BOL OS Privacy Policy

BOL OS is operated by BOL Agency (“BOL”, “we”). It is an invite-only workspace application used by BOL and by client companies BOL works with. Each company uses its own workspace. This policy covers the web application at os.bol-agency.com. The BOL OS Browser extension has its own policy at /privacy/extension.

• Account details. Your name, email address, and profile picture, from the invitation you accepted or from Google when you sign in with Google. From Google we request only your basic profile and email address, to match you to your invitation and show your name.
• What you and your teammates put in your workspace. Conversations with agents, wiki pages, tasks and comments, reports, and the settings you choose.
• Connected accounts. When someone connects a service such as Gmail, Google Calendar, Slack, or a meeting recorder, we store what is needed to keep that connection working and the data the agents fetch from it while doing the work they were asked to do. Access tokens are held by our integration provider or in a vault that only server-side code can read; they never reach a browser.
• Usage records. Agent activity, sign-in events, and error logs, used to run the service and keep it reliable.

To provide BOL OS: to run the agents you talk to, keep your workspace's wiki and tasks current, send you the emails you have asked for (invitations, task assignments, mentions), and secure the service. We do not sell personal data and we do not use workspace content to advertise to you.

Agents are powered by large language models from third-party providers. The content needed to answer a request, such as the message you sent, relevant wiki pages, or a calendar day, is sent to the model provider to generate a response. We use providers that do not train their models on data sent through their API.

Data belongs to the workspace it was created in. People see only the workspaces they have been added to, and within a workspace, what their role and teams allow. Nothing in one company's workspace is visible to another company. BOL's platform administrators can access workspaces to operate and support the service.

BOL OS runs on Vercel, stores data with Supabase (Postgres, hosted in the United States), sends email through Resend, and connects to third-party services through Composio and the services' own APIs. Each of these processes data only on our instructions, under their own security commitments.

• Edit your name and picture under Settings → Profile.
• Disconnect a connected account at any time under Settings → Integrations; we then stop using it.
• Ask a workspace admin to remove you; removal from your last workspace deletes your account.
• Email privacy@bol-agency.com to ask what we hold about you, to correct it, or to have it deleted.

Workspace content is kept for as long as the workspace exists, so the team's knowledge stays intact. Access is controlled per workspace, per role, and per team, enforced in the database; all traffic is encrypted in transit and data is encrypted at rest by our hosting providers.

We will update this page when our practices change and note the date at the top. Questions go to privacy@bol-agency.com.