Privacy Policy

Last updated: August 15, 2026

1. Introduction

ThePocketBoss (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website (collectively, the “Service”). This is the current PocketBoss privacy notice and controls if an older in-product summary conflicts with it.

2. Information We Collect

Personal Information

We collect personal information that you provide directly to us, such as:

• Name and contact information
• Business information
• Payment and billing information
• Account credentials

Usage Information

We automatically collect certain information when you use our Service, including:

• Device information
• Log data
• Location data (with your permission)
• Usage patterns and preferences

Authenticated App Session Replay

In the authenticated PocketBoss application, we use a first-party session replay system for troubleshooting, security review, product quality, and customer support. Replay may capture page content and routes, clicks, pointer movement, scrolling, browser and screen information, changes to page elements, console messages, and values entered into ordinary non-sensitive fields.

Password fields and fields identified by the application as payment-card or similarly sensitive are masked. Designated areas may also be masked or blocked. Because a business may enter personal information into an ordinary field, account owners should limit access to authorized personnel and avoid entering information that is not needed to use the Service. PocketBoss administrators use role-restricted tools to review replay data.

Cookies, Analytics, and Advertising Attribution

We use cookies and similar technologies to operate the Service, understand how people use it, measure advertising performance, and attribute trial registrations to the source that introduced a visitor to ThePocketBoss. These technologies may collect or receive information such as your IP address, browser and device type, operating system, language, approximate location, referring URL, pages viewed, interactions, and the date and time of a visit.

Our analytics and advertising attribution data may include Google Analytics client and session identifiers, campaign parameters (such as UTM parameters), landing-page information, and advertising click identifiers such as gclid, gbraid, or wbraid. When a Google advertising click identifier is present, we store it and related campaign information in a first-party attribution cookie for up to 90 days so the visit can be connected with a later registration across our website and app subdomains.

We use Google Analytics 4, including browser-based tags and Google's server-side Measurement Protocol, to measure site usage and successful trial registrations. When a registration succeeds, we may associate the saved attribution information with the new account and send Google a pseudonymous account identifier, Analytics client and session identifiers, and limited conversion details such as the registration method, selected plan, event time, and conversion value and currency. We do not include the registrant's name, email address, phone number, or business name in this server-side registration event.

SMS and Telecommunications Data

When you use our SMS messaging features, we collect and process:

• Phone numbers of message recipients (your customers)
• Message content and metadata (timestamps, delivery status)
• SMS consent records (opt-in/opt-out timestamps, consent source)
• Message logs and delivery reports
• Carrier information and routing data

Important: You are the data controller for your customers' phone numbers and message data. We act as a data processor, processing this information solely on your behalf and according to your instructions. You are responsible for obtaining proper consent from your customers and complying with all applicable telecommunications laws and regulations, including TCPA, CAN-SPAM, and GDPR where applicable.

AI Receptionist Call Data

If a business enables AI Receptionist, PocketBoss and its voice and telecommunications providers, including Retell and Twilio, process caller telephone numbers, routing and timing metadata, call status and duration, caller statements needed to complete intake, AI-generated summaries, structured service-request details, and provider usage and cost information.

We use this information to answer and route calls, create CRM and scheduling records, calculate prepaid usage, prevent fraud, provide support, and maintain an audit trail. AI Receptionist is configured not to record calls. Provider storage depends on the provider and agent configuration in effect for the call. PocketBoss requests limited Retell storage settings where supported, but does not promise a specific provider deletion period unless that period is expressly shown in the Service. PocketBoss may retain structured intake, summaries, billing records, and CRM records under the retention rules below.

3. How We Use Your Information

We use the information we collect to:

• Provide and maintain our Service
• Process transactions and send related information
• Send administrative information and updates
• Respond to your comments and questions
• Improve and personalize the Service
• Monitor and analyze usage patterns
• Detect and prevent fraud or abuse

4. Information Sharing and Disclosure

We do not sell personal information for money. We may disclose information as described below, and some privacy laws may define advertising-related disclosures as a sale, sharing, or targeted advertising even when no money changes hands. We may disclose information:

• With service providers who assist in operating our Service
• To comply with legal obligations or protect our rights
• In connection with a business transaction (merger, acquisition, etc.)
• With your consent or at your direction

SMS Service Providers

Our SMS messaging services are powered by Twilio and other telecommunications carriers. When you send SMS messages through our platform, message content and recipient phone numbers are transmitted to these third-party providers to facilitate message delivery. These providers have their own privacy policies and terms of service. We use only reputable, industry-standard providers that maintain appropriate security and privacy safeguards.

Message metadata (delivery status, timestamps, carrier information) may be retained by us and our telecommunications providers for troubleshooting, compliance, and service improvement purposes.

Analytics and Advertising Providers

We use Google Analytics and Google Ads to understand site activity, measure conversions, and evaluate the effectiveness of our advertising. Information collected by Google through our site or sent by us through Measurement Protocol is processed under Google's terms and privacy practices. You can learn more in Google's explanation of how Google uses information from sites and apps that use its services.

We also use the TikTok Pixel to measure visits and advertising performance. Google, TikTok, and other providers may use cookies or similar identifiers and may process information on servers outside your jurisdiction. We disclose limited usage and attribution data to them as service providers and advertising partners for the purposes described above. Depending on applicable law, this may be considered sharing or targeted advertising.

5. Data Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information, including:

• Encryption of data in transit and at rest
• Regular security assessments
• Access controls and authentication
• Employee training on data protection

No transmission or storage system is completely secure, and we cannot guarantee absolute security. Please use a unique password, protect account credentials, and notify us promptly of suspected misuse.

6. Your Rights and Choices

You have the right to:

• Access and update your personal information
• Correct inaccurate personal information
• Request deletion of your data
• Opt-out of marketing communications
• Opt out of sale, sharing, or targeted advertising where applicable
• Export your data
• Disable location services
• Appeal a denied privacy request where applicable

You can block or delete cookies using your browser settings. You can also use the Google Analytics opt-out browser add-on and manage advertising personalization through Google My Ad Center. Depending on where you live, you may also have rights to object to or restrict certain processing, withdraw consent where consent is the legal basis, or opt out of targeted advertising. Contact us to exercise a privacy right that is not available through these controls. We may need to verify your identity and authority before completing a request. We will not discriminate against you for exercising a privacy right protected by law.

7. Data Retention

We retain information only for as long as reasonably necessary for the purposes described here, including to provide the Service, maintain security and audit records, resolve disputes, enforce agreements, and meet legal, tax, accounting, and telecommunications obligations. Retention depends on the record type and the business customer's instructions.

• First-party session replay records are scheduled for deletion after 30 days.
• Advertising click-attribution cookies may remain for up to 90 days.
• Account, CRM, job, message, and structured AI intake records generally remain while the account is active and for a reasonable period afterward.
• Transaction, consent, acknowledgment, fraud-prevention, and security records may remain as required for legal and operational purposes.
• Provider-held data follows the provider configuration, contract, and legal requirements applicable to that provider.

An account-deletion request begins a verified deletion process. Some information may be retained, isolated, or anonymized where required or permitted by law, needed to complete an existing transaction, protect the Service, or preserve records that cannot yet be deleted.

8. Children's Privacy

Our Service is intended for business users and is not directed to anyone under 18 years of age. We do not knowingly collect personal information from children. If we learn we have collected such information, we will promptly delete it.

9. International Data Transfers

Your information may be transferred to and maintained on servers located outside of your jurisdiction. We ensure appropriate safeguards are in place for such transfers.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Last updated” date.

11. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us at: