You might want to install a firewall app on your phone. It will allow you to block specific apps and background services from any online accessibility, both via WiFi and mobile data (cellular). It's a good way to selectively control what data is coming in or going out so even if you weren't going through this possible spyware problem it's very handy to have. And that could be an issue itself, determining what could be the actual spyware service running on your phone. Not all spyware will be using an obvious name, and many are hard to detect and troublesome to remove. If there's something suspicious you can post it here of course and maybe one of us will be able to make suggestions, but you can also just do an online search to see if that app is or isn't a common exploit.
Just some suggestions on a good firewall app:
NoRoot Data Firewall:
https://play.google.com/store/apps/details?id=com.jianjia.firewall&hl=en
NetGuard (an Open Source app with active development and support but some have complained this one is a little heavy on ads)
https://play.google.com/store/apps/details?id=eu.faircode.netguard
Mobiwol
https://play.google.com/store/apps/details?id=com.netspark.firewall
NoRoot Firewall (this gets a lot of recommendations elsewhere but do note that it has not been updated in almost three years)
https://play.google.com/store/apps/details?id=app.greyshirts.firewall
If your boyfriend never had physical possession of your phone without you being present, the odds are he wouldn't have been able to install and configure something devious. If he did have your phone on his own however, then it can be really hard to say one way or the other (especially depending on his tech skill level). Whatever the case, you should reset the passwords to all your online social media accounts (email, Facebook, Instagram, etc), that would be the most likely remote point of entry into your phone.
Regarding your request for spyware to put on your boyfriend's phone, I'll just defer to what
@lunatic59 posted earlier. It's a slippery slope to install any kind of secret wiretapping app without the user's permission.
