an opt-in you actively choose (for users in Türkiye this is the KVKK açık rıza). You can withdraw that consent at any time via privacy@boss-iq.io or the in-product control; withdrawing excludes your content from this use going forward and does not affect your use of the service.

Retention of the AI-improvement archive. Where you have opted in, interaction data held for this purpose is retained for a maximum of 24 months, after which it is deleted or anonymized.

6. Who we share your data with (sub-processors)

We use carefully selected third-party providers (“sub-processors”) to operate BOSS-IQ — for example to host infrastructure, run AI analysis, parse documents, index search, deliver email, process voice, and handle payments. We share your data with these providers only for the purposes stated, under contractual data-protection terms. We do not sell your data and we do not share it with anyone for their own independent marketing.

The complete, current list of sub-processors — including each provider’s purpose, the category of data involved, processing region, and our objection-notice commitment — is published and maintained here:

➡️ BOSS-IQ Public Sub-Processor List

We will give at least 30 days’ advance notice before adding or replacing a sub-processor that processes personal data, so that you have an opportunity to object. See the sub-processor list for how notice is given.

7. International data transfers

We are a Turkish joint-stock company (AŞ). The two largest and most sensitive stores of your data — our database and your uploaded files — are hosted in the European Union (Amsterdam). Some derived and AI-related data is processed in the United States, specifically: our search index (Pinecone), our AI-quality monitoring/tracing provider (LangSmith), and the AI providers that perform the analysis (e.g., Anthropic, OpenAI), together with our voice and text-to-speech providers and certain identity/delivery providers. The processing region for each provider is shown in the sub-processor list.

Where personal data is transferred outside Türkiye and the EEA, we put in place appropriate safeguards for each transfer: EU Standard Contractual Clauses (SCCs) for the GDPR side, and a KVKK-compliant cross-border transfer mechanism (the KVKK standard contract or undertaking, with notification to the Turkish Data Protection Authority) for the KVKK side. Note that KVKK requires its own transfer mechanism in addition to the GDPR SCCs; we treat the two as separate requirements. You may request information about the safeguards in place for a specific transfer at privacy@boss-iq.io.

8. How long we keep your data & your rights

8.1 Retention

We keep personal data for as long as your account is active. After your account is closed, or after you make a valid erasure request, we delete or anonymize your Customer Content within 90 days, except where a longer period is required by law (for example, tax and accounting records, which Turkish law generally requires us to keep for up to 10 years). Some operational logs and AI-quality traces are kept on shorter, provider-set windows (for example, our AI-quality tracing provider auto-deletes traces after 14 days).

Deletion on account closure is carried out through our erasure process, which we are progressively automating with a termination-triggered purge. If you need confirmation that your data has been deleted, contact privacy@boss-iq.io.

8.2 Your rights

Subject to applicable law (GDPR / KVKK), you have the right to:

  • access the personal data we hold about you;
  • request rectification of inaccurate data;
  • request erasure (“right to be forgotten”);
  • request portability of data you provided, in a structured, machine-readable format;
  • object to or restrict certain processing, including the AI-improvement use; and
  • withdraw consent at any time where processing is based on consent (including voice input and the AI-improvement use).

To exercise any of these rights, contact us at privacy@boss-iq.io. We currently fulfill these requests through our internal process and will respond within the timeframes required by applicable law (generally within one month under GDPR, and within 30 days under KVKK). You also have the right to lodge a complaint with your data-protection authority (in Türkiye, the KVKK Board / Kişisel Verileri Koruma Kurulu; in the EU, your local supervisory authority).

9. AI transparency and accuracy

BOSS-IQ is an artificial-intelligence system. When you use BOSS-IQ, you are interacting with AI, not a human advisor. The strategy documents, analyses, and recommendations it produces are generated by AI models and may be inaccurate, incomplete, or out of date. They are decision-support material, not professional, legal, financial, or investment advice.

You remain responsible for reviewing AI output and making your own decisions. BOSS-IQ offers an expert-review feature so that a human you trust can review documents before you act on them; we encourage you to use it for high-stakes decisions. This disclosure is provided in satisfaction of the transparency obligation under Article 50 of the EU AI Act for a limited-risk AI system.

10. Security

We take reasonable technical and organizational measures to protect personal data, including encryption in transit, access controls, and tenant isolation (each customer’s data is logically separated). No system is perfectly secure. The security measures we make available to business customers — including those that are in place today and those that are on our roadmap — are described in our Data Processing Agreement (Annex II). We describe only the controls we can stand behind today as current, and clearly mark the rest as roadmap.

11. Your responsibilities

Because your content is processed in full by our AI sub-processors, you agree that you have the right to provide the content you upload and that you will not upload personal data of third parties that you are not authorized to share for these purposes. You are the controller of your own business and customer data; we act as your processor for that content (see the DPA).

12. Children

BOSS-IQ is a business tool intended for use by adults (business owners and their invited reviewers). It is not directed to children and we do not knowingly collect children’s personal data.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here with a new “Last updated” date and, where changes are material, provide additional notice. Adding or changing sub-processors is governed by the 30-day notice commitment in Section 6.

14. Contact

Blueprint IQ Yazılım ve Danışmanlık AŞ — operator of BOSS-IQ Levazım Mah., Beşiktaş / İstanbul / Türkiye Privacy: privacy@boss-iq.io · General: support@boss-iq.io

BOSS-IQ is a product of Blueprint IQ AŞ.