Privacy Policy

Effective date: April 12, 2026

1. Who We Are

BOSSX GLOBAL LIMITED, a company incorporated in Hong Kong ("BossX", "we", "us", "our"), is the data controller responsible for your personal data when you use the BossX and BossDriver applications (the "Service").

For privacy inquiries, contact us at privacy@bossx.app.

2. Information We Collect

2.1 Information You Provide

• Account information: Name, phone number, and email address when you register.
• Profile information: Profile photo, display name, and language preference.
• Messages: Text messages, voice messages, and images sent through the in-app chat.
• Support requests: Communications when you contact us for help.

2.2 Information Collected Automatically

• Location data: Real-time GPS coordinates when the app is actively in use. Drivers share location with connected Bosses while online. Bosses share location when summoning a Driver. Location is not collected in the background when the app is closed.
• Trip data: Pickup location, drop-off location, timestamps, distance, and ride status.
• Device information: Device model, operating system version, app version, unique device identifiers, and push notification tokens.
• Usage data: App interaction events, feature usage, and crash reports for improving service stability.

2.3 Information We Do Not Collect

• We do not collect payment or financial information. All payments are arranged directly between Bosses and Drivers.
• We do not access your contacts, photos, or files unless you explicitly share them in chat.

3. How We Use Your Information

Purpose	Legal Basis
Provide the Service (connect Bosses and Drivers, enable messaging, display locations)	Performance of contract
Send ride status notifications and push alerts	Performance of contract
Monitor and improve service stability (crash reporting, error tracking)	Legitimate interest
Respond to support requests	Performance of contract
Enforce our Terms and prevent abuse	Legitimate interest
Comply with legal obligations	Legal obligation
Send product updates and optional marketing (with opt-out)	Consent

4. How We Share Your Information

We do not sell your personal information. We share data only in these circumstances:

4.1 Between Users

When you are connected via the Service, Bosses and Drivers can see each other's name, profile photo, and real-time location during active rides. Chat messages are visible only to the parties in the conversation.

4.2 Service Providers

We use third-party providers to operate the Service. These providers process data on our behalf under contractual obligations to protect your information:

• Google Cloud Platform (infrastructure, data storage, computing) — Singapore region
• Firebase (authentication, real-time database, crash reporting, analytics) — Google
• Google Maps (maps and geocoding)
• Stream (chat messaging infrastructure)
• Apple Push Notification service / Firebase Cloud Messaging (push notifications)

4.3 Legal Requirements

We may disclose your information if required by law, legal process, or government request, or if we believe disclosure is necessary to protect the rights, safety, or property of BossX, our users, or the public.

5. International Data Transfers

Your data is primarily processed and stored on servers in Singapore (Google Cloud Platform, asia-southeast1). If you are located outside Singapore, your data will be transferred internationally.

We ensure appropriate safeguards for international transfers through:

• Standard contractual clauses with our service providers
• Reliance on service providers' certifications and compliance frameworks (e.g., Google's compliance with applicable data protection regulations)

6. Data Retention

Data Type	Retention Period
Account information	Until you delete your account, then removed within 30 days
Trip data	2 years from the trip date, or until account deletion
Chat messages	Until you delete your account, then removed within 30 days
Location data (real-time)	Not persisted beyond the active session; trip pickup/drop-off locations follow trip data retention
Crash reports and analytics	12 months
Device and push tokens	Until you delete your account or revoke permissions

We may retain data longer if required by law or to resolve disputes.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your account and associated data.
• Portability: Request your data in a structured, machine-readable format.
• Restriction: Request that we restrict processing of your data in certain circumstances.
• Objection: Object to processing based on legitimate interest.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at privacy@bossx.app. We will respond within 30 days.

8. California Residents (CCPA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of your personal information.
• Right to Opt-Out of Sale: We do not sell your personal information. No opt-out is necessary.
• Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To make a request, email privacy@bossx.app with the subject line "CCPA Request".

9. Data Security

• All data in transit is encrypted using TLS 1.2 or higher.
• Data at rest is encrypted on Google Cloud Platform.
• Access to production systems is restricted and authenticated.
• We use Firebase Authentication with industry-standard protocols.

No system is 100% secure. While we take reasonable measures to protect your data, we cannot guarantee absolute security.

10. Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach, where required by law.
• Notify affected users without undue delay if the breach is likely to result in a high risk to your rights and freedoms.
• Provide details of the breach, its likely consequences, and the measures taken to address it.

11. Analytics and Crash Reporting

We use the following services to understand app usage and improve stability:

• Firebase Analytics: Collects anonymized usage events (e.g., screen views, feature interactions). Does not collect personally identifiable information.
• Firebase Crashlytics: Collects crash logs, device state, and stack traces when the app encounters an error. Used exclusively for debugging and stability improvements.

You can limit analytics data collection through your device settings.

12. Children

The Service is not intended for persons under 18 years of age. We do not knowingly collect personal information from children under 18. If we become aware that we have collected data from a child under 18, we will promptly delete it. If you believe a child has provided us with personal data, contact us at privacy@bossx.app.

13. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to read their privacy policies.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the app or by email at least 14 days before the changes take effect. The "Effective date" at the top of this page indicates the latest revision.

15. Contact

If you have questions or concerns about this Privacy Policy or our data practices:

BOSSX GLOBAL LIMITED
Privacy inquiries: privacy@bossx.app
General: contact@bossx.app