Privacy Policy

1. Who we are

Yesboss is a service of Weird Labs Private Limited ("we", "us"), registered at 3/6 Soni Bunglow, Mathuradas Road, Kandivali West, Mumbai 400067, Maharashtra, India. This policy covers the Yesboss app at app.yesboss.si, this website, and the emails we send.

Each organisation that signs up ("your organisation") decides who joins it and what they use it for. For the chats, tasks and files people create in Yesboss, your organisation is the data fiduciary (the "controller") and we process that data on its behalf. For account, billing and website data, we are the data fiduciary.

2. What we collect

3. How Yesboss's AI uses your chats

• At regular intervals (every 5 or 30 minutes, depending on your plan), Yesboss reads new messages in your organisation's chats, including direct messages, to find requests that could become tasks. It reads the text, and the names and captions of any files. It never opens the files themselves.
• It sends that text, with the names of the people in the chat, to Anthropic's API, which runs the Claude models. Under Anthropic's commercial terms, this data isn't used to train their models.
• On the Pushy and Know-it-all plans, admins can turn voice transcripts on or off for their team. When they're on, the audio of recorded voice notes is sent to AssemblyAI, in the United States, which turns it into text, up to 20 minutes per person a month. AssemblyAI doesn't use it to train its models, and the audio is deleted from AssemblyAI once the text is back.
• The transcript is shown under the voice note, to the same people who can play it. Yesboss reads it like any other message, and if it suggests a task from a voice note, the transcript can go into the task's description. Transcripts are kept with their message or task and deleted with it.
• Yesboss only suggests. A person always confirms a task before it's created.
• On the Know-it-all plan, Yesboss also learns short rules from the corrections people make. An admin approves each one before it's used. Lessons from a direct message are approved by the two people in it instead. People can see, and delete, any facts Yesboss keeps about them.
• Yesboss never learns opinions about people, and lessons from a direct message never show up in other chats.
• Your admins can switch Yesboss off at any time. Chats and tasks keep working without it.

4. Why we use personal data

• To provide the service you or your organisation signed up for: chat, tasks, notifications, file sharing, Yesboss's suggestions and, where your team turns them on, voice transcripts.
• To tell you when Yesboss opens, if you joined the waitlist. That's one email, not a newsletter. If you listed tools you'd like Yesboss to work with, we use them only to decide which integrations to build first.
• To carry out actions you approve, once Yesboss actions launches (it's coming soon) and if you use it. Yesboss will draft an email, meeting or file share for a task. Only when you tap Send will it send that one thing from the account you connected. To draft, it will use the task, the chat it came from, and the names and types of the task's files, never what's inside them. Unsent drafts will be deleted after 30 days.
• To bill your organisation and keep the records tax law requires.
• To keep Yesboss secure, prevent abuse and fix problems.
• To contact you about your account, invites, security and changes to these policies. We send marketing emails only if you opt in, and every one has an unsubscribe link.
• To meet legal obligations, such as responding to lawful requests from authorities.

Where the law requires consent, for example for push notifications, we ask for it first, and you can withdraw it at any time.

4a. Connected accounts (Yesboss actions) Coming soon

Yesboss actions isn't available yet. This section applies once it launches. It will be optional. If you connect an account, Yesboss will ask only for the access it needs:

• Gmail: permission to send email you approved. Yesboss won't be able to read your inbox.
• Google Calendar: permission to create and change the events you approve.
• Google Drive: access only to files you pick or that Yesboss creates for you, not your whole Drive.

Your sign-in token will be encrypted and used only when you approve an action. You'll be able to disconnect from Settings at any time, and leaving or being removed from a team will disconnect you there. Either way, we'll revoke the access and delete the token. A connection will belong to one team and never be used for another.

Yesboss's use and transfer of information received from Google APIs will follow the Google API Services User Data Policy, including the Limited Use requirements. We don't use Google user data to train AI models, we don't sell it, and people don't read it unless you ask us to for support, it's needed for security, or the law requires it.

5. Who we share it with

We share personal data only with the providers below, who process it for us under contract, and when the law requires it. We never sell it.

Some providers process data outside India, including in the United States. We use providers that protect it to standards comparable to those in this policy.

6. What your organisation can see

• Admins can see the chats and channels they belong to, tasks in their departments, and usage reports.
• Admins can't read direct messages they aren't part of.
• Your organisation can export its chats and tasks, and delete its workspace.

7. How long we keep it

• Content stays for as long as your organisation uses Yesboss, unless people or admins delete it sooner.
• When an organisation deletes its workspace, we delete its data 30 days later.
• When an organisation cancels its plan, the plan keeps working until the end of the period it has paid for. We delete its data 30 days after that.
• When an organisation doesn't pay (a trial ends without a plan, or a payment fails), its workspace becomes read-only after 14 days. We delete its data 90 days after it becomes read-only. A new organisation still awaiting its first payment is deleted 90 days after it was created. Either way, we email the Owner and admins 30 days and 7 days before.
• Backups are overwritten within a further 30 days of any deletion.
• When someone leaves an organisation, their account is deactivated. Messages they sent stay in their organisation's chats.
• Billing records are kept for as long as tax and accounting law requires.
• Waitlist details are deleted once we've invited you, or after 12 months, whichever comes first. Email hello@yesboss.si to be removed sooner.

8. How we protect it

Data is encrypted in transit (TLS) and at rest. Each organisation's data is kept separate, and access is limited by role. Our AI provider key and other secrets are held in a secrets manager, never in the app. Yesboss is not end-to-end encrypted, because its AI has to read chat text on our servers. If we ever have a data breach that affects you, we'll tell you and the authorities as the law requires.

9. Your rights

Under India's Digital Personal Data Protection Act, 2023, and other laws that may apply to you, you can ask us to:

• tell you what personal data we hold about you and how we use it;
• correct, complete or update it;
• erase it, where we no longer need it or you withdraw consent;
• nominate someone to act for you if you die or become unable to;
• resolve a complaint (see Grievances, below).

For content inside your organisation's workspace, please contact your organisation's admin first, as they control it. For anything else, write to hello@yesboss.si. We reply within 30 days.

10. Cookies

This website sets no cookies and runs no advertising trackers. We count visits with Cloudflare Web Analytics: it records the page, the referring site, and your country, browser and device type, without cookies, without fingerprinting your device and without following you across sites. Like any website, Cloudflare receives your IP address to deliver its script. We use the counts only to see which pages are visited. It loads fonts from Google Fonts, which receives your IP address to deliver them. The Yesboss app stores sign-in data in your browser so you stay signed in. That's essential for the app to work and isn't used for tracking.

11. Children

Yesboss is for businesses and their staff. It's not meant for anyone under 18, and we don't knowingly collect their data.

12. Grievances

If you have a concern about how we handle personal data, contact our Grievance Officer:

Preet S
hello@yesboss.si
Weird Labs Private Limited, 3/6 Soni Bunglow, Mathuradas Road, Kandivali West, Mumbai 400067, Maharashtra, India

We acknowledge complaints within 48 hours and aim to resolve them within 30 days. If you're not satisfied with our answer, you can complain to the Data Protection Board of India.

13. Changes to this policy

If we make a significant change, we'll tell your organisation's admins by email or in the app at least 15 days before it takes effect. The date at the top shows when this policy last changed.