This policy explains what personal information BOFU Software Inc. (“BOFU”, “we”, “us”) collects when you visit bofu.ai, take the free assessment, book a call or use the BOFU app, how we use it and the choices you have. If you have a question about it, write to [email protected].
What we collect
Information you give us
- Account details: your name, email address and password (stored hashed), or the profile Google shares when you sign in with Google.
- Assessment and booking details: the website, company details and answers you enter in the assessment, and the name, email and notes you give when you book a call.
- Your content: the projects, documents, files, notes, prompts and other material you upload to or create in the app (“Customer Content”).
- Billing details: billing name, address and plan. Card details go straight to our payment processor, Stripe; we never see or store full card numbers.
- Support conversations: messages you send us by email or through in-app chat.
Information from connected services
If you connect a third-party account, such as Google Search Console or Google Drive, we receive only the data needed for the feature you turned on: for example, search performance data for the sites you choose, or the files you pick. You can disconnect at any time from the app’s settings or from your Google account.
Information collected automatically
- Usage and device data: pages and features used, IP address, browser and device type, and timestamps, kept in server logs to run, secure and debug the service.
- Analytics: the pages you view on bofu.ai and in the app, measured with PostHog, as described under Cookies and analytics.
- Cookies: we use strictly necessary cookies to keep you signed in and to deliver private images in your documents, and analytics cookies on bofu.ai as described under Cookies and analytics. We do not use advertising cookies.
Public web data
To do its job the app reads public web pages, such as your site and the competitors you name, and takes screenshots of them. That data is about businesses and their pages, not about you.
The website assessment
- What we read: only the public pages of the domain you type, such as its home page, a few linked pages, its sitemap and a sample of its blog, plus what public AI answer engines say about it. We do not sign in to anything or read pages behind a login.
- What we store: your answers, your email address and first name if you give them, a hashed form of your IP address (we never store the address itself), the page that referred you, and the scan results: short summaries and counts from those public pages and a screenshot of the home page. When you submit your email, the page also sends the address of the page you were on, the page that referred you and, if PostHog is running on the page, the identifier PostHog gave your browser, so we can see which of our pages you read before taking the assessment.
- How long: if you never open the report link we email you, we delete your email, name, answers and hashed IP after 30 days. If you open it, we keep them for 12 months, unless you become a customer, in which case they are kept with your account. Scan results about the website are kept for reuse and contain nothing about you.
- Who sees it: you, through the private link we email you, and the BOFU team who follow up on assessments. Our email providers (Loops or Resend for the report email, Kit for marketing) receive your email address only to send what is described here. We never sell it.
- Marketing: we send you one email with your report. You get anything more, such as the playbook or news, only if you tick the box asking for it and then open the report link, and you can unsubscribe at any time.
- Deleting it: write to [email protected] from the address you used and we will delete your email, name, answers and hashed IP from every assessment you took.
Cookies and analytics
We measure visits to bofu.ai with PostHog, a product analytics service run by PostHog, Inc. in the United States (its US cloud). The requests go through e.bofu.ai, a subdomain of ours that forwards them to PostHog. PostHog records the pages you view, the page that referred you, your browser, device type and approximate location from your IP address, and, if you take the assessment, which steps you reach: started, answers sent, email sent, report opened and a click to book a call. With those steps we send only the score tier and the suggested next step, never your email address, your answers or the website you entered, and we remove the private report link from every address PostHog receives. We do not record clicks automatically or record your session.
- In the EU and EEA, the UK, Switzerland and Quebec, we ask first. Until you choose, or if you decline, PostHog keeps its identifier in the page’s memory only. Nothing is stored on your device, and each page you open counts as a new visit. We tell where you are from the approximate location of your connection, and ask whenever we cannot tell.
- Everywhere else, PostHog stores an identifier in a cookie and in your browser’s local storage without asking, unless your browser sends a Global Privacy Control signal, which we treat as declining.
- With your consent, the identifier is kept on bofu.ai and its subdomains, so your visits link together. That is how we see which articles led to an assessment or a call.
- Your choice is kept in your browser’s local storage. Anyone can change it at any time with “Cookie settings” at the foot of any page; declining removes PostHog’s stored identifier.
In the BOFU app, we use PostHog to see which features are used and to catch errors, under the same provider terms.
How we use it
- to provide, maintain and improve BOFU, including running the AI features you request;
- to create and secure your account, and to prevent fraud and abuse;
- to process payments and keep billing records;
- to send service emails (sign-in links, receipts, run results) and, if you signed up for them, product and marketing emails, which you can unsubscribe from at any time;
- to answer support requests and prepare for calls you booked;
- to comply with the law and enforce our Terms of Service.
We do not sell your personal information, and we do not use Customer Content to train AI models. Our AI providers process Customer Content only to return results to you, under terms that do not allow them to train on it.
Google user data
BOFU’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use Google data only to provide the features you connected it for, never for advertising, and we do not let people read it except with your permission, for security, or where the law requires.
Who we share it with
We share personal information only with:
- Service providers that run parts of BOFU for us under contract: cloud hosting and storage, payments (Stripe), email delivery (Loops, Resend), email marketing (Kit, United States), product and website analytics (PostHog, United States), scheduling (Cal.com), AI model and search providers (reached through the Vercel AI Gateway, plus Exa), browser rendering (Browserbase) and Cloudflare. They may use the data only to provide their service to us.
- Your team: members of your organization and projects can see the content shared with them.
- Legal and safety: when the law requires it, or to protect the rights, safety or property of BOFU, our users or others.
- Business transfers: as part of a merger, acquisition or sale of assets, subject to this policy.
How long we keep it
We keep account information and Customer Content while your account is active. When you delete a project or your account, we delete the related data within 30 days, except where we must keep it longer by law (for example, billing records) or in backups, which expire on their normal schedule.
Security
We encrypt data in transit, encrypt stored credentials for connected services, keep documents and images private behind access checks, and limit staff access to what is needed to run the service. No system is perfectly secure; if we learn of a breach that affects you, we will tell you as the law requires.
Your choices and rights
You can see and update most of your information in the app. Depending on where you live, you may also have the right to access, correct, delete or export your personal information, to object to or restrict how we use it, and to withdraw consent. To make a request, write to [email protected]; we will answer within 30 days and will not treat you differently for asking. You may also complain to your local data protection authority.
International transfers
We and our providers may process information in countries other than yours, including the United States and Canada. Where the law requires, we use appropriate safeguards such as standard contractual clauses.
Children
BOFU is a business service and is not meant for anyone under 16. We do not knowingly collect information from children.
Changes to this policy
We will post any change on this page and update the date at the top. If a change is significant, we will also tell you by email or in the app before it takes effect.
Contact
Questions or requests about this policy: [email protected]. BOFU Software Inc., 3919 Providence Road South, Ste B 727, Waxhaw, NC 28173, USA.