Privacy Policy (draft)

1. Roles

For Customer Data inside a workspace, the Customer is the controller and CCSIT is the processor (see the Data Processing Agreement). For account, billing, website and security data, CCSIT is the controller and this policy applies.

2. What we collect

Account data: name, work email, job title, role, language and time-zone preferences.

Security data: sign-in times, IP addresses, browser user agent, two-step verification events, kept to protect accounts.

Billing data: company name, billing contact and invoices (card details are handled by our payment provider, never stored by Bosla).

Usage data: feature usage and AI credit consumption, to operate plans and improve the Service.

3. Why we use it (lawful bases)

To provide the Service under our contract with your organisation; to secure accounts and prevent abuse (legitimate interest and legal obligation); to bill (contract, legal obligation); to send service emails you can control in your notification settings.

4. Where data is stored

The Bosla cloud is currently hosted by Hetzner Online GmbH in Helsinki, Finland (European Union), and Customer Data is stored and processed there. The data region shown in workspace settings (UAE, Saudi Arabia or Egypt) is an organisational setting: until in-region hosting is offered it does not change where data is physically stored [● CCSIT to decide whether and when UAE, Saudi and Egyptian hosting is offered]. Your own data centre is available for on-premises (Sovereign) deployments. When live AI is enabled, the relevant data is sent to the AI provider listed on the Subprocessors page with appropriate safeguards [● cross-border transfer mechanism per jurisdiction].

5. Retention

Account data: while the account exists plus [●] months. Security logs: 12 months. Billing records: as required by tax law. Customer Data: as set out in section 10 of the Terms of Service.

6. Your rights

You may request access, correction, deletion, restriction or a copy of your personal data, and object to processing, by writing to privacy@ccsit.co. If your data is in a customer's workspace, we will pass the request to that customer as controller. You may also complain to the competent data protection authority (e.g. Egypt's Personal Data Protection Centre, SDAIA in Saudi Arabia, the UAE Data Office).

7. Security

Encryption in transit (TLS) and at rest, bcrypt password hashing, optional and enforceable two-step verification, role-based access with client isolation, antivirus scanning of uploads, audit and security logs, and regular penetration testing.

8. Cookies

We use strictly necessary cookies to keep you signed in and the service secure, and, only with your consent, cookies and browser storage that remember your display choices and anonymous page-speed measurements. No advertising or third-party tracking cookies are used. The Cookie Policy lists every item and you can change your choices at any time from "Cookie settings".

9. Contact

Data protection contact: privacy@ccsit.co. [● Data Protection Officer name and registration where required.]