1. Purpose and Scope
This Written Information Security Program (“WISP” or “Program”) establishes administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of Confidential Information and Personal Information (“PI”) processed by Boomerangme in connection with its SaaS platform that provides business and loyalty analytics, automated messaging insights, and AI/LLM-powered assistance to SMB customers.
This Program applies to all Boomerangme employees, contractors, consultants, and subprocessors who have access to Boomerangme systems, customer data, or Personal Information.
This Program covers:
Boomerangme’s cloud-based SaaS platform
Data received from business customers (SMBs)
Guest Personal Information used for loyalty matching and analytics
Data used for training and improving Boomerangme’s LLM assistant
2. Definitions
Confidential Information – Any non-public information, including customer data, analytics, business records, and proprietary technology.
Personal Information (PI) – Any information that identifies or could reasonably identify an individual, including Guest PI received from partners or customers.
Customer Data – Data provided by SMB customers through the Boomerangme platform, including transaction, loyalty, and engagement data.
Guest PI – Personal information related to end customers/guests of Boomerangme’s SMB clients.
Authorized Personnel – Boomerangme employees or contractors approved to access systems and data based on role and necessity.
Security Incident – Any actual or suspected unauthorized access, disclosure, alteration, or destruction of data.
3. Security Governance and Responsibility
3.1 Security Leadership
Boomerangme designates a Security Lead (or equivalent role) responsible for:
Implementation and maintenance of this Program
Risk assessments and security controls
Compliance with applicable data protection laws
Coordination of incident response
Vendor security oversight
Annual review and updates to this Program
3.2 Roles and Responsibilities
Engineering Team: Secure design, development, and maintenance of the SaaS platform
Data/ML Team: Responsible use of data for analytics and LLM training in compliance with this Program
Operations Team: Access management and monitoring
All Employees: Compliance with security policies and prompt reporting of incidents
4. Data Use and Processing (SaaS-Specific)
Boomerangme processes data for the following purposes:
4.1 Customer and Guest Data Use
Boomerangme may use Guest PI and customer data solely for:
Matching guests to existing loyalty account holders
Improving and training Boomerangme’s LLM assistant and analytics models
Delivering contracted services to SMB customers
Generating aggregated, anonymized business insightsBoomerangme does not:
Sell Personal Information
Publicly disclose Guest PIUse Guest PI for unrelated marketing without customer authorization
4.2 Data Minimization
Boomerangme collects and retains only the data necessary to provide its services and improve its platform.
5. Risk Assessment and Management
Boomerangme conducts periodic risk assessments focused on:
Cloud infrastructure risks
Data access risksLLM/AI model risks
Third-party vendor risks
Potential misuse or exposure of Guest PI
Risk assessments are reviewed at least annually and after significant system changes.
6. Administrative Safeguards
6.1 Access Control (Least Privilege)
Access to data is restricted based on role and necessity, including:
Role-based access control (RBAC)
Unique user accounts
Multi-factor authentication
Regular access reviewsImmediate deprovisioning upon employee termination
6.2 Employee Training
Boomerangme provides periodic training on:
Data privacy and security
Phishing and social engineering
Secure handling of Personal Information
Incident reporting procedures
6.3 Vendor and Subprocessor Management
Boomerangme requires that any third-party vendors:
Maintain appropriate security safeguards
Sign confidentiality and data protection agreements
Undergo security review prior to engagement
7. Technical Safeguards (Cloud & SaaS)
7.1 Cloud Security
Boomerangme operates its infrastructure in secure cloud environments with:
Network segmentation
Firewalls and intrusion detection/prevention
Continuous monitoring for suspicious activity
7.2 Encryption
Sensitive data is encrypted:
In transit using TLSAt rest where feasible and appropriate
7.3 Secure Development Practices
Boomerangme follows secure software development principles, including:
Code reviews
Vulnerability scanning
Secure configuration management
Regular patching and updates
7.4 LLM and AI Data Controls
For data used in training or improving AI models:
Access is limited to authorized personnel
Data is handled in controlled environments
Use aligns with contractual and legal requirements
8. Data Retention and Deletion
Boomerangme retains Personal Information only as long as necessary to:
Fulfill contractual obligations
Provide services to customers
Meet legal or regulatory requirements
When data is no longer needed, it is securely deleted or anonymized.
9. Incident Response
In the event of a security incident, Boomerangme will:
Contain and mitigate the incident
Assess scope and impact
Notify affected parties as required by law or contract
Document findings and remediation stepsImplement improvements to prevent recurrence
10. Business Continuity
Boomerangme maintains reasonable measures to ensure service continuity, including:
Regular backups
Redundant cloud infrastructure
Recovery procedures in case of outages or breaches
11. Compliance
Boomerangme seeks to comply with applicable U.S. laws and industry expectations related to data protection, including:
State privacy laws where applicable
Contractual data protection obligations with partners and customers
12. Program Review
This WISP will be reviewed and updated:
At least annually
After significant security incidents
Following major changes in systems or operations
Approval
Approved by: Mike Inishev
Title: CEO
Date: 08/16/2025
