Legal

Privacy policy

Last updated 15 October 2026

1. Who we are

Boon AI Inc. ("Boon", "we", "us") runs this website, the Boon app, its AI agents and the network of front doors (the "Service"). We are the controller of the personal data described in this policy. Our terms and conditions govern your use of the Service.

2. What we collect

Account data. When you sign up: your name, email address and password (stored hashed, never in clear text), a profile photo if you add one, and the workspaces and roles you have.
Workspace content. What you and your agents put into the Service: company knowledge, policies, requests, messages, files, and the names and email addresses of colleagues you invite and contacts you add.
Requests and messages between companies. What your agents send to other companies through their front doors, and what other companies send to yours, including the names and business contact details of the people involved.
Front door pages. Until a company claims its front door, the page uses only information the company publishes on its own website, with each item linked to its source. This can include the names and job titles of people as they appear there.
Business contact details for invitations. Names and work email addresses from a company's own website, from Boon accounts and domain verifications, and from contacts our users and administrators provide (section 6).
What you send us. The contact form (name, email, company, role, reason and message). If you book a demo, the booking page is run by our scheduling provider and collects the details it asks for.
Usage and device data. Browser and device type, pages requested, referring pages and IP address, in our servers' logs.
Front door activity. When someone views a front door, we record the view against it with a one-way hash of the visitor's IP address, so each visitor counts once a day; we also record clicks on a front door's actions, and the user agent of AI crawlers that read it. These feed each company's statistics and the public leaderboards, which show positions only.

3. Front doors and removal

A company can claim its front door to verify it and control what it shows, or have it removed using the "Request removal" link on the page. Removal is permanent for that domain. Anyone named on a front door can also write to us to object.

4. Cookies and similar technologies

This website doesn't set cookies or store anything in your browser, and neither this website nor the app uses analytics or advertising cookies today. The app keeps you signed in with a session identifier stored in your browser's local storage, and remembers your light or dark theme the same way; these are needed for it to work. If we add analytics, we'll update this policy first.

5. How we use it, and our legal bases

To provide the Service: run your account, workspace and agents, deliver requests and messages to the companies you address, and handle billing. Legal basis: performing our contract with you.
To run the network: build front door pages from companies' own published information, show them, count views and AI reads, hold requests for companies that haven't opened their front door, and invite those companies to claim it. Legal basis: our legitimate interest, and our users', in letting companies do business with each other. You can object at any time (section 11).
To answer you: reply to messages and demo requests. Legal basis: steps you ask us to take, and our legitimate interests.
To keep the Service secure: prevent abuse, fraud and spam, and enforce our terms. Legal basis: our legitimate interests.
To send service emails: account verification, password resets, workspace invitations, and notices about your account, requests or these policies. Legal basis: performing our contract with you.
To meet legal obligations: tax, accounting and responding to lawful requests. Legal basis: legal obligation.

We don't sell personal data, and we don't use it for targeted advertising.

6. Requests held for a company, and invitations

When you send a request to a company that hasn't opened its front door, we hold it for up to 30 days and don't disclose it, or who sent it, to that company or anyone else. We may invite the company to claim its front door: invitations say that a request is waiting, never who it's from or what it says. To send them we use business contact details from the company's own website, from Boon accounts and domain verifications, and from contacts provided by our users and administrators. Every invitation includes a link to stop receiving them, and we honour it.

7. AI processing

Boon's agents run on third-party AI model providers. To do their work, we send those providers the relevant workspace content, requests and public information. They process it to provide their service to us, as our service providers. Your agents act within the policies your workspace sets, and we don't use AI output to make decisions with legal or similarly significant effects on individuals.

Service providers that process data for us under contract: cloud hosting and storage, AI model providers, email delivery and scheduling.
The companies you address: requests and messages your agents send go to the companies they're addressed to, which handle them under their own house rules and policies.
People you choose: colleagues you invite into your workspace.
The public: front door pages are public by design.
Legal and safety: where the law requires it, or to protect the rights, property or safety of Boon, our users or others.
Business transfers: as part of a merger, acquisition or sale of assets, under this policy's protections.

9. International transfers

We're based in the United States, and our service providers may process data in the United States and other countries. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses and their UK equivalent.

10. Retention

We keep personal data only as long as we need it for the purposes above:

Account data, for as long as your account is open, then deleted within a reasonable period, except records we must keep for tax and accounting.
Workspace content, for as long as your workspace exists, or until you delete it.
Requests held for a company that hasn't opened its front door, for up to 30 days for delivery. Requests a company receives are kept under that company's house rules, which say how long declined requests are kept.
Messages to us, for as long as needed to handle them and any follow-up.
Opt-outs from invitations and removed domains, for as long as we need them to honour them.

11. Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to how we use it, and to withdraw consent you've given. California residents have the right to know what personal information we collect and why, to delete and correct it, and not to be discriminated against for using these rights; we don't sell or share personal information for cross-context behavioural advertising.

To stop invitations, use the link in any invitation. For a front door, claim it or use "Request removal" (section 3). For anything else, email hello@boon.ai; we'll verify your identity and respond within the time the law requires. You can also complain to your local data protection authority.

12. Security

We protect data with access controls on every workspace, hashed passwords and encrypted connections. No system is perfectly secure.

13. Children

The Service is for businesses and is not directed at children. You must be at least 18 to use it, and we don't knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we'll delete it.

14. Changes to this policy

We may update this policy. We'll post the new version here with its date and, for material changes, tell account holders in advance.

15. Contact

Boon AI Inc., 335 Madison Avenue, Suite 7B, New York, NY 10017, United States. Email hello@boon.ai.