Privacy Policy

1. Who we are

Bounty AI is a product of Kavodel INVT, a Delaware company registered in the United States (651 N. Broad St., Suite 201, Middletown, DE 19709). In this policy, “Kavodel INVT”, “Bounty”, “we”, “us” and “our” mean Kavodel INVT.

This policy explains how we collect and use personal data when you visit bountyai.online, request a demo or a pilot, book a meeting, request investor materials, contact us, or use the Bounty platform. It is written to meet the EU and UK General Data Protection Regulation (GDPR) and applicable US privacy laws.

Questions or requests: legal@bountyai.online.

2. Our two roles: controller and processor

• Controller. For our website, demo requests, sales conversations, investor requests and customer account administration, Kavodel INVT decides why and how personal data is used, and is the controller.
• Processor. When an operator uses Bounty on its own data (for example player, payment and gaming data), the operator is the controller and we act only as its processor, under a written data processing agreement (DPA) and the operator's instructions. Players and end users should contact the operator first; we will help the operator answer.

Bounty is warehouse-native: in most deployments it runs in the operator's own environment and queries data where it already lives, so no copy of the operator's database is transferred to us.

3. What we collect

Information you give us

• Contact and demo requests: name, work email, company, role, phone number (optional), company website and your message.
• Meeting bookings: the name, email and any notes you enter in the booking calendar.
• Investor requests: name, email, fund or company, website, phone (optional) and the reason for your interest.
• Feedback: answers you give in demo or pilot feedback forms.
• How you found us: when you send a form, we also record the page you sent it from, the website or campaign link that brought you to us on that visit, your device type and language. We do not store anything in your browser to do this.

Information created when you use a demo or the platform

• Demo access: when your one-time login link was sent and used, session start and end times, and the questions asked in the demo, used to keep access secure and to improve the product.
• Platform accounts: user name, email, role and permissions, login history, consent records and usage activity, used to run and secure the service.

Technical information

• Server logs: IP address, browser and device type, pages requested and timestamps, recorded by our hosting provider for security and reliability.

We do not use advertising cookies or third-party analytics on this website. See our Cookie Policy.

4. Why we use it, and our legal basis

• To answer enquiries and arrange demos, meetings and pilots: steps you ask us to take before a contract, and our legitimate interest in responding to business enquiries.
• To review demo requests and send demo access: our legitimate interest in giving access only to genuine business users and keeping the demo secure.
• To follow up after a demo and understand fit: our legitimate interest in business development. This includes an internal assessment of how well Bounty fits your organisation, used only to prioritise our follow-up. It has no legal or similarly significant effect on you, and you can opt out of follow-up emails at any time.
• To provide the platform to customers: performance of our contract with the customer.
• To handle investor requests: our legitimate interest in managing investor relations.
• To keep our services secure and improve them: our legitimate interests in security, fraud prevention and product quality.
• To meet legal obligations: for example tax, accounting and responding to lawful requests.

Where we rely on legitimate interests, we have balanced them against your rights. You can object at any time (see section 8).

5. Who we share it with

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We share it only with:

• Service providers acting for us: website hosting, database hosting, meeting scheduling, email delivery, and internal team messaging used to review demo requests. You can ask us for the current list of providers. Each is bound by a data processing agreement.
• AI model providers, where an operator's deployment uses one for summaries: only the question and on-screen result are sent, under the operator's agreement with us.
• Professional advisers, authorities and successors: where required by law, to protect our rights, or as part of a merger or acquisition, subject to confidentiality.

6. International transfers

Kavodel INVT is based in the United States, and some of our providers are in the US or other countries outside the European Economic Area and the UK. When we transfer personal data from the EEA or UK, we use the European Commission's Standard Contractual Clauses (and the UK addendum), or rely on an adequacy decision such as the EU-US Data Privacy Framework where the recipient is certified. Managed Bounty deployments can be hosted in the EU. You can ask us for a copy of the safeguards we use.

EU representative (Article 27 GDPR): [name and address of EU representative, once appointed].

7. How long we keep it

• Enquiries, demo requests and sales contacts: up to 24 months after our last contact with you.
• Demo access and session records: up to 12 months.
• Investor requests: up to 24 months after our last contact.
• Server logs: for the short period set by our hosting provider.
• Customer platform data: as set out in the customer contract and DPA, then deleted or returned.

We keep data longer only where the law requires it.

8. Your rights

If the GDPR applies to you, you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• have your data erased;
• restrict or object to our use of it, including for direct marketing;
• receive your data in a portable format;
• withdraw consent where we rely on it;
• complain to the data protection authority in the country where you live or work.

Depending on where you live, including certain US states, you may have similar rights to know, correct, delete and opt out. We will not discriminate against you for using them.

To use any right, email legal@bountyai.online. We reply within one month, and may ask you to confirm your identity. If your request concerns an operator's player data, we will pass it to that operator.

9. Security

We protect personal data with encryption in transit, role-based access controls, login history and audit records, and least-privilege access for our team. Managed hosting runs on SOC 2 compliant infrastructure. Demo logins are single-use and time-limited. No system is completely secure, and we will notify you and the authorities of a personal data breach where the law requires it.

10. Children

Bounty is a business service for iGaming operators. It is not intended for anyone under 18, and we do not knowingly collect their personal data.

11. Changes to this policy

We may update this policy as our services change. We will post the new version here with a new date, and tell customers of material changes in advance.

12. Contact

Kavodel INVT, 651 N. Broad St., Suite 201, Middletown, DE 19709, United States.
Privacy and data rights: legal@bountyai.online