Privacy Policy

This Privacy Policy explains how Boon processes personal data when you access or use Boon, including our website, web application, mobile applications, browser extensions, messaging integrations, email and calendar agent features, voice or audio features, and any related services made available under the Boon name.

Boon is an AI agentic companion designed to support young professionals with high-stakes life goals. Depending on the features you enable, Boon may help you organise information, reason through options, draft content, analyse uploaded files, interact with connected accounts, and take user-authorised actions.

This Privacy Policy is part of the contract between you and Boon. It should be read together with our Terms of Use and our Cookie Policy.

Boon is not an emergency service. Boon must not be used for emergencies of any kind, health advice, psychological crisis support, crisis intervention, or any situation requiring immediate professional, medical, emergency, or public authority assistance.

The controller of your personal data is:

Aaron Rodilla

NIF: 51116528V

Address: Calle Arturo Soria 338, 7b Izq, 28033 Madrid, Spain

Email for privacy matters: privacy@withboon.uk

Boon has not appointed a formal Data Protection Officer. Privacy requests and questions should be sent to the controller at privacy@withboon.uk.

Boon is only intended for users who are at least 18 years old.

You must not create an account or use Boon if you are under 18. If we discover that an account belongs to a person under 18, we may suspend or delete the account and associated data, subject to any legal obligations requiring limited retention.

Boon does not knowingly collect personal data from children or minors.

Boon processes personal data to:

1. create and manage your account;
2. provide the Boon AI companion and agentic features;
3. personalise your experience through user profiles, preferences, goals, and memory;
4. process your uploaded files and, where enabled, audio or voice inputs;
5. connect to third-party accounts that you authorise, such as email, calendar, contacts, messaging, productivity, or professional platforms;
6. perform actions on your behalf where you authorise Boon to do so;
7. process subscriptions, payments, invoices, refunds, and fraud checks;
8. send service communications and newsletters where you subscribe;
9. provide support and respond to your requests;
10. secure, debug, monitor, and improve Boon;
11. perform analytics, attribution, advertising measurement, retargeting, and product research;
12. comply with legal obligations and enforce our rights.

We do not use your prompts, chats, uploaded files, audio, or personal content to train or fine-tune Boon's own AI models. We also contractually configure third-party AI providers, where applicable, so that they do not use your content to train their models.

The personal data we collect depends on how you use Boon and which features you enable.

5.1 Account and identity data

We may collect:

• first name and surname;
• username or display name;
• email address;
• phone number;
• date of birth or age confirmation;
• country, city, and approximate location derived from IP address;
• profile photo or avatar;
• login credentials;
• magic-link or email one-time-passcode data;
• OAuth data from login providers such as Google, Apple, Microsoft, or other identity providers;
• account status, plan, preferences, settings, consent records, and security events.

5.2 Profile, goals, preferences, and memory

Boon may collect and generate information about:

• your goals;
• priorities;
• personal or professional plans;
• preferences;
• productivity patterns;
• decision context;
• tasks;
• reminders;
• projects;
• life-goal information;
• user profile fields;
• persistent memory created by or for Boon.

Persistent memory is used to provide a more useful and personalised service over time. You may manage or delete memory through the product controls made available to you.

5.3 AI interactions and user content

When you use Boon, we may process:

• prompts;
• messages;
• chats;
• instructions;
• generated outputs;
• documents and files you upload;
• file metadata;
• annotations, summaries, and extracted information;
• feedback you provide about AI outputs;
• audio or voice inputs, if audio features are enabled;
• transcriptions, embeddings, classifications, and other technical representations needed to provide the service.

5.4 Connected accounts and integrations

If you choose to connect third-party services, Boon may process personal data from those services according to the permissions you grant.

Integrations may include, for example:

• Google services, including Gmail, Google Calendar, Google Contacts, and other Google APIs;
• Microsoft services, including Outlook, Microsoft Calendar, Microsoft contacts, and other Microsoft APIs;
• Apple services;
• WhatsApp;
• Slack;
• Notion;
• LinkedIn;
• messaging, productivity, professional, scheduling, and communication tools;
• other third-party services you authorise.

Boon accesses these services through OAuth or equivalent API permissions. Boon does not ask you to provide passwords for third-party accounts.

You control whether to connect an integration, what permissions to grant, and whether to revoke those permissions. Depending on the integration, you may be able to choose between read-only access, send or write access, calendar editing, contact access, form submission, posting permissions, or other feature-specific scopes.

5.5 Email, calendar, contacts, and communication data

Where you connect relevant accounts, and only with your consent, Boon may process:

• email metadata;
• email contents;
• drafts;
• recipients;
• calendar events;
• event titles, descriptions, attendees, dates, and locations;
• contacts;
• contact names, roles, relationship context, email addresses, phone numbers, and related metadata;
• messages or communications needed to perform user-authorised actions.

Boon will process this data only to provide the connected functionality you enable, such as helping you draft or send communications, schedule events, organise tasks, understand professional context, or take authorised actions.

5.6 Third-party personal data provided by users

You may include limited contextual information about third parties, such as names, roles, relationship to you, professional context, employer, recruiter, school, lawyer, immigration official, client, colleague, or similar contextual references.

You must not upload, submit, or instruct Boon to process private, confidential, or sensitive personal data about another person unless you have the lawful right and authority to do so. You are responsible for ensuring that any third-party personal data you provide to Boon is lawful, accurate, relevant, and proportionate.

5.7 Payment and billing data

Boon operates on a freemium model and may offer paid plans, subscriptions, trials, upgrades, add-ons, or paid features.

Payments are processed through Stripe and may in the future be processed through other reputable payment providers. We may process:

• plan and subscription status;
• billing name;
• billing address;
• email address;
• tax information;
• invoice and receipt information;
• payment status;
• refund, dispute, and chargeback information;
• limited payment metadata received from payment processors.

We do not intentionally store full payment card numbers. Payment processors process payment data according to their own security standards and privacy terms.

5.8 Technical, usage, and device data

We may collect:

• IP address;
• approximate location derived from IP address;
• device type;
• operating system;
• browser type and version;
• app version;
• language preferences;
• identifiers, cookies, pixels, and similar technologies;
• referring URLs;
• pages and features viewed;
• session information;
• errors, crashes, logs, diagnostics, latency, performance, and security events;
• interaction events and feature usage.

5.9 Marketing, analytics, and advertising data

We may process:

• newsletter subscription status;
• email engagement data;
• campaign attribution data;
• referral or invitation data;
• advertising identifiers;
• cookie identifiers;
• conversion events;
• retargeting events;
• analytics and usage events;
• consent and opt-out signals.

We may use Google Ads, Google Analytics, Google Tag Manager, Meta Pixel, TikTok Pixel, LinkedIn Insight Tag, Microsoft Ads/Bing, Amplitude, Hotjar, New Relic, custom analytics, InMobi CMP, and similar tools as described in this Privacy Policy and our Cookie Policy.

Boon is designed to support users with serious personal and professional goals. Depending on how you use the service, Boon may process sensitive or highly personal information.

Boon may process sensitive data because of the nature of the service, including information relating to:

• legal issues;
• immigration matters;
• employment and career matters;
• education;
• high-stakes life circumstances;
• other personal circumstances you choose to disclose.

Boon is not designed for health advice, medical advice, psychological crisis support, emergency situations, or crisis intervention. You must not use Boon as a substitute for emergency services, medical professionals, therapists, crisis lines, lawyers, immigration advisers, financial advisers, or other qualified professionals where professional advice is required.

Where Boon processes special category data under the GDPR, we will request your explicit consent during onboarding or before enabling relevant sensitive features, unless another lawful exception applies. You may withdraw your consent at any time, although withdrawing consent may limit or disable relevant features.

You should not submit criminal-offence data, health data, or crisis-related information unless a feature expressly allows it and the relevant legal basis and safeguards are presented to you.

Boon uses artificial intelligence technologies to provide its core functionality. AI processing may involve routing user instructions, files, context, memory, and other relevant data through model providers and AI infrastructure providers.

Boon may use multiple AI providers, including providers available through Cloudflare AI Gateway, such as OpenAI, Anthropic, Google, Mistral, DeepSeek, and other model providers.

We use third-party AI providers to generate, classify, summarise, transform, reason over, transcribe, or analyse user content, depending on the features you use.

We do not use your prompts, chats, uploaded files, audio, or personal content to train or fine-tune Boon's own AI models. Where third-party AI providers are used, we configure and contract with them so that user content is not used to train their models, where such configuration or contractual commitment is available.

AI outputs may be inaccurate, incomplete, outdated, or unsuitable for your circumstances. Boon provides informational support and user-authorised assistance; it does not replace your own judgment or qualified professional advice.

Boon may perform actions on your behalf where you authorise it to do so. These actions may include:

• sending emails or messages to third parties;
• scheduling, changing, or cancelling calendar events;
• submitting forms or applications;
• making purchases or payments;
• accepting, rejecting, or responding to opportunities;
• applying to jobs, educational programmes, or other opportunities;
• assisting with legal or immigration-related submissions;
• interacting with connected third-party services;
• other consequential actions that you enable.

For consequential actions, Boon will generally require a separate, explicit confirmation immediately before execution, except for predefined low-risk actions that you have authorised in advance.

You may configure the scope of Boon's permissions, including which integrations are connected, whether access is read-only or write-enabled, what actions are allowed, and what approval thresholds apply.

Where Boon performs automated actions, it does so as a tool acting under your instructions and authorisation. You remain responsible for reviewing proposed actions, checking accuracy, and deciding whether an action should be taken.

Where applicable law gives you rights in relation to automated decision-making, including the right not to be subject to certain decisions based solely on automated processing that produce legal or similarly significant effects, you may exercise those rights by contacting privacy@withboon.uk.

Boon is designed to protect private user content from ordinary human access.

Communications and sensitive content are protected using encryption and access controls. Boon's internal policy is that staff should not read private user communications, chats, files, or connected-account content in the ordinary course of business.

Human access may occur only in limited circumstances, such as when:

1. you expressly request support and share relevant information with us;
2. access is strictly necessary to investigate a security incident, abuse, fraud, or legal claim;
3. access is required to comply with a valid legal obligation;
4. access is needed to protect the rights, safety, or integrity of Boon, users, or third parties.

Even in those cases, access should be limited to what is necessary, subject to confidentiality obligations, technical controls, and internal approval processes where appropriate.

Because Boon is an AI service, user content may be technically processed by automated systems and authorised processors in order to provide outputs, run integrations, maintain security, and deliver the service.

We process personal data under the following lawful bases, depending on the purpose.

Where we rely on consent, you may withdraw it at any time. Withdrawal of consent does not affect processing that occurred before withdrawal.

Where we rely on legitimate interests, we balance our interests against your rights and freedoms. You may object to processing based on legitimate interests where applicable.

We may process data to understand, maintain, secure, and improve Boon. This may include analytics, debugging, feature usage, aggregate statistics, safety evaluation, reliability testing, and performance monitoring.

We may use Amplitude, Hotjar, New Relic, custom analytics, Cloudflare, and similar technologies for analytics, diagnostics, and product monitoring.

We do not use your personal content to train AI models. AI-output evaluation beyond support, safety, debugging, and security is performed using anonymised or aggregated content.

We may send you:

1. service emails necessary to provide Boon, including account, security, billing, feature, policy, and operational notices; and
2. newsletters where you have subscribed.

Newsletter subscription may occur through a separate opt-in checkbox during signup or through a separate newsletter form.

You may unsubscribe from newsletters at any time by using the unsubscribe link in the email or by contacting privacy@withboon.uk. You may still receive service emails where they are necessary for your account or the service.

Boon may allow you to invite or refer other people.

Referral features may allow you to manually enter an invitee's details or share an invitation link. Boon will not automatically access your contacts for referrals unless you separately connect and authorise a contacts integration.

You must only invite people where you have a lawful and appropriate basis to do so.

Boon uses cookies, pixels, SDKs, local storage, identifiers, and similar technologies.

We may use:

• strictly necessary cookies;
• preference cookies;
• analytics cookies;
• performance cookies;
• advertising cookies;
• attribution and conversion tracking technologies;
• retargeting technologies;
• consent-management technologies.

Boon uses InMobi CMP as its consent-management platform.

We may use Google Ads, Google Analytics, Google Tag Manager, Meta Pixel, TikTok Pixel, LinkedIn Insight Tag, Microsoft Ads/Bing, and similar tools for advertising, retargeting, attribution, and measurement.

The detailed and current list of cookies and similar technologies is provided in our Cookie Policy at:

https://withboon.uk/cookie-policy

Where legally required, non-essential cookies and tracking technologies will be used only with your consent. You may manage your choices through the consent-management tool and through your browser or device settings.

Boon does not sell personal data for money.

However, Boon may share limited identifiers, cookie data, device data, and event data with advertising partners for targeted advertising, retargeting, attribution, conversion measurement, and campaign optimisation.

Depending on the law that applies to you, this may be considered a "share," "targeted advertising," or similar regulated disclosure.

Where legally required, Boon will provide opt-out mechanisms for sale, sharing, targeted advertising, or similar processing. Boon will honour legally required opt-out signals and privacy choices where applicable.

Boon does not knowingly sell or share personal data of users under 18 because users under 18 are prohibited from using the service.

We may share personal data with the following categories of recipients where necessary for the purposes described in this Privacy Policy:

1. Hosting and infrastructure providers , including Railway, Cloudflare, MongoDB Atlas, and AWS.
2. AI infrastructure and model providers , including providers routed through Cloudflare AI Gateway, such as OpenAI, Anthropic, Google, Mistral, DeepSeek, and other AI providers.
3. Payment providers , including Stripe and possible future payment processors.
4. Analytics, diagnostics, and product monitoring providers , including Amplitude, Hotjar, New Relic, custom analytics systems, and similar providers.
5. Email and communications providers , including Resend.
6. Advertising and measurement partners , including Google, Meta, TikTok, LinkedIn, Microsoft, and similar partners.
7. Consent-management providers , including InMobi CMP.
8. Identity and authentication providers , including Google, Apple, Microsoft, and other OAuth or login providers.
9. Third-party integrations you connect , including email, calendar, contacts, messaging, productivity, professional, and workflow services.
10. Professional advisers , including lawyers, accountants, auditors, insurers, and consultants.
11. Authorities, courts, regulators, or law enforcement , where required by law or necessary to protect rights, safety, security, or legal interests.
12. Successors or parties to business transactions , if Boon is involved in a merger, acquisition, financing, restructuring, transfer, or sale of assets, subject to appropriate confidentiality and legal safeguards.

We require service providers to process personal data according to contractual obligations, confidentiality duties, security requirements, and applicable law.

Boon is controlled from Spain and may process or store personal data in the European Economic Area and the United States.

Some service providers and AI providers may process personal data outside the EEA, the United Kingdom, or your country of residence.

Where personal data is transferred internationally, we rely on appropriate safeguards where required, including Standard Contractual Clauses, equivalent contractual safeguards, adequacy decisions, data processing agreements, technical measures, and supplementary safeguards where applicable.

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, disclosure, or destruction.

These measures may include:

• encryption in transit;
• encryption or equivalent protection for stored sensitive data where appropriate;
• access controls;
• authentication controls;
• logging and monitoring;
• segregation of duties;
• provider security reviews;
• restricted internal access;
• secure development practices;
• backup and recovery controls;
• incident response processes.

No online service can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials, devices, connected accounts, and authentication methods.

If you believe your account or data has been compromised, contact privacy@withboon.uk immediately.

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

When you delete your account:

• account and profile data will be deleted or anonymised within 30 days;
• AI chats and memory will be deleted or anonymised within 30 days;
• uploaded files will be deleted or anonymised within 30 days;
• connected-account tokens and permissions will be revoked or deleted according to the applicable integration process;
• security logs will be retained only as needed, often for shorter periods;
• billing, tax, payment, accounting, refund, dispute, and legal records will be retained for the period required by applicable law;
• limited data may remain in encrypted backups for a limited period before being overwritten or deleted through normal backup cycles.

We may retain limited information for longer where necessary to:

• comply with legal obligations;
• resolve disputes;
• prevent fraud or abuse;
• enforce agreements;
• maintain security;
• establish, exercise, or defend legal claims.

Where possible, we will anonymise or aggregate data instead of retaining identifiable personal data.

Boon provides in-product controls that allow users to manage and delete:

• chats;
• memories;
• uploaded files;
• account information;
• connected integrations;
• account deletion.

You may also contact privacy@withboon.uk to exercise privacy rights or request assistance.

Depending on where you live and which law applies, you may have the right to:

1. obtain confirmation as to whether we process your personal data;
2. access your personal data;
3. request correction of inaccurate or incomplete data;
4. request deletion of your personal data;
5. restrict processing;
6. object to processing based on legitimate interests;
7. object to direct marketing;
8. withdraw consent;
9. request data portability;
10. object to, or request safeguards in relation to, automated decision-making;
11. opt out of targeted advertising, sale, or sharing where legally applicable;
12. lodge a complaint with a supervisory authority.

To exercise your rights, contact:

privacy@withboon.uk

We may need to verify your identity before responding. Verification will be proportionate to the request and the sensitivity of the data involved. We will not require an identity document by default unless necessary.

You may lodge a complaint with the Spanish Data Protection Agency:

Agencia Española de Protección de Datos (AEPD)

https://www.aepd.es

Boon may help you make decisions and may perform user-authorised actions that have significant consequences, including in career, education, immigration, legal, financial, professional, or personal contexts.

Boon will not intentionally take legally or similarly significant actions without your authorisation. For high-risk or consequential actions, Boon will generally ask for separate confirmation immediately before execution, except for predefined low-risk actions that you have authorised in advance.

Where applicable law gives you rights in relation to automated decision-making, you may request information about the logic involved, request human review where applicable, express your point of view, contest a decision, withdraw relevant consent, or disable the relevant feature.

Boon is not the final decision-maker for decisions made by employers, schools, authorities, courts, immigration bodies, financial institutions, platforms, or third parties.

Boon may contain links to third-party websites, applications, services, or platforms. Boon may also allow you to connect third-party services through integrations.

Those third-party services are governed by their own terms and privacy policies. We are not responsible for how third parties process your data when they act as independent controllers.

When you connect a third-party integration, you should review the permissions requested and the privacy terms of that provider.

We may disclose personal data where we reasonably believe disclosure is necessary to:

• comply with applicable law;
• respond to a valid legal process;
• cooperate with courts, regulators, or public authorities;
• enforce our Terms of Use;
• investigate fraud, abuse, or security incidents;
• protect the rights, property, safety, or security of Boon, users, or third parties.

Boon is not an emergency service. If you are in danger or need urgent assistance, contact local emergency services or the appropriate public authority.

We may update this Privacy Policy from time to time.

If changes are material, we will provide notice by appropriate means, such as through the website, app, email, account notice, or another reasonable method.

The "Last updated" date at the top of this Privacy Policy indicates when it was last revised.

For privacy questions, requests, or complaints, contact:

Aaron Rodilla

NIF: 51116528V

Address: Calle Arturo Soria 338, 7b Izq, 28033 Madrid, Spain

Email: privacy@withboon.uk