This policy explains what personal data Bos Commerce ("we") handles when you visit Bos Commerce, open a store on it or work in one, and what your rights are. Shoppers of a store on Bos Commerce should read that store's own privacy policy: the store decides how their data is used (see section 6).
1. Who is responsible
Bos Commerce, is responsible for the data described here. You can reach us at [email protected].
2. What we collect
- Your account: your name, email address and Google account identifier when you sign up or sign in with Google, and the same for the team members you invite.
- Your store: its name, address (domain), settings, and what you put in it.
- Billing: your plan, invoices, payments and, if you pay by bank transfer, the receipt you upload. Online payments are made on our payment gateway's page; we receive their result, not your card or account details.
- Use and security: the pages and actions in your dashboard, IP addresses, browser information, and records of sign-ins and important changes, kept to protect your store and to find and fix problems.
- Messages: what you write to us, and the emails we send you.
3. Why we use it
- To provide the service: run your store, sign you in, send you the emails it needs (invoices, notices), and support you.
- To bill your plan and keep the records the law requires.
- To keep Bos Commerce secure, prevent abuse and fix problems.
- To improve the service, using aggregated information about how it is used.
- To tell you about changes to the service. We do not sell your data or use it for advertising.
We rely on the contract with you, our legitimate interest in running a secure service, our legal obligations and, where needed, your consent.
4. Who helps us
We use these providers, each only for its task and bound to protect the data:
| Provider | What for |
|---|---|
| Our hosting provider | The servers that run Bos Commerce and store its data |
| Cloudflare | Delivering pages securely and quickly, domains, file storage, bot checks on forms |
| Signing in with your Google account | |
| Resend | Sending emails |
| Payment gateway | Online payments of your plan |
| Sentry | Reports of technical errors, if enabled |
The payment accounts you connect for your shoppers (Stripe, PayPal, a payment gateway) and the services you turn on in your store (such as Google Analytics, Google Merchant Center or Telegram) are your own: their terms and policies apply between you and them.
Some of these providers process data outside your country. Where they do, we rely on their contractual and technical safeguards for international transfers.
5. How long we keep it
We keep your account and store data while your store exists. When you close your store, its data is kept until you ask us to delete it, so you can reopen it or take a copy. Invoices and payment records are kept as long as tax and accounting law requires. Security records are kept for a limited time, then deleted.
6. Your shoppers' data
When shoppers buy from your store, the store decides why and how their data is used, and is responsible for it. We process it only on the store's behalf and instructions to run the store: we keep each store's data separate from every other store's, protect it, do not sell it, and do not use it for our own purposes. Shoppers who want to use their rights should contact the store; we help the store respond.
7. Cookies
Bos Commerce's website uses only the cookies it needs: one to keep you signed in, one for security (protection against forged requests), and one to remember the language you chose. Your store's pages use their own cookies, and analytics only if the store turns it on and the shopper agrees.
8. Your rights
Depending on the law that applies to you, including Indonesia's Personal Data Protection Law and, for people in the European Union or the United Kingdom, the GDPR, you can ask to see your data, correct it, delete it, receive a copy, object to or limit its use, and withdraw a consent you gave. Write to [email protected]; we answer within the time the law sets. You can also complain to your data protection authority.
9. Security
We protect your data with encryption in transit, each store's data kept separate from the others', encrypted storage of your payment keys, limited staff access, and regular updates. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.
10. Changes
We may update this policy. We will show the date of the last change below, and tell you by email or in your dashboard about significant changes.