Privacy Policy

ZoBoss ("we," "us," or "our") respects your privacy. This policy explains what information we collect, how we use it, who we share it with, and your rights regarding that information. This is a self-contained policy governing the ZoBoss application and website at zoboss.crystalboswell.com.

Who We Are (Data Controller)

Crystal Boswell DBA Zoboss, operating as ZoBoss, is the data controller responsible for your personal data under this policy. You can contact us at zoboss@crystalboswell.com with any privacy questions or requests.

Information We Collect

• Account information: email address and password (encrypted) when you sign up.
• Calendar data: with your permission, we access event data (titles, dates, times) from Google Calendar, Outlook Calendar, and/or Apple Calendar (via iCal feed) that you connect to your account.
• Todo list data: items you select or create, along with their completion status.
• Payment and billing data: when you subscribe, our payment processor Paddle collects and processes your payment details, billing address, and transaction history. We do not directly store your full payment card information.
• Usage data: basic technical information such as login timestamps and device/browser type, used for security and troubleshooting.

How We Use Your Information

• To generate and display your personalized todo list.
• To send you a nightly email summarizing your upcoming todo items.
• To process your subscription payment and manage billing (via Paddle).
• To maintain and secure your account.
• We do not sell your personal information or calendar data to third parties.

Legal Basis for Processing

We process your personal data under the following legal bases:

• Consent: for accessing and processing calendar event data when you connect a calendar.
• Contractual necessity: for account data, todo list data, and payment data, all necessary to provide the subscription service you signed up for.
• Legitimate interests: for limited usage data used for security, fraud prevention, and service improvement.

You may withdraw consent for calendar access at any time by disconnecting a calendar in your account settings.

Third-Party Services

We use trusted third-party providers to operate ZoBoss, including:

• Google Calendar API and Microsoft Outlook Calendar API (to sync calendar events, only with your explicit authorization)
• Supabase (account authentication and data storage)
• Resend (to deliver nightly email notifications)
• Paddle.com Market Limited — our payment processor and Merchant of Record. Paddle receives your payment and billing information to process subscription charges, handle sales tax/VAT, and manage invoicing. Paddle acts as an independent controller for this data under its own Privacy Policy.

Each provider processes data according to their own privacy policies.

Data Retention

We retain your account, calendar, and todo list data for as long as your account is active. Payment and billing records are retained by Paddle as required for tax, accounting, and legal purposes. You may disconnect a calendar or delete your account at any time, which will remove associated data from our systems (see our Delete Data page).

Your Rights

You may access, correct, or delete your personal data at any time by contacting us. You can also disconnect any connected calendar directly from your account settings. If GDPR, UK GDPR, or a similar law applies to you, you also have rights to data portability, restriction of processing, objection to processing, and the right to lodge a complaint with your local supervisory authority.

International Data Transfers

Your data may be processed and stored in the United States and other countries through our service providers (Supabase, Resend, Paddle, and applicable calendar providers). Where required, we rely on appropriate safeguards such as Standard Contractual Clauses for transfers outside the EEA or UK.

Security

We use industry-standard measures, including encryption and secure authentication, to protect your data. However, no method of transmission or storage is 100% secure.

Children's Privacy

ZoBoss is not intended for use by children under 13, and we do not knowingly collect data from children.

Changes to This Policy

We may update this policy from time to time. We'll notify users of material changes via email or an in-app notice.

Contact Us

If you have questions about this policy or your data, contact us at zoboss@crystalboswell.com.