Privacy, data, and your rights.

1. Who we are (data controller)

Bossblog (“we”, “us”) operates the website ai-bossblog.com. The data controller is an independent publisher, governed by the laws of the Hong Kong Special Administrative Region.

For any privacy request or question, contact HereIsBossBlog@outlook.com.

2. Data we collect

Usage & analytics data: page views, clicks, referring pages, and selected product interactions; technical data such as browser/device type and an approximate location derived from the country of your IP address. We do not store full IP addresses for analytics beyond what is needed for security and abuse prevention.

Information you provide: when you join an email list we collect your email address and the browser-local device identifier the subscription is keyed to. There is no sponsor or advertising inquiry form; both were removed in September 2026.

Cookies & local storage: preferences and a device identifier used to power markets features (watchlists, alerts, email subscriptions) without an account. No advertising cookies are set, because no advertising is served.

3. Legal bases for processing (GDPR)

Legitimate interests: operating, securing, and improving the publication and its analytics.

Consent: email-list subscription (you may withdraw consent at any time by unsubscribing).

Performance of a contract / pre-contract steps: responding to enquiries you send us directly.

4. How we use data

To operate and improve the site and its content, to respond to enquiries you send us, to deliver email you subscribed to, and to protect the site against abuse. We do not use it to serve or measure advertising.

5. Third parties and processors

We share limited data with service providers that process it on our behalf: Resend (email delivery), Supabase (data storage), and Vercel (hosting and CDN, plus Vercel Web Analytics, which receives page views and a handful of product events as cookieless aggregates without a cross-site identifier). Each operates under its own privacy policy. The first-party events described above are a separate stream, recorded by this site in its own database.

We do not sell or share your personal information, and we use no advertising network.

6. Cookies and your choices

Two categories only: essential (site function and preferences) and analytics (aggregate usage measurement). There is no advertising category, because no ads are served.

You can clear or block both through your browser settings. Clearing site data resets the device identifier, which ends any email subscription keyed to it.

7. Data retention

Analytics events currently have no automatic expiry: nothing deletes them on a schedule, so they are held until we remove them by hand. We would rather say that than name a retention period we do not enforce. Email subscriptions are kept until you unsubscribe. Emails you send us are kept until the matter is closed.

Those analytics events carry no account or device identifier — only the truncated IP prefix, browser type and coarse location described in section 2 — so the rows belonging to any one reader cannot be singled out, and there is no per-reader deletion for them. Email addresses, and the subscriptions keyed to them, are identifiable: section 8 covers deleting those.

8. Your rights

If you are in the EEA/UK (GDPR): you have the right to access, rectify, erase, restrict, or port your personal data, to object to processing, and to withdraw consent. You may also lodge a complaint with your supervisory authority.

If you are a California resident (CCPA/CPRA): you have the right to know what we collect, to delete it, to correct it, and to opt out of any “sale” or “sharing” of personal information. We neither sell nor share personal information.

To exercise any right, email HereIsBossBlog@outlook.com. We will verify your request and respond within the time required by applicable law.

9. International transfers

Our processors may store or process data outside your country, including in the United States. Where required, transfers rely on the safeguards each processor publishes for its own service, such as Standard Contractual Clauses.

10. Children

The site is not directed to children under 16 (or the age of digital consent in your jurisdiction), and we do not knowingly collect their personal data.

11. Changes to this policy

We may update this policy; material changes will be posted here with a new effective date. Last updated: 2026-09-04.