Privacy notice
LEVER CONSULTANCY LTD, trading as hi boss · Version 2026-09-15.1 · 15 September 2026
Who is responsible
LEVER CONSULTANCY LTD, trading as hi boss, company 12434213, 6 Rose Joan Mews, London, England, NW6 1DQ, is the controller for account administration, security, usage and support data. Contact Daniel Lever at lever.daniel@gmail.com for privacy requests. For meeting content and connected context processed on a business customer’s instructions, that customer is normally the controller and we act as processor. Your meeting organiser can identify the relevant customer.
Data and sources
We receive sign-in identity, name, email, company, profile choices, acceptance records, invitations, subscription status, billing identifiers and usage records from you, your sign-in provider, administrator or payment provider. We do not store full payment-card details. If connected, Google supplies authorised calendar metadata and selected Drive content. Meeting participants provide speech, names and conversation content via the meeting provider. We process audio, transcripts, AI responses, summaries, actions and technical events. Uploaded documents and photographs may contain information about other people. Support submissions and reported meeting feedback are visible to the service owner.
Google data
When you connect Google, we read your Google email address to identify the connected account. Calendar connection requests read-only event access. We currently read the primary calendar to show meetings and support the calls you select; event data can include titles, dates, times, organisers, attendees, response status and meeting links. Connecting does not automatically send hi boss to every meeting. Individual-file connection requests access to the files you select in Google Picker. Folder sync separately requests read access to all Drive files because it needs to list and retrieve the contents of your chosen folder. The Google permission is broader than that folder selection. Previously granted permissions may remain included until you disconnect. hi boss stores imported file content and originals using its hosting services. Approved content is sent to OpenAI for indexing, retrieval and responses. Selected meeting links are sent to Recall.ai when the visible bot is dispatched. Relevant Context can inform spoken answers heard by everyone in the meeting. You control which imported sources are available to meetings and which are shared with your company. The connection screen explains the relevant access and sharing before you consent. We record the disclosure version, your selected connection type and the time you agree. These records document your choice; they do not replace Google’s permission screen.
Google data restrictions
hi boss follows the Google API Services User Data Policy, including Limited Use, when using or transferring information received from Google APIs. We also apply the Google Workspace developer policy. Google data and derived content are used only for the features you authorise. We do not sell this data, use it for advertising, creditworthiness or lending, or train general-purpose AI models with it. Transfers are limited to consented user-facing features, security needs, applicable law, or a business transfer with your explicit prior consent. Human access is limited as explained below.
Purposes and lawful bases
We use account and service data to deliver our contract with individual business subscribers and comply with legal obligations where applicable. For organisation representatives, security, service diagnostics and responding to enquiries we rely on legitimate interests in operating and protecting the service, taking account of your rights. We do not sell personal data or use meeting content for advertising. Customers determine and document the lawful basis for their meeting and context processing. We do not make solely automated decisions producing legal or similarly significant effects about individuals.
Who can access data
Your account scopes private content. Company administrators see team identities, membership and usage budgets; your explicit company-sharing choices can make context available to other approved company members. The service operator has technical administrative access, but this does not authorise routine reading of private Google content. Human access to Google data and derived content is limited to your documented permission for specific data, security investigations, legal requirements or permitted aggregated and anonymised internal analysis. Support permission is separate from connecting Google or accepting these terms. This is not an end-to-end encrypted service in which the operator cannot access data. Providers process data as described in our provider notice. Meeting participants hear AI responses, so choose sources appropriate for everyone present.
Audio and retention
hi boss does not retain meeting audio or video in its own storage. Recall.ai and OpenAI process live meeting audio. The Recall bot is configured for zero recording retention with low-latency transcription; this does not describe every provider’s operational logs or OpenAI processing. Transcript text, summaries and conversation diagnostics are available for 30 days. Physical deletion follows through our cleanup process, which currently depends on platform activity. Inactive periods or failed cleanup can mean records remain stored beyond that access window; the operator can also run cleanup. We do not promise physical deletion exactly at day 30. Imported Context, uploaded originals and OpenAI context indexes are separate from transcripts and remain until you remove the source or close your account. Saved actions, profiles, connection-consent records and usage records remain until deletion or account closure, subject to applicable legal retention. Provider logs, backups, financial records and legal holds can follow separate retention requirements. Contact us for help with deletion or current provider retention information.
Deletion and export
Use Settings to export account records or request account deletion, Context to remove sources, and transcript controls to remove retained conversations. Keep exports secure. Source and account deletion request applicable provider cleanup; failures are reported for retry rather than described as completed. You can contact us if a retry does not resolve the problem. Deleting a source does not retract its content from answers already heard or copied, so remove relevant retained conversations separately where needed. Account deletion does not delete Stripe transaction records that Stripe retains under its own obligations. We may retain minimum records required by law or to establish, exercise or defend legal claims, and will explain applicable restrictions.
Disconnecting Google
In Settings > Connections, disconnect Google to stop future Calendar and Drive access and pause synchronisation. Previously imported files become restricted but stay in Context until you delete them. Disconnection alone does not erase stored copies or OpenAI indexes and does not cancel scheduled or live hi boss meetings. Remove files in Context and cancel or leave meetings in Meetings. You can also revoke hi boss access through your Google account connections. Revoking Google permission stops future authorised API access; it does not itself delete copies already imported into hi boss.
International processing and security
Providers may process information outside the UK. We must use applicable adequacy decisions or contractual safeguards, such as the UK IDTA or UK Addendum where required, and assess transfers before introducing new processing. Contact us for available transfer information. Provider agreements and location settings require ongoing verification; we do not offer a UK-only data-residency guarantee. Application controls include authenticated workspaces, scoped queries, meeting tokens and encryption of Google credentials. Cloudflare documents automatic encryption at rest for the D1 database and R2 object storage used by hi boss. These are provider-managed keys, not customer-managed end-to-end encryption. No service is completely secure and we do not claim SOC 2 or ISO 27001 certification.
Training and providers
We do not use meeting content, connected context or Google Workspace data to develop, improve or train general-purpose AI or machine-learning models, and do not authorise our providers to use that data for those purposes. OpenAI states that API inputs and outputs are not used for training unless the API customer opts in. We do not authorise optional training-data sharing for customer content. This does not mean that all provider retention is zero: processing, safety logs and stored context indexes are subject to the relevant services and settings. See OpenAI data controls and our provider notice.
Your rights and complaints
Depending on the processing and applicable law, you can request access, correction, erasure, restriction, portability, object to legitimate-interest processing and withdraw consent where consent is used. Contact lever.daniel@gmail.com. We may reasonably verify identity and normally respond within one month; lawful extensions will be explained. For customer-controlled meeting content, contact the organiser or contact us so we can help route the request. You can complain to the Information Commissioner’s Office at ico.org.uk. You do not have to contact us before doing so.