Privacy Policy

1. Who we are

Bounty AI is a product of Kavodel INVT, a Delaware company registered in the United States (651 N. Broad St., Suite 201, Middletown, DE 19709). In this policy, “Kavodel INVT”, “Bounty”, “we”, “us” and “our” mean Kavodel INVT.

This policy explains how we collect and use personal data when you visit bountyai.online, request a demo or a pilot, book a meeting, request investor materials, contact us, or use the Bounty platform. It is written to meet the EU and UK General Data Protection Regulation (GDPR) and applicable US privacy laws.

Questions or requests: legal@bountyai.online.

2. Our two roles: controller and processor

• Controller. For our website, demo requests, sales conversations, investor requests and customer account administration, Kavodel INVT decides why and how personal data is used, and is the controller.
• Processor. When an operator uses Bounty on its own data (for example player, payment and gaming data), the operator is the controller and we act only as its processor, under a written data processing agreement (DPA) and the operator's instructions. Players and end users should contact the operator first; we will help the operator answer.

Bounty is warehouse-native: in most deployments it runs in the operator's own environment and queries data where it already lives, so no copy of the operator's database is transferred to us.

3. What we collect

Information you give us

• Contact and demo requests: name, work email, company, role, phone number (optional), company website and your message.
• Meeting bookings: the name, email and any notes you enter in the booking calendar.
• Investor requests: name, email, fund or company, website, phone (optional) and the reason for your interest.
• Newsletter: your email address, your first name if you give it, the page you signed up from, and the date you confirmed your subscription.
• Feedback: answers you give in demo or pilot feedback forms.
• How you found us: when you send a form, we also record the page you sent it from, the website or campaign link that brought you to us on that visit, your device type and language. We do not store anything in your browser to do this.

Information created when you use a demo or the platform

• Demo access: when your one-time login link was sent and used, session start and end times, and the questions asked in the demo, used to keep access secure and to improve the product.
• Platform accounts: user name, email, role and permissions, login history, consent records and usage activity, used to run and secure the service.

Technical information

• Server logs: IP address, browser and device type, pages requested and timestamps, recorded by our hosting provider for security and reliability.

We measure visits with Umami, an analytics tool that we host ourselves. It does not use cookies and does not track you across other websites. It records the pages you visit, the page or link that brought you here (including campaign tags in the link), your approximate location (country, region and city), device type, browser, operating system, screen size and language, which buttons and links you click, how far you scroll, how long you stay and how fast pages load. We do not use advertising cookies. See our Cookie Policy.

Visits from organisations, and paper downloads

• Visiting organisation: for each visit, we record your IP address and look up the organisation that owns it (for example a company or an internet provider), together with the pages you view. We use this to understand which businesses are interested in Bounty and to follow up with them.
• Paper downloads: when you verify your email to get our white papers, we record your name, role and company from the form, which papers you download and when, and the IP address you used. Your copy of each paper carries a short code in its links, so if you follow a link from it, or visit again from the same IP address, we can see that you came back and which pages you read. We use this to follow up with you about Bounty.
• We do not do this when your browser sends a Do Not Track or Global Privacy Control signal.

4. Why we use it, and our legal basis

• To answer enquiries and arrange demos, meetings and pilots: steps you ask us to take before a contract, and our legitimate interest in responding to business enquiries.
• To review demo requests and send demo access: our legitimate interest in giving access only to genuine business users and keeping the demo secure.
• To follow up after a demo and understand fit: our legitimate interest in business development. This includes an internal assessment of how well Bounty fits your organisation, used only to prioritise our follow-up. It has no legal or similarly significant effect on you, and you can opt out of follow-up emails at any time.
• To send the newsletter: your consent. We only add you after you confirm by clicking the link in our confirmation email (double opt-in). Every newsletter email has an unsubscribe link, and you can withdraw consent at any time.
• To provide the platform to customers: performance of our contract with the customer.
• To handle investor requests: our legitimate interest in managing investor relations.
• To keep our services secure and improve them: our legitimate interests in security, fraud prevention and product quality.
• To understand how our website is used: our legitimate interest in improving the website, using cookieless analytics.
• To see which organisations visit, and to follow up with people who download our papers: our legitimate interest in business-to-business development. You can object at any time, and we will stop and delete these records (see section 8).
• To meet legal obligations: for example tax, accounting and responding to lawful requests.

Where we rely on legitimate interests, we have balanced them against your rights. You can object at any time (see section 8).

5. Who we share it with

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We share it only with:

• Service providers acting for us: website hosting, database hosting, meeting scheduling, email delivery, and internal team messaging used to review demo requests. You can ask us for the current list of providers. Each is bound by a data processing agreement.
• AI model providers, where an operator's deployment uses one for summaries: only the question and on-screen result are sent, under the operator's agreement with us.
• Professional advisers, authorities and successors: where required by law, to protect our rights, or as part of a merger or acquisition, subject to confidentiality.

6. International transfers

Kavodel INVT is based in the United States, and some of our providers are in the US or other countries outside the European Economic Area and the UK. When we transfer personal data from the EEA or UK, we use the European Commission's Standard Contractual Clauses (and the UK addendum), or rely on an adequacy decision such as the EU-US Data Privacy Framework where the recipient is certified. Managed Bounty deployments can be hosted in the EU. You can ask us for a copy of the safeguards we use.

EU representative (Article 27 GDPR): [name and address of EU representative, once appointed].

7. How long we keep it

• Enquiries, demo requests and sales contacts: up to 24 months after our last contact with you.
• Demo access and session records: up to 12 months.
• Investor requests: up to 24 months after our last contact.
• Newsletter: until you unsubscribe. After that we keep only your email address on a suppression list, so we never email you again by mistake. If you never confirm, you are not added to the list.
• Server logs: for the short period set by our hosting provider.
• Website analytics: up to 24 months.
• Visit records with IP addresses, and paper download records: for as long as they are useful for following up with your organisation. We review them regularly, delete them when they are no longer needed, and delete them straight away if you ask.
• Customer platform data: as set out in the customer contract and DPA, then deleted or returned.

We keep data longer only where the law requires it.

8. Your rights

If the GDPR applies to you, you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• have your data erased;
• restrict or object to our use of it, including for direct marketing;
• receive your data in a portable format;
• withdraw consent where we rely on it;
• complain to the data protection authority in the country where you live or work.

Depending on where you live, including certain US states, you may have similar rights to know, correct, delete and opt out. We will not discriminate against you for using them.

To use any right, email legal@bountyai.online. We reply within one month, and may ask you to confirm your identity. If your request concerns an operator's player data, we will pass it to that operator.

9. Security

We protect personal data with encryption in transit, role-based access controls, login history and audit records, and least-privilege access for our team. Managed hosting runs on SOC 2 compliant infrastructure. Demo logins are single-use and time-limited. No system is completely secure, and we will notify you and the authorities of a personal data breach where the law requires it.

10. Children

Bounty is a business service for iGaming operators. It is not intended for anyone under 18, and we do not knowingly collect their personal data.

11. Changes to this policy

We may update this policy as our services change. We will post the new version here with a new date, and tell customers of material changes in advance.

12. Contact

Kavodel INVT, 651 N. Broad St., Suite 201, Middletown, DE 19709, United States.
Privacy and data rights: legal@bountyai.online