Privacy Policy

This Privacy Policy describes how Sahayogi One Private Limited ("Company", "we", "us", or "our") processes personal information in connection with the BoSS platform ("Platform"), the BoSS website, and related support, onboarding, and communication workflows.

This page is intended to describe our current data-handling practices. It is not a certification, legal opinion, or promise of controls that are not yet implemented.

We may process the following categories of information:

a. Account and workspace information

• Name, email address, mobile number, company or workspace details
• User role, login method, and access configuration
• Information submitted during demos, onboarding, support, or implementation

b. Business and operational data

• Records, documents, ledgers, transactions, and master data entered by customers in the Platform
• Organisation identifiers such as GSTIN, PAN, TAN, or related statutory fields where the product requires them

c. Technical and security data

• Session and authentication data used to sign in and secure access
• IP address, request timestamps, device or browser details, and security logs
• Cookie-based preference data such as workspace or report-scope selections

d. Communications data

• Email, WhatsApp, or support conversations with our team
• OTP delivery events and verification records used for login or lead verification

We use information to operate and secure the Platform, including to:

• Create and administer user accounts and workspaces
• Authenticate users and prevent unauthorised access
• Deliver the product features the customer has enabled or subscribed to
• Provide support, implementation, and service communications
• Investigate misuse, security incidents, fraud, or operational failures
• Meet statutory, audit, tax, accounting, or contractual obligations
• Improve the Platform based on operational feedback and product usage patterns

We do not sell personal information. We may share information only where reasonably necessary, including with:

• Service providers that support hosting, messaging, email delivery, storage, or similar infrastructure
• Payment or billing partners where a customer purchases a paid plan or add-on
• Government, tax, or compliance systems when a customer explicitly uses a connected filing or statutory workflow
• Professional advisers, auditors, or authorities when required by law or to protect legal rights
• A successor entity in connection with a restructuring, financing, merger, or sale of business assets

Our current implementation includes a number of practical security controls, such as:

• Encrypted transport over HTTPS/TLS in production environments
• Hashed passwords and server-side hashed OTP verification data
• Role-based access controls and workspace-scoped access checks
• Rate limiting on authentication and other sensitive routes
• Structured application logging with redaction for secrets and sensitive fields
• Audit logging for critical product operations in key flows

Security controls evolve over time, and this page should be read as a current-state summary rather than an absolute guarantee that every control applies uniformly to every deployment, module, or integration.

We retain information for as long as needed for the relevant service purpose, support need, security review, or legal retention requirement. Some data entered into the Platform may need to be preserved for statutory, tax, accounting, fraud-prevention, or audit reasons even after an account is closed or access is disabled.

Retention periods can therefore vary by data type. Requests for deletion or cleanup are reviewed in light of those obligations and the product's current retention mechanics.

Depending on the law that applies to the request, you may be able to ask us for access, correction, deletion, objection, restriction, export, or withdrawal of consent for certain data processing activities.

Some requests may be limited where we must retain records for legal, tax, accounting, security, or dispute resolution purposes, or where the data is held by us on behalf of a customer that controls the underlying use.

To make a request, contact us at support@sahayogi.in.

We use cookies and similar storage mechanisms primarily for authentication, session continuity, short-lived verification flows, and product preferences. More detail is available in our Cookie Policy.

The Platform may rely on third-party infrastructure or communication providers. Those providers may process limited information as part of delivering their service to us. Their own policies and contractual terms apply to the parts of processing they control.

BoSS is intended for business use. It is not designed for children, and we do not intentionally build the service for use by minors. If we discover personal information was submitted inappropriately, we will review and handle it in line with applicable law and our operational obligations.

We may update this Privacy Policy as our product, legal obligations, or data flows change. The latest version will be posted on this page with an updated revision date.

For privacy questions or rights requests, contact: