Your secret stays your secret.

Arbolo AI Inc. operates Boses.ai and is the Personal Information Controller ("PIC") for the personal data described in this Policy, in accordance with Republic Act No. 10173 (the Data Privacy Act of 2012, the "DPA"), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission ("NPC").

From Senders (account holders):

• Account data: email address, authentication identifiers, and basic profile data obtained through social or magic-link sign-in;
• Content data: the Recipient details you provide, the clues and options you select, and the Calls you generate;
• Usage data: how you interact with the Service, plus device and log information;
• Payment data, once paid features launch: processed by our third-party payment processor; we do not store full card numbers.

From Recipients:

• The name and phone number provided by the Sender;
• If you choose to engage (hear your Call, view clues, share, or request clues): usage data, and, if you sign up, account data;
• Voice audio: we generate and may store the synthesized artificial-intelligence voice audio of the Call. We do not record, capture, or store the Recipient’s own voice or any live two-way conversation.

We process personal data to:

• Deliver Calls and operate, maintain, and improve the Service;
• Protect users, prevent and investigate abuse, and enforce our Terms;
• Comply with our legal obligations; and
• For Senders who have given consent, develop and offer new features and send other communications (see Section 5).

• Sender account data: retained while the account is active and for a reasonable period after closure.
• Recipient data where the Recipient does not sign up: retained only for as long as necessary to operate the Call feature and to honor opt-outs and suppression, and then deleted.
• Data retained for the investigation of abuse, or to comply with a legal obligation: retained only for as long as legally necessary.

If you create an account, you may give your separate, informed consent for us to:

• Send you other communications, which may include greetings, reminders, service messages, and promotional or campaign content, delivered by voice call, SMS, or in-app message; and
• Process your personal data to develop, test, and offer new features and use cases of the Service.

This consent is optional and is sought separately from your acceptance of the core Service. You may withdraw any such consent at any time, through your account settings or by contacting us, without affecting your ability to use the core Service.

We do not sell personal data. We may share personal data with: our service providers (including telephony, cloud hosting, voice generation, and payment processing) under written agreements that require them to protect it; law enforcement, the NPC, or other authorities where required by law or in response to a verified report of abuse or harm; and a successor entity in the event of a merger, acquisition, or reorganization. We do not disclose a Sender’s identity to a Recipient except as described in the Terms.

Under the DPA you have the rights to be informed, to access, to object, to erasure or blocking, to rectification, to data portability, to damages, and to lodge a complaint with the National Privacy Commission. Recipients may opt out and request deletion of their number at any time. To exercise any right, contact our Data Protection Officer at [DPO email].

We maintain reasonable and appropriate organizational, physical, and technical security measures to protect personal data, consistent with NPC Circular No. 2023-06 on the minimum requirements for the security of personal data. In the event of a personal data breach that may give rise to a real risk of serious harm, we will notify the NPC and the affected data subjects within seventy-two (72) hours of knowledge of the breach, as required by law.

The Service is intended for users aged eighteen (18) and over, and Calls may only be sent to Recipients aged eighteen (18) and over. We do not knowingly process the personal data of minors. If we learn that a Recipient is a minor, we will delete their data and permanently block the number from receiving Calls.

We provide a mechanism for any person to report abuse or harassment through the Service. Where we are notified of content or conduct that may constitute gender-based online sexual harassment or other abuse, we will act on the report, which may include removing content, suspending the responsible account, and cooperating with the PNP Anti-Cybercrime Group.

We may update this Policy from time to time. We will notify you of material changes through the Service.

Data Protection Officer: [name], [dedicated DPO email (must be separate from personal/work email per NPC rules)], [address].