Privacy Policy

1. Who we are and what this policy covers

BoringOps and Boring Cash are operated by PT. Sinar Baru Inovasi ("BoringOps," "we," "us," or "our"). This policy applies to the BoringOps platform, Boring Cash, their public websites, portals, registration flows, messaging workflows, and integrations.

2. Information we collect

• Account and workspace information: name, email address, Google or Firebase user identifier, workspace or company name, role, language, currency, and account preferences.
• Connected-service information: OAuth tokens, granted scopes, connection status, account identifiers, spreadsheet and file identifiers, sheet names, URLs, and token-expiry metadata.
• Workflow content: messages, receipts, documents, images, audio, voice-note transcripts, extracted fields, transaction drafts, jobs, approvals, comments, and synchronization results.
• Messaging information: Telegram, WhatsApp, Twilio, email, or other channel identifiers and the content and metadata needed to process a user-requested workflow.
• Operational and security data: browser and device information, API and webhook metadata, usage counts, audit events, error details, and security logs.
• Support and commercial information: communications with us, pilot details, plan information, and payment or billing references when applicable.

3. Google user data

Our products may use Google Sign-In and Google Workspace APIs, including Google Drive and Google Sheets, to provide features that a user explicitly connects or requests.

What we access

Depending on the feature and permissions shown on Google's consent screen, we may receive basic Google account information, granted OAuth tokens and scopes, Google Drive file metadata, spreadsheet identifiers, workbook structure, and spreadsheet values needed for the connected workflow.

How we use it

• Identify and authenticate the connected account.
• Create, open, read, update, and check files or spreadsheets used by the user-facing workflow.
• Write user-approved records, maintain workbook structure, provide summaries, answer user-requested questions, and report connection health.
• Refresh or revoke OAuth tokens and troubleshoot a connection at the user's request.

How use differs by product

Boring Cash uses Google access to create and maintain the user's Boring Cash workbook, write approved cash records, and read connected workbook data for user-facing summaries and reports. BoringOps uses Google access only for the Google-backed operational solutions or workflows that the workspace has configured.

Limited Use

BoringOps’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• We do not sell Google user data or transfer it to data brokers.
• We do not use Google user data for advertising, retargeting, lending, or creditworthiness decisions.
• We do not use Google user data to create, train, or improve general-purpose AI or machine-learning models.
• We do not allow humans to read Google user data except with the user's explicit permission for support, when necessary for security, when required by law, or when the data is aggregated and anonymized for permitted internal operations.

4. How we use information

• Provide, maintain, secure, and improve the user-facing features you request.
• Authenticate users, enforce workspace permissions, and maintain audit trails.
• Convert submitted content into structured drafts and records, request confirmation, and synchronize approved results.
• Provide support, diagnose failures, prevent abuse, and communicate service or security notices.
• Administer plans, usage limits, billing, and contractual obligations.
• Comply with applicable law and protect users, BoringOps, and the public.

5. AI-assisted processing

Some workflows use AI, OCR, or transcription providers to interpret user-submitted messages, receipts, documents, and audio. We send only the information reasonably needed to perform the requested feature. AI-generated results may be incorrect, so products may ask the user to review or confirm important records before they are saved or synchronized.

6. When we share information

We may share information with infrastructure, database, hosting, communications, analytics, AI-processing, and integration providers only as needed to operate or secure the service. We may also share information with a connected system at the user's direction, to comply with law, to investigate abuse or security incidents, or as part of a corporate transaction subject to appropriate notice and safeguards.

We do not sell personal information. Service providers are required to handle information consistently with their contractual, confidentiality, security, and legal obligations.

7. Storage, security, and retention

We use access controls, encrypted transport, credential encryption, audit logging, and other reasonable administrative and technical safeguards. No system is completely secure, and we cannot guarantee absolute security.

We retain information for as long as needed to provide the service, maintain security and audit records, satisfy contractual or legal obligations, resolve disputes, and enforce agreements. Retention periods vary by data type, workspace configuration, and legal requirement. Backups and security logs may remain for a limited period after deletion.

8. Your choices and deletion requests

• You can revoke Google access from your Google Account permissions page or disconnect the integration in the applicable product.
• You can stop submitting messages or content and can remove files or spreadsheets that you own, subject to your organization's controls.
• You may request access, correction, export, or deletion of eligible personal information by emailing hello@boringops.ai.
• Workspace administrators may control or retain workspace records according to their organization's policies and legal obligations.

9. International processing and children

Our service providers may process information in countries other than the user's country. We use appropriate contractual and organizational safeguards where required. The services are intended for adults and authorized business users and are not directed to children under 13.

10. Changes and contact

We may update this policy as our products, providers, or legal obligations change. We will update the effective date and provide additional notice when appropriate.

For privacy, data, or security questions, contact hello@boringops.ai.