Privacy Policy

Information we collect

• Account information. Your name, email address and profile photo from the sign-in provider you choose, your role, and the organization you belong to.
• What companies add. Organization details, team members, positioning material, bounties, and the target accounts and people a company wants to meet: names, job titles, LinkedIn profile links, email addresses and phone numbers.
• What BDRs add. Profile details, training and certification progress, claims, the prospects they work, and the outreach they log.
• Meetings. Booking times, video meeting links, whether a meeting was held, verified or disputed, and the evidence submitted in a dispute.
• Payments. Payments and payouts are handled by Stripe. We keep amounts and statuses, never card numbers. For BDRs we keep the status of their Stripe account and of their identity check, not the identity documents themselves.
• Calendars. When a company member connects a calendar. See the next section.
• People found with AI. When a company asks Claude to find people at an account: each person's name, job title, public professional context, and the public pages that mention them. Never an email address or phone number.
• Contact details looked up for you. When a company asks us to find how to reach a person it has named on a bounty, we send that person's name and employer to RocketReach and store what comes back: an email address, up to two phone numbers and a LinkedIn profile link. We only ever fill in details the company does not already have, and never replace what it entered itself.
• Technical information. Logs, IP addresses, browser details, and a record of the actions taken in the product, used to keep it secure and to settle disputes.

What anyone can see on our home page

The home page shows a live, anonymous picture of the market: how many bounties are open or in progress, the kinds of role they target (such as CEO or Finance), broad industries, and the tiers of BDR who can claim them. It never shows a company, a person, a job title as it was written, a payout, or anything that leads back to a particular bounty.

Google Calendar and other calendar connections

A company member can connect their Google Calendar so that meetings BDRs win for them are booked straight onto it. BountyBDR asks Google for two permissions:

• See when you're free (calendar.freebusy). We use your free and busy times to show BDRs your open 30-minute slots. This gives us times only, not the titles or details of your events.
• Create and manage events on calendars you own (calendar.events.owned). We create the meeting a BDR books on your calendar, invite the prospect, and add a Google Meet link. Afterwards we check that one event to see whether it was cancelled, declined, moved or held, which is how the meeting is verified and the BDR is paid.

We store the booked meeting's event ID, its times and its Meet link. We do not read, copy or store your other events. The access token for your Google account is held by our sign-in provider, Clerk, and is not stored by BountyBDR.

We do not sell Google user data, use it for advertising, or use it to train AI models, and no one at BountyBDR reads it except with your permission, to keep the service secure, or where the law requires.

BountyBDR's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect your calendar at any time from the Calendar page in BountyBDR, and remove BountyBDR's access in your Google Account's third-party access settings.

If you connect a Cal.com account instead, we store its access token encrypted, create a “BountyBDR intro” event type on your Cal.com account, and attach a webhook so bookings made through BountyBDR are reported back to us.

How we use information

• To run the marketplace: post and claim bounties, book and verify meetings, and pay BDRs.
• To send the emails the service depends on, such as a meeting that needs confirming.
• To suggest companies and people to target, when you ask. Your company's positioning and website, the companies you target, and the names and job titles of people already on an account's org chart (so they aren't suggested twice) are sent to Anthropic's Claude, which researches public web pages. Claude is never asked for anyone's email address or phone number, and we never store one from it.
• To prevent fraud and abuse, including checks that a meeting was genuine.
• To provide support, keep the service secure, and meet our legal obligations.

Who we share it with

• The other side of the marketplace, as the work requires. A BDR who claims a bounty sees the contact details the company added for it; a company sees the profile of the BDR who booked its meeting; the prospect receives the meeting invitation.
• Service providers who run parts of BountyBDR for us: Clerk (sign-in), Stripe (payments and identity checks), Neon (database), Netlify (hosting), Vercel Blob (dispute evidence files), Upstash (rate limiting), Resend (email), Google and Cal.com (scheduling), Brave Search (looking up public information about the companies you target), RocketReach (finding contact details for a person a company has named on a bounty), and Anthropic (Claude, which researches and suggests companies and people to target when you ask it to).
• For legal reasons, or as part of a merger or sale of the business, in which case this policy continues to apply.

We do not sell personal information.

How long we keep it

We keep information while your account is active and afterwards for as long as we need it to resolve disputes, meet accounting and legal obligations, and enforce our terms. The record we keep of actions in the product does not hold the contact details of the people you target.

Security

Data is encrypted in transit. Calendar tokens we store are encrypted at rest. Access inside BountyBDR is limited by role, and BDRs see a company member's calendar only as open time slots.

Your choices

You can ask to see, correct or delete your information by emailing us. You can disconnect a calendar at any time. BountyBDR is not meant for anyone under 18. Information is processed in the United States.

Changes and contact

If we change this policy we'll update this page and the date above. Questions: charles@kindling-ai.com.