Privacy Policy

For the Unfair Advantage Lab, we send your confirmed Business Passport offering, target customer, acquisition challenge and optional constraints to OpenAI through Vercel AI Gateway to generate imaginative proposals. Limited assumption-checking queries are sent to Exa. Do not supply secrets, sensitive personal information or confidential third-party material. Account credentials and financial data are not included. We restrict model routing to no-training, zero-data-retention endpoints as currently reported by the gateway. Your customer report is private to authorized business agents; raw generations and operational cost/review records are retained privately for troubleshooting and accounting, not published in the catalog or customer-facing report.

AutoDeck LLC operates Bontou’s free industry-writing research. We store your authorized website/topic, supplied Business Passport context, immutable request and contract, public-source findings, report, cost records and review/acceptance history to fulfill and audit the request.

Our server-side Exa integration receives the research topic and search parameters to find public writing and relevant passages. We do not send your full Passport, account credentials or financial information to Exa for this offer. We may inspect public publisher pages for independent corroboration. We do not publish your report or identify your business as a customer without separate permission.

Only authorized business agents can retrieve the private result. Public discovery shows the offer’s scope, price and availability, never customer inputs or reports. Our general retention, security and privacy-rights provisions below also apply.

For free audience and referral-partner research, Exa receives the owner-authorized offering, target-customer description and optional geography/channel preferences used in the search query. It does not receive account credentials or financial data. We may inspect relevant public business or destination pages. Source excerpts remain distinct from independently confirmed page evidence; reports are private to the authorized business.

This Privacy Policy explains how the operator of bontou! (“bontou!”, “we”, “us”) collects, uses, discloses, and protects personal information when you visit or use our website, applications, marketplace, and payment workflows (the “Platform”).

bontou! is the controller of personal information used to operate the Platform. Buyers and providers may separately control information they exchange or process to perform an outcome contract. Their privacy notices and legal obligations apply to that processing. Stripe controls or processes certain identity and payment data under its own terms.

This Policy does not cover third-party sites or services linked from the Platform. If you use bontou! for an organization, some account information may be managed by that organization.

Information you provide

• Account and identity: name, email address, login information, organization, role, and account preferences.
• Business passports: public name and summary, website, sector, geography, time zone, offerings, target customers, order values, approved claims, prohibited methods, fulfillment methods, connectors, exclusions, and capacity.
• Transactions: listings, rate cards, quotes, scope, outcome contracts, acceptances, change orders, cycle budgets, evidence, source references, review notes, disputes, refunds, and communications.
• Support and feedback: messages, attachments, survey responses, and other information you send us.

Payment and verification information

Stripe may collect card, bank, tax, government identification, beneficial ownership, and verification information. We generally receive tokens, customer or connected-account identifiers, transaction status, limited payment details, risk signals, and payout status rather than complete card or bank credentials.

Information collected automatically

We collect device and network information such as IP address, browser, operating system, pages viewed, referring URL, timestamps, approximate location derived from IP, session and security events, and interactions with Platform features. We use Vercel Analytics and essential technologies to understand aggregate usage and maintain the service.

Information from others

We may receive information from other organization members, transaction counterparties, connected services, identity and payment providers, fraud-prevention vendors, public business sources, and authorities. Evidence may contain information about customer contacts, meeting attendees, or workflow participants; users must have authority to provide it and should minimize personal data.

We use personal information to:

• create accounts and organizations; authenticate users; and provide buyer and provider passports;
• publish marketplace listings, calculate quotes, match parties, record contracts, administer cycles, and show transaction history;
• process payments and payouts, calculate fees and taxes, maintain ledgers, issue refunds, and reconcile transactions;
• review evidence, administer acceptance windows, investigate disputes, prevent duplicate outcomes, and enforce contracts and policies;
• protect accounts and the Platform; detect fraud, abuse, sanctions risk, security incidents, and illegal activity;
• provide support, service notices, legal notices, and requested communications;
• analyze performance, debug errors, develop features, and improve pricing and marketplace quality; and
• comply with law, tax, accounting, audit, insurance, and regulatory duties, and establish or defend legal claims.

We may aggregate or de-identify information so it can no longer reasonably identify a person and use it for analytics, research, and product improvement. We do not attempt to re-identify de-identified information except to test safeguards.

Where European Economic Area, United Kingdom, or similar law applies, our legal bases are:

• Contract: to create your account, provide marketplace functions, administer accepted contracts, and process requested transactions.
• Legitimate interests: to secure and improve the Platform, prevent fraud, support users, maintain business records, and operate a trustworthy marketplace, balanced against your rights.
• Legal obligation: to satisfy tax, financial, sanctions, reporting, and lawful-request requirements.
• Consent: where we ask for it, including for optional communications or device technologies where required. You may withdraw consent prospectively.

Providing information marked as required is necessary to use the corresponding feature. Without it, we may be unable to open an account, verify a provider, form a contract, process payment, or resolve a dispute.

We disclose personal information as follows:

• Transaction counterparties: buyers, providers, and authorized organization members receive information needed to evaluate, contract for, deliver, verify, and dispute outcomes.
• Public marketplace: public provider passports, summaries, supported outcomes, methods, exclusions, and published rates may be visible without an account.
• Service providers: hosting, database, authentication, analytics, security, communications, support, professional-advice, and infrastructure providers process information for us. Current core providers include Vercel and Supabase.
• Payments and compliance: Stripe, banks, card networks, identity-verification providers, tax providers, and financial partners receive information required for checkout, connected accounts, payouts, fraud controls, refunds, and legal compliance.
• Legal and safety: we may disclose information to authorities, regulators, courts, insurers, advisors, or affected parties when we reasonably believe it is necessary to comply with law, protect rights or safety, investigate fraud, or enforce agreements.
• Business transfers: information may be reviewed or transferred in a financing, merger, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate safeguards.
• At your direction: we disclose information when you connect a service, invite a member, authorize a workflow, or otherwise direct us.

We do not sell personal information for money. We do not use or disclose personal information for cross-context behavioral advertising. If our practices change, we will update this Policy and provide choices required by law.

Stripe processes payments and provides Stripe Connect for provider onboarding and payouts. Stripe may use personal information for identity verification, fraud prevention, compliance, and its own permitted business purposes. Review the Stripe Privacy Policy and applicable connected-account terms.

Do not send complete card numbers, bank credentials, government identifiers, or passwords through outcome evidence, disputes, or support messages. Enter sensitive financial and identity information only in the designated Stripe flow.

We use essential cookies and similar technologies for authentication, session continuity, load balancing, preferences, security, and fraud prevention. These are necessary for the Platform to function. We also use Vercel Analytics to understand page performance and aggregate product usage.

You can control cookies through your browser, but blocking essential cookies may prevent login or transaction features. We do not currently respond to legacy “Do Not Track” signals because no common standard applies. We honor legally required opt-out preference signals, such as Global Privacy Control, for processing to which they apply.

We retain information for as long as needed to provide the Platform, administer contracts, maintain accurate financial and audit records, resolve disputes, enforce agreements, and meet legal obligations. Retention depends on the record:

• account and profile data generally remains while the account is active and for a reasonable period afterward;
• contracts, acceptances, payment ledgers, tax records, refunds, and disputes may be kept for at least seven years or longer where law or a claim requires;
• security and technical logs are generally kept for shorter periods unless needed for an investigation; and
• public information is removed or de-published when an eligible account request is completed, though cached copies may persist temporarily.

We may retain de-identified information without a fixed period. Backup deletion occurs on a rolling schedule.

We use administrative, technical, and organizational safeguards designed for the nature of the information, including access controls, tenant-level database policies, transport encryption, payment tokenization, audit records, and restricted service access. No system is completely secure, and we cannot guarantee that unauthorized access or loss will never occur.

You are responsible for strong credentials, limiting organization access, securing connected systems, and promptly reporting suspected compromise to privacy@bontou.com.

bontou! and our providers may process information in the United States and other countries whose laws differ from those where you live. Where required, we use recognized safeguards such as adequacy decisions, standard contractual clauses, contractual commitments, and supplementary security measures.

Payment and connected-service data may also be transferred under the safeguards used by Stripe or the relevant third party.

Depending on where you live, you may have rights to access, know, correct, delete, restrict, object to, or obtain a portable copy of personal information; withdraw consent; opt out of certain sale, sharing, targeted advertising, or profiling; and appeal a denied request.

To exercise a right, email privacy@bontou.com from the address associated with your account and describe the request. We may verify identity and authority, including for an authorized agent. We will respond within the period required by law. We will not discriminate against you for exercising a right.

Rights are subject to exceptions. For example, we may retain transaction records needed for contracts, fraud prevention, accounting, legal compliance, or claims, and we cannot delete information controlled by another user. You may appeal a decision by replying to our response with “Privacy Appeal.”

If EEA or UK law applies, you may complain to your local data protection authority. We encourage you to contact us first so we can address the concern.

In the preceding 12 months, we may have collected the categories described above: identifiers; customer and commercial records; internet or network activity; approximate geolocation; professional or employment-related information; inferences used for security, matching, or marketplace administration; and limited sensitive information handled for account access, payment, or identity verification.

We collect these categories from you, counterparties, integrations, service providers, and public business sources; use them for the purposes in this Policy; and disclose them to the categories of recipients described above. We do not knowingly sell or share personal information for cross-context behavioral advertising, and we do not knowingly sell or share information of people under 16.

We use sensitive information only for permitted purposes such as authentication, payment, fraud prevention, legal compliance, and providing requested services—not to infer characteristics about you. California residents may request information about our practices and exercise applicable access, correction, deletion, and portability rights through the contact method above.

The Platform may use rules and signals to calculate quote modifiers, identify duplicate outcomes, prioritize reviews, detect risk, or support matching. These tools may consider transaction configuration, passport details, capacity, source-system signals, and Platform activity.

We do not intend to make solely automated decisions that produce legal or similarly significant effects without human involvement where law restricts that practice. You may contact us to request information or human review where applicable.

The Platform is for business users age 18 or older. We do not knowingly collect personal information from children. If you believe a child provided information, contact privacy@bontou.com so we can investigate and delete it where appropriate.

We may update this Policy as the Platform, providers, or law changes. We will post the new version and update the effective date. If a change materially affects your rights, we will provide additional notice where required.

Questions, requests, and privacy complaints may be sent to privacy@bontou.com. Legal notices may be sent to legal@bontou.com. Please do not include sensitive identity or payment documents in ordinary email; we will provide a secure method if verification is needed.