← Back to login

Privacy Policy

Data controller

ordosphere LLC (operator of HelloBoss), see Impressum. For construction-site/company data stored on HelloBoss, the customer's company (construction company) remains the data controller under data protection law in each case; HelloBoss processes this data as a processor (Art. 28 GDPR). Details are governed by the data processing agreement.

Which data we process

Login data (email, password hash), construction-site and company data of the customer company, incoming WhatsApp/Telegram messages (text, voice messages, photos) from installers for construction-site documentation.

Services used (processors)

Transfer of data to third countries

Certain processing steps (speech recognition by OpenAI, AI text analysis by Anthropic or models routed via OpenRouter) take place with providers headquartered in, or using server infrastructure in, the USA. This constitutes a transfer of data to a third country within the meaning of Art. 44 et seq. GDPR. The transfer takes place on the basis of the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) with the respective providers or — where available — on the basis of certification under the EU-U.S. Data Privacy Framework.

Legal basis

Performance of contract (Art. 6(1)(b) GDPR) under the agreement between HelloBoss and the customer company; supplemented by a data processing agreement (DPA, Art. 28 GDPR) between HelloBoss and the customer company.

AI-assisted processing

Incoming voice messages and photos are automatically evaluated via speech recognition, translation and classification in order to assign them to the correct construction site and task. This AI evaluation is strictly limited to construction-site documentation — it does not serve the evaluation, scoring or performance monitoring of individual installers. Speech recognition is carried out by OpenAI, and content classification by Anthropic or language models routed via OpenRouter. Photos are currently not transmitted to an image-analysis model, but are processed only as attachment metadata.

Retention period

Data is stored for the duration of the contractual relationship with the customer company and deleted or anonymized after termination within the framework of statutory retention periods (including under the German Commercial Code, HGB).

Data subject rights

Access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). Please direct requests to your own construction company (as controller) or to datenschutz@helloboss.dev. Details on the process and the response deadline can be found under Data Subject Rights.

Response deadlines

Requests regarding access, rectification, erasure, restriction of processing or data portability are answered within one month of receipt (Art. 12(3) GDPR). For complex requests, this period may be extended by a further two months; in that case, we will inform you within the first period of the reasons for the delay.

AI labelling

AI output is labelled as such in the interface. Which steps the AI performs, which providers are involved, what the AI explicitly does not do and how the labelling looks is set out on the transparency page how the AI works (Article 50 of Regulation (EU) 2024/1689). There is no solely automated decision with legal effect within the meaning of Art. 22 GDPR.

Right to lodge a complaint

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) — as a rule the authority of the Member State of your habitual residence, place of work or the place of the alleged infringement. Lodging a complaint is free of charge and does not require contacting us first.

Security incidents and vulnerabilities

Where an incident leads to a personal data breach, we notify the competent supervisory authority within 72 hours of becoming aware of it (Art. 33 GDPR) and inform the affected customer company without undue delay so that it can meet its own obligations. To report a vulnerability: report a security vulnerability.

Data protection contact

Email: datenschutz@helloboss.dev

German version: /datenschutz. In case of discrepancies, the German version prevails.