Privacy Policy

Last updated 2026-11-11

Jay Altman Inc. ("Two Comma Boss", "we", "us") operates Two Comma Boss AI at ai.twocommaboss.com, including member workspaces and the blogs we host for members at ai.twocommaboss.com/blog. This policy explains what we collect, why, who we share it with and the choices you have. We do not sell your personal information.

Information you give us

Account information: your name, email address and login details. Sign-in is handled by our database and authentication provider; we never see your password.

Workspace information: what you enter or create in your workspace, such as setup answers, business numbers and KPIs, goals, plans, notes, framework answers, content drafts, SEO settings and articles, and files you upload (for example call recordings or transcripts you choose to have reviewed).

Payment information: memberships are billed through Stripe. Card details go directly to Stripe; we never receive or store your card number.

Boss Partners (our referral program): if you apply or become a partner, your name, email, phone, website, what you tell us about your audience, how you would like to be paid (for example a PayPal email or Venmo handle) and, for US partners, the W-9 details you give us, including your taxpayer ID number. Taxpayer IDs are encrypted at rest, shown back only as the last four digits, and used only to file required tax forms (such as 1099s). If you join or buy through a partner's link, that partner sees a masked version of your email (like j•••@example.com), what you bought and when, so they can be paid.

Information about your contacts and leads

If you use email marketing, lead forms, booking or texting, you collect or upload information about your own contacts (such as names, email addresses, phone numbers and messages). We process it on your behalf, only to provide those features to you. You are responsible for having the right to contact these people. We record texting consent from lead forms and honor STOP and unsubscribe requests automatically.

Services you choose to connect

Some features work only when you connect another service. We access only what each feature needs. Access tokens and keys are encrypted at rest, and you can disconnect at any time:

Google Search Console (read-only): your list of Search Console properties and search performance data (search queries, pages, clicks, impressions, click-through rate and average position).

Gmail or Outlook (read-only), connected by each person for their own inbox in the CRM: we read the sender, recipients, date, subject and a short preview of new emails, and keep only those exchanged with people already in your CRM (subject, preview, direction and a link back to the email) on that person's timeline. We never store full email bodies or attachments, and we can never send, change or delete anything in your inbox.

Stripe (a restricted, read-only key you create): charges, customers and balance, used to calculate your revenue figures.

QuickBooks Online (read-only): profit-and-loss and balance-sheet reports, used to fill in your financial KPIs.

Social accounts (LinkedIn, Instagram, Facebook Pages, Threads, X, TikTok, YouTube, Pinterest, Google Business Profile and Bluesky), connected directly or, for some networks, through our publishing provider Ayrshare: to publish the posts you schedule or approve, and to show the connected account's name and picture. We do not read your messages, followers, contacts or other content on those networks.

WordPress sites or webhooks you add: to publish the articles your SEO agent writes.

Business texting (through Twilio): a phone number registered for your business, used to send and receive texts with your leads.

YouTube: uploads use YouTube API Services. By connecting YouTube you agree to the YouTube Terms of Service (https://www.youtube.com/t/terms), and the Google Privacy Policy (https://policies.google.com/privacy) applies. You can revoke our access at any time at https://security.google.com/settings/security/permissions.

Google user data

Two Comma Boss AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What we access: with your permission, (a) the read-only Search Console scope: the list of your Search Console properties and search performance data for the properties you connect; and (b) if you connect Gmail to the CRM, the read-only Gmail scope: the sender, recipients, date, subject and a short preview of your emails.

How we use it: only to provide features you can see and use. We show you your search performance, and your SEO agent uses it to choose article topics, improve titles and descriptions, and update articles on your own sites. From Gmail we keep only emails exchanged with people already in your CRM (the subject, a short preview, the direction and a link back), shown on that person's timeline and used, when you ask, in that person's AI summary. All other email is read only to check whether it involves someone in your CRM and is never stored. To provide these features, the relevant data is processed by our AI provider under terms that do not allow it to train its models on the data.

What we never do with it: we do not sell it, use it for advertising, or use it to train generalized AI models. People do not read it unless you ask us to (for example for support), it is needed for security or to comply with the law.

Your control: you can disconnect Search Console at any time in SEO Articles. When you do, we revoke our access with Google and delete the search data we stored. You can disconnect Gmail at any time in CRM → Inbox sync; we revoke our access with Google, and you can choose to delete every email it added to timelines. You can also remove access from your Google Account permissions page.

How we use AI

Two Comma Boss AI uses AI models to generate plans, drafts, articles, reviews, images and transcripts. To do so, the inputs needed for each task (for example your question, the relevant workspace information or a recording you upload) are sent to our AI providers: Anthropic for text, and OpenAI for images and audio transcription. They process this data to return results to us, under terms that do not allow them to train their models on it. AI output can be wrong; review anything important before you rely on it.

Who we share information with

We share information only with service providers that help us run the platform, and only as needed for their part: Supabase (database, authentication and server functions), Netlify (website hosting), Anthropic and OpenAI (AI processing), SendGrid (email delivery), Twilio (texting and video calls), Stripe (payments), Ayrshare (social publishing), Intuit (QuickBooks), Google (Search Console, YouTube and Business Profile), the social networks you connect (only to publish your posts: LinkedIn, Meta for Facebook, Instagram and Threads, X, TikTok, Pinterest and Bluesky) and Microsoft or Google services you use to sign in to email. We may also disclose information if the law requires it, to protect rights and safety, or as part of a business transfer, in which case this policy continues to apply.

Email and tracking

We send account and service emails (for example sign-in links, receipts, recaps and notices that an article was published). Marketing emails include an unsubscribe link. For emails sent through the platform, we may record deliveries, opens and clicks so you can see results. We do not use third-party advertising trackers in the app.

Calls and recordings

Coaching and video calls may be recorded when that is announced in the call. Recordings may be transcribed and summarized into a recap that is shared with participants. Call audio uploaded for review is deleted after it is transcribed.

Security

Data is encrypted in transit. Connected-service tokens and keys are encrypted at rest. Access to workspaces is limited to the member and the coaches they work with. No method of storage or transmission is perfectly secure, but we work to protect your information.

Retention and deletion

We keep your information while your account is active and as needed to provide the service. You can ask us to delete your account and workspace data at any time; we do so within 30 days, except for records we must keep by law (such as billing records).

Deleting your data

Connected accounts: disconnect any account in Integrations → Social accounts (or SEO Articles for Search Console). We delete its access tokens immediately and revoke our access where the network allows it. You can also remove Two Comma Boss AI from the network's own settings, for example Facebook or Instagram → Settings → Apps and websites.

Everything else: email jay@twocommaboss.com from your account email with the subject "Delete my data". We delete your account, workspace and connected-account data within 30 days and confirm by email, keeping only records the law requires (such as billing records).

Your choices and rights

You may request access to, correction of, export of or deletion of your personal information, and you can disconnect any connected service at any time. Depending on where you live (for example California or the European Economic Area) you may have additional rights; we honor them and will not discriminate against you for using them. We do not sell or share personal information for cross-context behavioral advertising.

Children

Two Comma Boss AI is for business owners and is not intended for anyone under 18.

Changes

If we change this policy, we will update the date above and, for material changes, notify members by email or in the app.

Contact

Questions or requests: email jay@twocommaboss.com.