Privacy

BO2 is operated by The House of SaaS Pvt Ltd. This page describes what we collect when you use the product or this website, why we collect it, who else sees it, and what you can ask us to do about it. Last updated 22 October 2026.

Who is responsible for what

BO2 is sold to organisations, and most of the data in it is put there by your employer. For that data your employer decides what is collected and why — we only hold and process it on their instructions. If you are an employee and you want your records changed or removed, your organisation’s administrator is the right first contact, and they can usually act immediately.

For the handful of things we decide ourselves — this website, billing, and the diagnostics that tell us the product is broken — we are responsible, and you can come to us directly.

What we collect

• Account details — name, work email, phone number, job title, and which organisation and team you belong to.
• Business records entered in the product: customers and contacts, orders, visits, beats, payments and collections, expenses, leave, timesheets and attendance.
• Location, when a check-in, check-out or visit is recorded, and only at that moment. We do not track continuously and the app does not collect location in the background.
• Files you upload — receipts, photographs, documents and voice notes attached to those records.
• Device tokens, if you turn on push notifications, so a notification can reach your phone.
• Usage and error diagnostics — which screens failed, with what error — so we can tell when something is broken.

We do not collect government identifiers, financial account numbers, health information, or any other special category of personal data, and the product has no field designed to hold them.

Where it lives

On servers in Mumbai, India. Databases, uploaded files and outgoing email all stay in the Indian region. Uploaded files are encrypted at rest with keys we control, and everything travels over TLS. Each organisation’s data is separated at the application and storage layer, and access is checked on every request rather than assumed from the address of a file.

We do not sell your data. We do not use your business records to train models, for ourselves or for anyone else.

Who else touches it

We use a small number of service providers, each for one job. They may process personal data only to do that job:

• Amazon Web Services (Mumbai) — file storage and outgoing email such as invitations and password resets.
• Hostinger (Mumbai) — the servers the product runs on.
• Cloudflare — DNS, and protection for our administrative tools.
• Vercel — this marketing website only. It holds none of your business data.
• Mapbox — map tiles, when you open a map or a journey view.
• Sentry — error diagnostics.
• Razorpay — subscription billing. Card details go to them directly and are never stored by us.
• Google — only if your organisation enables the AI assistant on a Google model. See below.

The AI assistant

BO2 includes an optional assistant. Where your organisation runs it on a self-hosted model, the text of your question and the records needed to answer it stay on our infrastructure. Where your organisation chooses a Google model, that text and those records are sent to Google to generate the answer. That is a real difference and your administrator chooses which applies. The assistant is off unless it is switched on, and no business data is sent anywhere for it until then.

How long we keep it

Business records stay for as long as your organisation’s account is open, because they are its operating records. When an account is closed we delete its data within 90 days, except where we are required to keep something longer — invoices, for example, which Indian tax law requires us to retain. Diagnostics are kept for 90 days. Backups are deleted on their own schedule within 35 days.

What you can do

• Download any list you can see in the product as a spreadsheet, yourself, at any time.
• Ask us for a complete copy of an organisation’s data in a machine-readable form. We will provide it within 30 days.
• Ask for an account and its data to be deleted.
• Correct anything inaccurate.
• Ask us who we have shared something with, and why.
• Withdraw consent for anything you gave it for, such as push notifications.
• Complain to us, and — if we do not resolve it — to the Data Protection Board of India.

If your employer put the data there, we will usually pass your request to them, because they decide what happens to it. We will tell you when we do that.

Children

BO2 is a workplace product and is not intended for anyone under 18. We do not knowingly collect data about children.

Changes

If we change this policy in a way that affects you, we will tell account administrators before it takes effect, rather than quietly changing the date at the top.

Contact

Write to support@bo2forbusiness.com — for privacy questions, requests about your data, or to escalate a complaint — and a person will answer. We aim to respond within 30 days.