Who we are
BossLead is owned and operated by Agensi Pekerjaan Talent Focus Sdn Bhd, which decides how personal data in the service is used (the data user under the Personal Data Protection Act 2010).
Email: kaisheng@talentfocus.com.my
Address: 80-1F , LORONG MERBAU JAYA 1, TAMAN SERI MERBAU SUNGAI DUA, 13800 Butterworth, Pulau Pinang
Privacy Policy
Effective date: 5 October 2026. This policy explains how BossLead (“we”, “us”) handles personal information through bosslead.my and its prospecting, recruitment and messaging tools. Privacy contact: kaisheng@talentfocus.com.my.
Information we collect
We collect account and workspace details, names, business contact information, saved searches, prospect lists, campaign content, preferences, and information you submit to our talent pool or upload. This may include candidate profiles, employment history and documents. We also process device and browser information, IP addresses, cookies, activity records and service logs for authentication, usage limits, security and troubleshooting. Billing records may include subscription status, transaction references and invoice details; card payments are handled by Stripe.
How we use information
We use information to operate accounts and workspaces, search and organise company or candidate information, provide requested introductions, deliver user-directed campaigns, display replies, stop follow-ups when recipients respond, handle subscriptions, support users, prevent abuse and meet legal obligations. Employers are responsible for having an appropriate basis to upload personal data or contact recipients and for respecting opt-outs.
Connected Google and Microsoft mailboxes
Connecting a mailbox is optional and requires your permission. We process your account identity, email address and access tokens. The requested permissions allow sending messages you direct and reading mailbox messages and related metadata to collect replies in your workspace and stop follow-ups. Message information may include sender, recipients, subject, body, timestamps and attachments. Campaigns configured to use your own mailbox are sent through your selected email provider. We do not ask for your Google or Microsoft account password through OAuth. You can disconnect the mailbox in BossLead and revoke access in your provider’s account settings. Disconnecting stops future access but does not automatically erase messages already stored.
Google API Limited Use
BossLead’s use and transfer of information obtained through Google APIs must comply with the Google API Services User Data Policy, including its Limited Use requirements. Google user data is used only for the mailbox features described here. It must not be sold, used for advertising or credit decisions, or used to train general-purpose AI models. Human access is limited to your explicit permission, security investigations, legal requirements, or permitted internal operations involving aggregated and anonymised information.
WhatsApp and Meta connections
When you connect WhatsApp through Meta, we process the account and phone-number identifiers, business profile details, permission tokens, messages, media, delivery statuses and quality notifications needed for the connected messaging features. Meta delivers webhook events to BossLead. Your connected business account controls its messages and recipients. Recorded opt-in is required by our configured campaign settings. You may disconnect the integration or remove BossLead from Meta’s business integrations. Provider rules may require approved templates or restrict when messages can be sent.
AI and service providers
AI features can process search prompts, campaign drafting inputs and other information you submit to the selected feature. Our currently selected text provider is Anthropic. Avoid submitting unnecessary sensitive information. Information may be shared with hosting and infrastructure providers, connected Google/Microsoft/Meta services, Stripe, email delivery providers such as Brevo, and enabled data or AI providers to deliver the relevant service. These providers may process information outside your country under their applicable terms. We may also disclose information when required by law, to address abuse or protect rights, or as part of a business transfer subject to appropriate protections.
Workspace sharing and public information
Workspace members may see information according to their roles and the features you use. Prospecting may process publicly available business information and information supplied by enabled data sources. Public availability does not remove a person’s privacy rights. Candidate information submitted to the talent pool may be shown or shared through the candidate-search and introduction features in accordance with the choices made at submission.
Cookies and security
Cookies and similar technologies support login, preferences, session protection and usage limits. Blocking them may affect functionality. We use access controls and encrypted storage for integration secrets. No system can guarantee complete security. Keep your account credentials private and review workspace access and connected applications regularly.
Retention
We retain information while needed to provide the service, maintain account records, investigate abuse, resolve disputes or meet legal duties. The current inbox configuration keeps stored messages and attachments until they are deleted or a retention rule is applied; it does not provide automatic age-based deletion. Disconnecting an integration alone does not delete existing stored data. Backup or legally required records may remain for a limited period after deletion.
Your choices and data deletion
You may update account details, unsubscribe from optional emails, disconnect integrations and request access, correction, export or deletion of your personal information. To request deletion of BossLead data received through Facebook or WhatsApp, email kaisheng@talentfocus.com.my with the subject “BossLead data deletion” and identify your BossLead account and connected business/phone number. Do not send passwords or access tokens. We may verify your identity and clarify the scope before acting. We will confirm the request’s outcome and explain any information retained for legal, security or billing reasons. Deleting BossLead records does not delete messages or records independently held by Google, Microsoft, Meta, recipients or other providers; contact them separately.
Children and changes
BossLead is intended for adults and business use, not for children under 18. Contact us if a child’s information has been submitted. We may update this policy as our services or practices change, and will update the effective date and provide additional notice when appropriate. Contact kaisheng@talentfocus.com.my for questions or privacy requests.
Google user data
When you connect a Gmail or Google Workspace mailbox with "Sign in with Google", BossLead asks Google for permission to:
- Send email on your behalf (gmail.send): to send the outreach emails and follow-ups you write or approve in BossLead, from your own address.
- Read your email (gmail.readonly): to find replies, bounces and out-of-office answers to the emails BossLead sent, so follow-ups stop when someone answers and replies appear in your BossLead inbox and pipeline.
- Your email address (openid, email): to know which mailbox you connected.
We only read messages to find answers to emails sent through BossLead, and we store only what is needed for that: the sender, subject, date, the text of those replies, their message identifiers, and the contact details written in the reply's signature (such as name, job title, company and phone), which are saved to your own contact book. Other email in your mailbox is not stored.
We do not sell Google user data, use it for advertising, use it to build or train general artificial-intelligence or machine-learning models, or let people read it, except with your permission for support, for security reasons, to comply with the law, or when the data is aggregated and anonymised.
BossLead’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Everything read from your mailbox is used only to provide these features to you, and only your account can see it. It is never added to the business-contact data other BossLead customers search, never shared with other customers, and never used for any other purpose.
Access tokens are stored encrypted. You can disconnect the mailbox in BossLead at any time, and remove our access in your Google Account under Security, Third-party apps with account access. When you disconnect, we delete the tokens straight away and the stored replies when you delete the mailbox or your account.
Questions about Google user data: kai-sheng@hotmail.com.