Privacy Policy — Bossefixar

Last updated: June 3, 2026

1. Who we are

Bossefixar ("Bossefixar", "we", "us") is a digital service for small businesses, operated by Vaam AB, a company registered in Sweden (org. nr 559266-8833), with its registered address at Box 6038, 102 31 Stockholm.

For any privacy-related questions or requests, contact us at privacy@bossefixar.se.

We are the data controller for the personal data described in this policy, except where we act as a data processor on behalf of our business customers (see Section 8).

2. Scope

This policy explains what information we collect when you use Bossefixar to manage and grow your online presence — your website, your Google presence, and, where you choose to connect them, your social media accounts — how we use it, who we share it with, and the rights you have over it.

Some features rely on third-party platforms that you connect yourself. Where a platform imposes its own data requirements, the platform-specific details are set out in Section 11 (Connected platforms).

3. Information we collect

Information you provide directly

  • Account and contact details (name, email address, company name, billing information).
  • Content you create, upload, schedule, or approve (text, images, videos).

Information we collect automatically

  • Usage and device data (e.g. log data, IP address, browser type) needed to operate and secure the service.

Information from accounts and services you connect

When you connect a third-party account or service (for example your Google profile or a social media account), you authorize us to access certain data from that account in order to provide the relevant features. Depending on the platform and the permissions you grant, this may include:

  • Account and profile details for the connected service.
  • Access tokens that allow us to publish and read content on your behalf.
  • Content and media on the connected account.
  • Performance and engagement metrics (e.g. reach, impressions, interactions).

We only request the minimum permissions needed to provide the service, and we access this data solely to operate the features you have signed up for. Platform-specific details are described in Section 11.

4. How we use your information

We use the information above to:

  • Provide the features you have signed up for, including publishing and scheduling content to the accounts and channels you connect.
  • Show you how your content and online presence are performing.
  • Provide, maintain, secure, and improve the Bossefixar service.
  • Communicate with you about your account and provide support.
  • Comply with our legal obligations.

We do not sell your personal data, and we do not use the data we obtain from connected platforms for advertising or any purpose other than providing the Bossefixar service to you.

5. Legal basis for processing (GDPR)

We process your personal data on the following legal bases:

  • Performance of a contract — to deliver the service you have signed up for.
  • Legitimate interests — to secure, maintain, and improve the service.
  • Consent — where you connect third-party accounts and grant specific permissions; you may withdraw this consent at any time (see Sections 8 and 9).
  • Legal obligation — where we are required to retain certain records.

6. How we share information

We share data only as needed to run the service:

  • Platforms you connect — when you connect a third-party platform, we exchange data with that platform's APIs to provide the features you use (for example, publishing your approved content). See Section 11.
  • Service providers (sub-processors) — hosting, infrastructure, and business providers that process data on our behalf under contract. Our current sub-processors are listed below.
  • Legal and safety — where required by law or to protect our rights, users, or the public.

We do not share your data with third parties for their own marketing purposes.

Our sub-processors

We engage the following sub-processors to provide the service:

  • Cloudflare — content delivery, DNS, and edge hosting for our website and application. Does not store personal customer data. (EU)
  • Hetzner Online GmbH — application hosting and infrastructure (limited personal data). (Germany, EU)
  • Visma Spiris AB — customer records, billing, and accounting. (Sweden, EU)
  • OpenAI — AI-assisted features, such as content generation, where enabled. (United States)
  • Anthropic — AI-assisted features, such as content generation, where enabled. (United States)
  • Berget AI — AI-assisted features, such as content generation, where enabled. (Sweden, EU)

Some sub-processors are located outside the EU/EEA (for example, in the United States). Where we transfer personal data outside the EU/EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. We may update this list as our providers change; material changes will be reflected here.

7. Data retention

We retain your personal data only for as long as your account is active or as needed to provide the service, and thereafter only as required to meet legal, accounting, or reporting obligations. When you disconnect an account or close your account, we delete or anonymize the associated data as described in Section 8, subject to those obligations.

8. How to delete your data

You can have the data we hold about you deleted in any of the following ways:

  1. Disconnect within Bossefixar — remove a connected account in your account settings. This revokes our access and we will delete the data associated with that connection.
  2. Revoke access from the platform — you can also remove Bossefixar's access directly from the connected platform. Platform-specific steps are described in Section 11.
  3. Email a deletion request — write to privacy@bossefixar.se with the subject "Data deletion request." We will verify your identity and delete your personal data within 30 days, except where we are legally required to retain certain records.

If you would like written confirmation that your data has been deleted, contact us at the email above.

9. Your rights (GDPR)

If you are in the EU/EEA, you have the right to access, correct, delete, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent at any time. To exercise any of these, contact privacy@bossefixar.se. You also have the right to lodge a complaint with the Swedish data protection authority (Integritetsskyddsmyndigheten, IMY).

10. Security

We use appropriate technical and organizational measures to protect your data, including encryption in transit, restricted access, and secure storage of access tokens. No method of transmission or storage is completely secure, but we work to protect your information and review our practices regularly.

11. Connected platforms

Some Bossefixar features rely on third-party platforms that you choose to connect. This section describes how we handle data for those platforms. It applies only if you connect the platform in question — if you do not, none of the processing below takes place.

11.1 Meta (Facebook and Instagram)

If you connect a Facebook Page and/or an Instagram Business or Creator account, you authorize us — through Facebook Login — to access certain data from those accounts. Depending on the permissions you grant, this may include:

  • Your Facebook Page details (Page ID, name, and the list of Pages you manage).
  • Your connected Instagram Business/Creator account details.
  • Access tokens that allow us to publish and read content on your behalf.
  • Posts, comments, and media on the connected accounts.
  • Performance and engagement metrics (e.g. reach, impressions, likes, comments).

We use this data solely to publish and schedule the content you create and approve, and to show you how it is performing.

Removing access and deleting Meta data. In addition to the options in Section 8, you can revoke our access from Facebook directly: go to your Facebook Settings → Settings & Privacy → Settings → Business Integrations (or Apps and Websites), select Bossefixar, and remove it. When you remove the app, Meta notifies us and we delete the personal data we obtained through your connected accounts.

Compliance with Meta Platform Terms. Our use of information received from Meta's APIs complies with Meta's Platform Terms and Developer Policies, including limitations on how Platform Data may be used and the requirement to delete it upon request or when no longer needed.

12. Children

Bossefixar is a business service and is not directed at children under 16. We do not knowingly collect personal data from children.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version here and revise the "Last updated" date above. Material changes will be communicated to account holders.

14. Contact

Vaam AB
Box 6038, 102 31 Stockholm
Email: privacy@bossefixar.se