Privacy Policy

This Privacy Policy explains how Lune Group Limited (trading as Boring Business OS) collects, uses, stores, and protects your personal information. It applies to our website at b-bos.com and our software platform (together, "the Service").

Lune Group Limited is a New Zealand company bound by the Privacy Act 2020 (NZ). By using the Service, you agree to the practices described in this policy.

Section 01

Who We Are

• Legal entity: Lune Group Limited
• Trading name: Boring Business OS
• Location: Dunedin, New Zealand
• Contact: hello@b-bos.com

Section 02

Information We Collect

Information you give us directly

• Your name and email address when you sign up to our mailing list or create an account
• Business information you enter into the platform — for example: revenue, pricing, client data, capacity, and goals
• Payment information when you purchase a product or subscription. Payment details are processed by Stripe and we do not store your card information
• Communications you send us via email or contact forms

Information collected automatically

• Usage data — pages visited, features used, time spent, and actions taken inside the platform
• Device and browser information — browser type, operating system, screen size
• IP address and approximate location (country/region level)
• Cookies and similar tracking technologies — see Section 07

Information from third parties

We may receive basic account information from tools you use to sign in, where applicable. We do not purchase data from data brokers.

Section 03

How We Use Your Information

• To provide and operate the Service — including running the platform, generating your Business Health Score, AI-powered observations, and next actions
• To send you emails you have opted into — including onboarding sequences, product updates, and newsletter content
• To process payments and manage your subscription
• To improve the platform — understanding how features are used helps us build a better product
• To provide customer support — responding to your questions and resolving issues
• To comply with legal obligations

Section 04

The Business Data You Enter

Boring Business OS is built around the business information you enter — revenue, clients, pricing, capacity, goals. This data is personal to you and your business. We treat it with strict confidentiality.

This data is used solely to:

• Generate your platform outputs — health scores, AI recommendations, and observations
• Improve the AI models that power the platform, in aggregated and anonymised form only

We will never share your individual business data with third parties, use it for advertising, or sell it in any form.

Section 05

Who We Share Your Information With

We use a small number of trusted third-party services to operate the platform:

• Stripe — payment processing. Stripe stores your payment details securely. We do not hold your card data. See stripe.com/privacy
• GoHighLevel (GHL) — our CRM and email platform. Your email address, name, and communication history are stored in GHL to send you emails you have opted into and to manage your customer account. See gohighlevel.com/privacy-policy
• Substack — if you subscribe to our Substack newsletter, your email address is stored and managed by Substack Inc. See substack.com/privacy
• Anthropic — the AI model that powers our AI features processes data you have entered into the platform to generate recommendations and observations. We do not send more data than is required to generate the relevant output. See anthropic.com/privacy
• Our hosting provider — the platform and your data are hosted on secure servers. We will name our hosting provider once confirmed

We require all third-party providers to handle your data securely and in accordance with applicable privacy law. We do not allow them to use your data for their own purposes.

We may also disclose your information if required to do so by law, court order, or regulatory authority.

Section 06

Data Storage and Security

Your data is stored on secure servers. We take reasonable technical and organisational steps to protect your information from unauthorised access, loss, or misuse.

No method of transmission over the internet or electronic storage is 100% secure. While we work hard to protect your data, we cannot guarantee absolute security.

We retain your data for as long as your account is active, or as long as is necessary to provide the Service. If you close your account, we will delete or anonymise your personal data within 30 days, unless we are required to retain it for legal reasons.

Section 07

Cookies

Our website uses cookies and similar technologies. Cookies are small files stored on your device that help us understand how the site is used.

We use cookies for:

• Analytics — understanding how visitors use the site, for example which pages are most visited
• Essential functionality — keeping you logged in and remembering your preferences

You can control cookies through your browser settings. Disabling cookies may affect how the site works. Where required by law, we will ask for your consent before placing non-essential cookies.

Section 08

Your Rights

Under the Privacy Act 2020 (NZ), you have the right to:

• Access the personal information we hold about you
• Request correction of any information that is inaccurate or out of date
• Request deletion of your personal information, subject to any legal obligations we have to retain it
• Withdraw consent to marketing emails at any time by clicking the unsubscribe link in any email we send
• Make a complaint to the Office of the Privacy Commissioner if you believe we have breached the Privacy Act

To exercise any of these rights, contact us at hello@b-bos.com. We will respond within 20 working days, as required by the Privacy Act 2020.

Section 09

Children

The Service is not directed at children under the age of 16. We do not knowingly collect personal information from anyone under 16. If you believe we have received information from a person under 16, please contact us and we will delete it promptly.

Section 10

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the date at the top of this document. If changes are significant, we will notify you by email.

Your continued use of the Service after changes are posted means you accept the updated policy.

Section 11

Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please get in touch.

If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner (New Zealand) at privacy.org.nz.