Boomi US

Privacy Statement Overview

Company and scope. This statement applies to Boomi, LP’s websites and services, including Boomi and Rivery websites. It describes Boomi’s role as a data controller for information it collects directly. It generally does not apply to Business Partners or unrelated third-party websites.

1. Data Collection and Use

Information you provide

Boomi may collect:

• Name, job title, company, email, postal address and telephone number
• Login ID and password
• Billing and credit-card information for purchases
• Information submitted through account registration, orders, trials, support requests, downloads, events, webinars, surveys, testimonials, newsletters and marketing programs
• Information from interactions on social-media platforms

Forms should indicate whether requested information is mandatory or voluntary.

Information collected automatically

Boomi collects usage and technical information, including:

• IP address, device identifier and location data
• Browser, language, operating system and access times
• Referring and exit URLs
• Pages viewed, searches, clicks, advertisements viewed and other activity
• Service configuration, feature usage, performance data and system logs

Boomi may combine information from different sources and identify users across multiple devices. It may also supplement information using Business Partners, public databases, social-media platforms and joint-marketing partners.

Purposes

Uses include:

• Providing, operating, monitoring and supporting services
• Managing accounts and transactions
• Personalizing websites and communications
• Analytics, fraud prevention, product improvement and development
• Targeted advertising and marketing
• Legal, regulatory and security purposes

Cookies, pixels, web beacons and tracking links may monitor browsing and email activity. Rejecting cookies may impair login or other website functions.

Important distinction: Data that Boomi processes through a customer’s account—such as that customer’s end-user data—is processed on the customer’s instructions under the customer contract, not this statement. The customer, such as an employer, generally controls access, settings and data-rights requests.

2. User Rights

For EU, UK and Swiss data, users may have rights to:

• Access and obtain a copy of their data
• Correct inaccurate or incomplete information
• Object to processing based on legitimate interests
• Request deletion
• Restrict processing
• Receive or transfer data in a portable format
• Avoid solely automated decisions producing legal or similarly significant effects
• Complain to a data-protection regulator

These rights are subject to legal exceptions and verification requirements. California residents may also have rights to know, access, portability, deletion and freedom from discrimination. Boomi states it does not “sell” personal information as currently defined under California law.

Marketing can generally be stopped using unsubscribe links or cookie-management tools. Transactional and account-service communications may continue. Changes may take up to 10 business days.

3. Third-Party Sharing

Boomi may share information with:

• Corporate affiliates
• Business Partners, subcontractors and service providers supporting transactions, analytics, communications and service delivery
• Co-branded service partners
• Government or law-enforcement authorities when legally required or necessary to protect rights, security or the public
• A purchaser or successor in a merger, acquisition or asset sale
• Other parties with user consent

Boomi says it will not disclose personal information to third parties for their own marketing unless consent is provided. It may share aggregated or de-identified information for any purpose.

Third-party advertising, social-media features and linked websites have their own privacy policies and may track users independently.

4. AI/ML Training

The statement gives a specific protection for Google OAuth and Google Workspace API data: that data will not be used to develop, improve or train AI/ML models, and will not be transferred to third-party AI tools.

However, it does not clearly state a general prohibition on using all other Boomi service data or personal information for AI/ML training. It expressly permits analytics and product improvement, so users should seek clarification if AI training is a concern.

5. Key User Responsibilities and Risks

Users should:

• Keep passwords confidential and beware of phishing
• Avoid posting personal information in public blogs or forums
• Review third-party privacy terms for linked, social-media or co-branded services
• Understand that disabling cookies may reduce functionality
• Direct rights requests concerning data held in a customer account to that customer/controller first

Boomi does not knowingly collect children’s data and asks children to obtain parental involvement.

6. Liability and Disputes

The statement contains limited detail about damages, warranties or liability caps; those issues may be governed by the separate service agreement.

For EU/UK/Swiss Data Privacy Framework complaints, users should first contact Boomi, then USCIB’s free dispute-resolution process. If unresolved, binding arbitration before the Data Privacy Framework Panel may be available. Boomi is subject to U.S. Federal Trade Commission enforcement and states it remains responsible under the DPF for certain agent failures.

7. Changes

For material changes, Boomi says it will provide email notice or a prominent website notice before effectiveness. Changes otherwise become effective when posted, and users are encouraged to review the statement periodically.Last revision: November 19, 2025.

Boomi Enterprise Platform Service Description: Key User Terms

> Important scope limitation: This document is a service description, not a complete Terms of Service or privacy policy. The separate Master Services Agreement (MSA), Order Form, SLA, and possibly Boomi’s online terms govern many important issues—especially liability, termination, dispute resolution, data-subject rights, and security details.

1. Data Collection and Usage

• The Service processes Customer data supplied through integrations, including data transferred between databases, applications, APIs, files, and trading partners.
• If Boomi hosts the Runtime in its public cloud or the customer uses ViewData, Customer data is transferred to and processed in the United States.
• ViewData allows users to view integration data through a web browser, which may increase exposure of sensitive information to platform users.
• Boomi states it will:
• Protect confidential data under the confidentiality provisions of the MSA.
• Apply appropriate technical and organizational security measures against loss, destruction, alteration, unauthorized disclosure, or unauthorized access.
• Require relevant subcontractors and business partners to adopt equivalent security measures.
• The document does not specify:
• Precisely what personal information Boomi collects about account users or administrators.
• How long data, logs, backups, or support records are retained.
• Whether Boomi uses cookies, analytics, telemetry, or usage monitoring.
• Detailed deletion, return, breach-notification, or data-localization procedures.

2. User and Customer Data Rights

No specific individual data rights are stated in this document. It does not address rights such as access, correction, deletion, portability, objection, or restriction of processing.

Those rights may be addressed in the MSA, a data-processing agreement, or Boomi’s privacy documentation. Customers should confirm:

• Who is the data controller and who is the processor.
• Whether Boomi will assist with regulatory requests.
• How data is exported and deleted when the subscription ends.
• Whether international-transfer mechanisms satisfy applicable privacy laws.

3. Third-Party Sharing

• Boomi may provide Customer data to subcontractors and business partners involved in delivering the Service.
• Those parties are supposed to use equivalent security measures, but the document does not identify them, describe their locations, or explain whether Boomi remains fully responsible for their conduct.
• Data may also be accessible to Boomi personnel providing hosting, support, consulting, or troubleshooting.
• The document does not expressly authorize advertising, sale of data, or unrelated commercial sharing.

4. AI/ML Training

• There is no statement that Customer data is used to train artificial-intelligence or machine-learning models.
• There is also no express prohibition on such use.
• Customers handling confidential, regulated, or proprietary information should obtain written confirmation from Boomi—preferably in the MSA or data-processing agreement—that Customer data, prompts, outputs, logs, and support materials will not be used for AI/ML training without authorization.

5. Key Customer Obligations and Costs

• Pay annual fees upfront according to the Order Form. Consulting services may be billed separately.
• Public-cloud Runtime usage includes only 1 GB per Runtime per month. Each additional gigabyte, or fraction of a gigabyte, costs $117 per month.
• A reconnection fee may apply after account suspension.
• Customers must manage integration processes, connectors, credentials, permissions, and data lawfully and securely.
• Customers agree to reasonably support Boomi’s reference activities after implementation, including press releases, case studies, reference calls, and speaking engagements. This obligation should be clarified if publicity or confidentiality is a concern.
• Connection availability and features may change, and Boomi may notify customers of added or deleted connections.

6. Liability and Disputes

• This document does not contain liability caps, warranties, indemnities, termination rights, governing law, arbitration, court jurisdiction, or dispute procedures.
• Those terms are governed by the separate MSA or, if none applies, Boomi’s terms of sale.
• The SLA is incorporated by reference and provides support response targets, but the document does not state service credits or other remedies for downtime.
• Customers should review the MSA for exclusions of consequential damages, data-loss liability, security-breach responsibility, and limitations on recovery.

7. Changes and Notice

• Boomi may amend the SLA. The amended SLA generally applies prospectively; if the customer objects in writing within 30 days, it applies at the next renewal rather than immediately.
• New features are automatically subject to this Service Description.
• Specifications, availability, and connections may change without notice.
• The document does not explain how customers receive notices, so users should monitor contractual and online communications.