Privacy Policy
Last updated 17 August 2026 · Black Tee Labs Pty Ltd (ABN 41 680 736 127), Australia
1.What we collect
In short What you give us when you sign up, what you add about the people you know, and basic technical data needed to run the app. We do not collect sensitive information.
Account information. Your name and email address are required to create an account. You can optionally add a phone number, organisation, job title, location, photo and the other fields that make up your digital business card. If you sign in with Google, Apple or LinkedIn, we receive your name, email address and profile picture from that provider and nothing else.
What you put in. Contacts you add one at a time, notes you write or dictate, actions, objectives, touchpoint plans, opportunities and referrals. This is your content and it is the substance of the product.
Device permissions you grant. Contacts (to save a bondai contact into your phone, and to keep that one in step; bondai does not read your address book), camera (to scan a QR code or take a photo), microphone (to record a voice note), and notifications. Each is asked for at the point of use and each can be withdrawn in your device settings at any time. Declining a permission disables that feature and nothing else.
Connected accounts, if you connect them. If you connect Outlook, we read the emails you have exchanged with a contact, and your calendar, to work out when you last spoke and to prepare you for meetings. This includes the body of those messages, not just who and when: because that is where the useful part is: how you greet each other, how you sign off, how formal you are, how quickly you reply.
What we take from an email is its shape, not its subject matter. The message is analysed on our servers, we keep the greeting form, the sign-off form, a formality band, a typical length and the timing, and the message itself is discarded. We do not store copies of your emails, and the content of your correspondence is not sent to our AI providers and is not used to suggest what to say. bondai will learn that you and someone write to each other briefly and casually and that they usually reply within a day; it will not read what the two of you discussed and turn it into a prompt to reply.
We look only at correspondence involving the contact in question, bounded to roughly the most recent 500 messages and the last 180 days. We do not read your wider mailbox.
Connecting a mailbox is off unless you turn it on, and you can disconnect it at any time from the app or from your Microsoft account. Disconnecting stops any further access immediately.
Documents you upload. If you record a referral or introduction agreement, any document you attach is stored in private storage, is not publicly accessible, and is available only to you. Those documents often concern third parties, so the same care applies as to anything else you record about someone else.
Technical and usage data. Device type, operating system version, app version, IP address, and logs of errors and feature usage, used to keep the service running and to find bugs.
Payment data. If you subscribe through the App Store or Google Play, that purchase is handled entirely by Apple or Google and we receive only the fact of the subscription and its status. If you subscribe on the web, payment is handled by Stripe. We never see or store your card details.
What we do not collect. We do not collect sensitive information as defined by the Australian Privacy Act or the GDPR: health, biometric, genetic, racial or ethnic origin, political opinions, religious beliefs, trade union membership or sexual orientation. We do not sell personal information, and we do not share it for advertising.
2.Information about other people
In short Your contacts have not signed up, and we take that seriously. Their details are visible only to you, and anyone can ask us to remove theirs.
bondai is a tool for remembering people, so most of what it holds is information about people other than you: their names, contact details, where you met, what you talked about, what you promised them. You are responsible for what you record, and you should only record what is reasonable for a professional relationship and lawful where you are.
A contact's information is visible only to you, with the one exception described below. It is not pooled, not published, and not used to build a profile of that person for anyone else. On Enterprise plans an organisation can see that a relationship exists between one of its members and a company, in aggregate, for planning purposes; contact-level notes and details are never exposed to an organisation, an administrator, or to us for that purpose.
The exception: people you both know. If one of your contacts is themselves a bondai user, bondai can show each of you which contacts you have in common. It works by comparing email addresses and LinkedIn handles, never phone numbers, and it only ever returns records you already hold yourself. A name you do not already have is never shown to you, and a name they do not already have is never shown to them, so neither of you can use it to browse the other's contacts. What it does reveal is the overlap itself: that a particular person appears in both books.
There is currently no way to switch this off. An opt-out is built but not yet released. If you would rather be excluded in the meantime, email privacy@bondai.app and we will exclude your account manually.
If you are not a bondai user and someone has recorded you, you can ask us what we hold and ask us to delete it. Email privacy@bondai.app. We will act on it, and we will not need you to create an account first.
If a contact is themselves a bondai user, the details on their own digital business card may appear on your copy of their contact. They maintain that card and can change or withdraw it at any time.
3.How we use it
In short To run the product you are paying for, and to keep it working. Nothing else.
- To create and maintain your account and authenticate you.
- To store and organise your contacts, notes, actions and plans.
- To prepare you for a meeting and suggest what to talk about.
- To draft messages in your own writing style, for you to edit and send yourself.
- To transcribe voice notes and turn commitments into actions and reminders.
- To tell you when something changes for someone you care about, such as a job move.
- To share your digital business card when you choose to share it.
- To take payment, and to manage trials, renewals and cancellations.
- To fix faults, prevent abuse, and meet our legal obligations.
4.Legal bases
In short In Australia we operate under the Privacy Act. If you are in the EU, the UK or Canada, the equivalent bases are set out here.
Black Tee Labs Pty Ltd is an Australian company and handles personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
If you are in the EU or UK, we rely on: contract, to provide the service you signed up for; consent, for device permissions and connected accounts, which you may withdraw at any time; legitimate interests, to secure the service, prevent abuse and improve the product, weighed against your rights; and legal obligation, where the law requires it.
If you are in Canada, we rely on your express or implied consent, and on the limited exceptions permitted by PIPEDA.
Our servers are in the United States, so using bondai involves transferring your information there. Where required, we use appropriate safeguards such as standard contractual clauses with our providers.
5.How AI is used
In short Two AI providers process your content to generate suggestions and transcribe voice notes. Neither trains on your data. You can opt out.
bondai's suggestions, drafted messages and summaries are produced by third-party AI models. To do that, relevant content, the contact's details, your notes about them, and what you have asked for, is sent to the model provider over an encrypted connection and the result is returned to you. We send the minimum needed for the feature to work.
We use two providers, for different jobs:
- Anthropic: chat and AI text generation, including suggested topics and drafted messages.
- OpenAI: voice note transcription and search embeddings.
Neither provider trains its models on your data. With Anthropic this is contractual; with OpenAI it is the default for API use. Both bound retention at 30 days for abuse monitoring, after which the data is deleted.
AI output is a suggestion, not a fact. It can be wrong, out of date, or subtly off about a person. Nothing is sent anywhere on the strength of it, you read it, edit it, and decide. Do not rely on it for decisions that matter without checking.
If you would rather your content was not processed by AI at all, email privacy@bondai.app and we will turn those features off for your account.
7.We never send messages for you
In short bondai drafts the message and opens your app. You press send.
bondai does not connect to your messaging accounts to transmit anything on your behalf, and it has no ability to do so. When you choose a channel, WhatsApp, LinkedIn, Instagram, Messenger, SMS or email, the draft is copied and that app is opened. What is sent, and whether anything is sent at all, is entirely your decision and happens in that app under your own account.
Social profiles: what we no longer collect, and what we still hold. bondai does not read your LinkedIn or Instagram accounts, or your contacts', and does not import posts, profiles or activity from them. That collection stopped in August 2026 and the capability has been removed from the product. Bringing contacts across in bulk went at the same time: there is no longer a way to import your phone's address book, a spreadsheet, or a CRM's contact list into bondai.
We have not deleted what was collected before then. Posts previously gathered from public LinkedIn and Instagram profiles remain stored against the relevant contacts, and bondai still draws on them when it suggests topics or drafts a message. So the collection has stopped; the use of what was already collected has not. If you would rather we removed the social data held about you, or about one of your contacts, email privacy@bondai.app, you do not need an account, and we will not ask you to create one.
8.How long we keep it
In short While your account is open. Delete it and we remove your personal information from our active systems.
We keep your information while your account exists. You can delete your account at any time from inside the app, or at bondai.app/delete-account. Deletion removes your personal information from our active databases, retaining only what we are legally required to keep, such as transaction records for tax purposes.
Encrypted backups persist for a short period after deletion by design. They are not used to restore deleted accounts and they age out on their normal cycle.
Social posts collected before August 2026 are kept indefinitely unless you ask us to remove them. They sit against the contact they belong to, so deleting that contact deletes them, and deleting your account removes them with everything else.
If your subscription lapses you are not locked out. You move to the Free plan. Your card and your contacts stay, and your notes, actions and opportunities are retained but no longer displayed. You can export everything at any time, on any plan, including Free.
9.How we protect it
In short Encryption in transit and at rest, single named production access with MFA, tested backups, and an ISO 27001 program underway. We are not certified yet and we will not say we are.
- All traffic is encrypted in transit with TLS.
- Data is encrypted at rest, MongoDB Atlas AES-256, and server-side encryption on file storage.
- Production access is limited to named individual accounts with multi-factor authentication. There is no feature that lets staff browse a user's contacts or notes.
- Secrets are held in a managed secrets store, never in code.
- Databases are backed up daily, and restores are rehearsed.
- Infrastructure activity is logged.
An honest note on what encryption does and does not mean here. bondai is a server-side AI product: the model has to be able to read your notes for the features to work, so we do not offer end-to-end or zero-knowledge encryption and we will not claim to. As with any operator of a hosted service, we have technical access to stored content. What limits it is policy, least privilege and audit, not mathematics.
An ISO/IEC 27001 certification program is underway, with certification targeted for the first half of 2027. We are not currently certified against ISO 27001 or SOC 2. No system is completely secure, and we cannot guarantee absolute security.
If you believe you have found a security issue, please email security@bondai.app. We will not pursue anyone who reports a genuine vulnerability in good faith.
10.Your rights
In short Access, correct, export or delete, most of it yourself, from inside the app, without asking us.
Wherever you are, you can:
- Access and correct what we hold, directly in the app.
- Export everything you have added, as a spreadsheet, at any time and on any plan including Free.
- Delete your account and your data, from inside the app or at bondai.app/delete-account.
- Withdraw permissions: contacts, camera, microphone, notifications, in device settings.
- Disconnect a connected Outlook account at any time.
- Opt out of AI processing by emailing us.
- Complain, if you think we have handled your information badly.
If you are in the EU or UK you also have rights to restrict or object to processing, to data portability, and to lodge a complaint with your supervisory authority. If you are in California or another US state with a privacy statute, you have rights of access, deletion, correction and portability, and the right not to be discriminated against for exercising them, and note that we do not sell personal information or share it for cross-context behavioural advertising.
To exercise anything that is not self-service, email privacy@bondai.app. We will respond within 30 days. If you are in Australia and you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner.
11.Children
In short bondai is not for under-16s.
bondai is a professional tool and is not directed at children. We do not knowingly collect information from anyone under 16. If you believe a child has given us information, email us and we will delete it.
12.Changes to this policy
In short We will date any change, and tell you about material ones.
We may update this policy as the product changes. The date at the top always reflects the current version. If a change materially affects how we handle your information, we will tell you in the app or by email before it takes effect.
13.Contact us
In short A real person reads these.
Black Tee Labs Pty Ltd (ABN 41 680 736 127), Australia.
Privacy: privacy@bondai.app
Everything else: info@bondai.app