Bronty

Privacy Policy

The short version

• We collect the minimum we need to find products for you, deliver your order and support you afterwards.
• We never receive your chat history, your conversation transcript, your saved assistant memories or your AI-assistant account profile.
• We never receive your card number, security code or banking login. Your payment is authorised in your own bank or with our payment provider, not with us.
• We share your details mainly with the merchant selling you the item, the carrier delivering it, our payment provider, and the suppliers who run our systems (section 6 lists everyone we share with).
• We do not sell your personal information and we do not use it to build advertising profiles.
• You can ask us for a copy of your information, ask us to correct or delete it, and disconnect the app at any time.
• If you are a merchant who connects a Shopify store through Bronty connect, Part B explains what we collect from your store, what we send to it and what we delete when you leave.

This summary is here to help. The full policy below is what applies.

This policy explains how Bronty AI Pty Ltd (ACN 702 754 998, ABN 77 702 754 998) and its related companies handle your personal information. It applies to the Bronty app inside the AI assistants we support, and to the customer support and delivery services that go with your order. It also applies to Bronty connect and the merchant workspace (see Part B), and to bronty.ai, our information website, which hosts this policy and our terms. You cannot buy anything on bronty.ai.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

This policy has two parts. Part A (sections 1 to 19) covers shoppers who use Bronty through an AI assistant. Part B covers merchants who use Bronty connect and the merchant workspace.

Part A: Shoppers

Part A applies to everyone who uses Bronty through an AI assistant to find and buy products.

1. Who we are

Bronty is a conversational commerce service. You describe what you want to an AI assistant, we search the catalogues of independent merchants, and we help you buy and receive the goods.

Bronty also provides Bronty connect, a Shopify app. Merchants use it to sync and enrich their products for connected channels, to update the products they approve in their Shopify store, and to receive and create paid orders there. Part B explains how we handle merchants' information.

Bronty AI Pty Ltd operates the platform and is the entity responsible for your personal information under this policy. Each merchant, itself or through its logistics provider (which may be a Bronty related company), packs and dispatches the order created in its store. Bronty coordinates delivery options and customer support. Where a Bronty related company acts as a merchant's logistics provider or helps support your order, it handles your information under this same policy and under written agreements with us. The merchant who sells you an item is a separate business and handles your information under its own privacy policy for its own purposes.

Our privacy contact is privacy@bronty.ai.

2. What personal information we collect

We collect only what a given task requires. Browsing and searching for products needs far less than placing an order.

Providing your contact and delivery details is optional, but we cannot deliver an order without them.

3. What we never collect

We do not collect, request, receive or store:

• your chat history, conversation transcript, or any part of your conversation with the assistant beyond the shopping request described above;
• your saved assistant memories or custom instructions;
• your AI-assistant account profile, including the email address on that account;
• your full card number, card security code, PIN, banking login, password, one-time code or any other authentication secret;
• any data subject to the Payment Card Industry Data Security Standard;
• health information or protected health information;
• government identifiers such as tax file numbers, driver licence numbers or passport numbers;
• precise location data such as GPS coordinates;
• sensitive information as defined in the Privacy Act: racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record, biometric or genetic data.

We do not attempt to reconstruct or infer the wider conversation from what the assistant sends us. We work only with the specific request the assistant passes to us for the purpose of answering it.

If you volunteer information we do not need (for example, in a free-text support message), we will not use it for any other purpose and will delete it where we reasonably can.

4. How we collect it

• From you, when you give the assistant your delivery details, confirm an order, or contact support.
• From the AI assistant, which passes us the shopping request you made and the details you chose to share with the app.
• From our payment provider, which returns the outcome and reference of your payment.
• From merchants and carriers, in relation to stock, dispatch, tracking and returns for your order.
• Automatically, in server and security logs when your request reaches our systems.

Where it is reasonable and practicable, we collect personal information directly from you rather than from anyone else. You may deal with us using a pseudonym for a general product enquiry, but not for an order we have to deliver.

5. Why we use it

We will not use your personal information for a purpose unrelated to those above unless you consent or the law requires or permits it.

6. Who we share it with

We do not sell your personal information. We do not disclose it to data brokers, and we do not share it with advertisers or use it to build advertising or behavioural profiles.

7. Working with AI assistants

Bronty runs as an independent third-party app inside AI assistants. Bronty is not made, endorsed or operated by any AI provider.

• Two separate operators. The AI provider is responsible for the assistant and for your account with them, under their own privacy policy. We are responsible for Bronty, under this policy. The AI provider is not responsible for how we handle your information, and we are not responsible for how they handle it.
• What flows to us. When you use Bronty, the assistant sends us the specific request needed to answer you, plus anything you choose to give the app such as a delivery address. Nothing else.
• What flows back. Our response travels back through the assistant so it can be shown to you. That means the content of our response (for example, product names, prices and your order confirmation) passes through the AI provider's systems and is handled under their privacy policy.
• Connecting. Before you connect Bronty, the assistant will tell you what categories of data may be shared with us and will show you this policy.
• Disconnecting. You can disconnect Bronty in the assistant's settings at any time. We immediately lose the ability to receive requests from it. Disconnecting does not delete information we already hold; to request that, see section 12.

8. Payments and your bank

Payments are processed by our payment services provider, together with your own bank or card issuer.

• Where you pay by bank, you authorise the payment inside your own banking app or portal. Your banking credentials are entered with your bank, never with Bronty.
• Where you pay by card, the card details are captured by the payment provider, not by us.
• We receive only a payment reference, the amount, the outcome, the time and the payment method type.
• Funds settle from the payment provider directly to each merchant. Bronty does not receive, hold or control your money at any point.
• Where an assistant supports a delegated payment token, the token is single use, capped at the amount you approved, and time limited. We use it only for the order you approved.
• The payment provider handles your payment information under its own privacy policy and its obligations as a regulated payments business.

9. Sending information overseas

Your personal information is stored primarily in Australia, on Google Cloud in Sydney (australia-southeast1). Some of our suppliers operate or store data overseas, which means some of your information may be disclosed to recipients in:

• the United States: OpenAI (AI enrichment of merchant product data), SendGrid, a Twilio company (sign-in codes, invitations and receipts), Honeycomb (logs and monitoring), Better Auth Infrastructure (authentication and account management services), Google (website analytics), HubSpot (the seller form on bronty.ai) and support tooling;
• the United Kingdom and the European Union: payment processing, and Snitcher (identifying the company a website visit comes from).

Before disclosing personal information overseas we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, including through contractual commitments, restricting access to what is necessary, and requiring the information to be encrypted in transit and at rest. The AI provider that operates your assistant handles information under its own policy and its own arrangements, which are not controlled by us.

Where a merchant uses Bronty connect, we create your order in that merchant's Shopify store. Shopify handles store data as the merchant's platform under Shopify's own privacy policy.

10. How long we keep it

We keep personal information only as long as we need it for the purpose we collected it, or as long as the law requires, and then destroy or de-identify it.

Where you ask us to delete information, we will do so except where we are required to keep it (for example, tax records for a completed order).

11. How we protect it

• Data is encrypted in transit and at rest.
• Access is restricted to staff who need it for their role, under individual accounts with multi-factor authentication, and is logged.
• Systems are monitored and patched.
• Suppliers are assessed before onboarding and are bound by written confidentiality and security terms.
• We keep payment card data out of our environment entirely by design, so there is no cardholder data for us to lose.
• No system is perfectly secure. If something goes wrong, see section 17.

12. Your choices and rights

• Access. Ask us for a copy of the personal information we hold about you. We will respond within 30 days and will not charge for the request itself.
• Correction. Ask us to correct anything inaccurate, out of date or incomplete.
• Deletion. Ask us to delete your information. We will delete what we are not required to keep, and tell you what we must retain and why.
• Marketing opt-out. Unsubscribe from any marketing email, or email us. Order and delivery notifications are not marketing and will continue while an order is live.
• Disconnect the app. Remove Bronty in your assistant's settings at any time.
• Complain. See section 19.

To exercise any of these, email privacy@bronty.ai. Identify the account or order, but do not include passwords, payment details or identity documents in your message. We may need to verify who you are first, and will ask for only as much as is needed to do that. We will never require you to send government identification through the assistant. If we refuse a request, we will tell you why in writing and how to have that reviewed.

Deleting in one place does not delete everywhere

Bronty, the AI provider, the merchant and the payment provider each keep their own records. So:

• Deleting a conversation in an AI assistant does not delete Bronty's records of an order placed in it.
• Asking us to delete your information does not erase records held independently by the AI provider, a merchant, a carrier or the payment provider. Each has its own retention obligations.
• Disconnecting the app stops further access through that connection. It does not cancel an accepted order, revoke a payment mandate you set up with your bank, or delete records we already hold.
• Closing your Bronty account does not cancel an order already accepted, or require us to destroy records we are legally required to keep.

Tell us what you want deleted and we will handle our own records and, where appropriate, tell you who else to contact or pass on an authorised request for you.

13. AI and automated decisions

Bronty uses automated systems, including AI models, to interpret your shopping request, match it to products, rank results, estimate delivery times and options, and detect suspected fraud.

• We do not use automated processing to make decisions that have a legal effect on you or a similarly significant effect, other than declining a transaction where fraud is suspected.
• If a transaction is declined on fraud grounds, you can ask us to review it. A person will look at it. Email support@bronty.ai.
• We do not use your personal information to train our own AI models, and we do not provide your personal information to third parties to train theirs.
• We do not use requests received through an AI assistant, or their content, to train or improve AI models, and we do not use them to develop models that compete with the AI provider whose assistant you are using.
• Our suppliers are contractually prohibited from using information we give them for their own advertising or model training.
• The wording of the assistant's replies is generated by the AI provider's model, not by us, and may be inaccurate. Please check product information before relying on it.

AI enrichment of merchant product data

Merchants who use Bronty connect can choose to enrich their product data with AI. This is separate from your shopping requests.

• A run happens only when a merchant admin, or a Bronty operator, confirms it after seeing what will be sent. We record that confirmation.
• For each run we send product listing text to OpenAI in the United States through its API: title, product type, vendor, up to 40 tags, up to 10 collection titles, options and description. We do not send images, prices or any shopper information.
• When a merchant presses Enrich title or Enrich description on one product, we send that product's title, description, vendor, product type, tags, options and product details to OpenAI in the United States through its API, to suggest new text. Nothing is sent until the merchant presses the button. We do not send images, prices or any shopper information. The merchant can edit or discard each suggestion, and each store has a daily limit on suggestions.
• OpenAI keeps API data under its own API data policy and does not use it to train its models by default.
• The results (such as category, occasions, colours, materials and styles) are stored in Bronty with a record of where each one came from. The merchant can edit them. They reach the merchant's Shopify store only if the merchant turns on Shopify updates in Bronty and approves that product. Bronty keeps the original title and description so the merchant can restore them.
• We also run a free rules-based pass on store data automatically. It does not use any AI provider.

14. Marketing

We will only send you marketing where you have asked us to or where the law otherwise permits it in relation to a purchase you made. Every marketing message has an unsubscribe link, and we act on unsubscribes promptly. We comply with the Spam Act 2003 (Cth). We do not display advertising inside the assistant.

15. Cookies on our website

bronty.ai uses cookies and similar technologies that are needed to make the site work and keep it secure, and two analytics tools:

• Google Analytics counts visits and shows us how the website is used. It sets its own cookies and receives your IP address and browser and device details. We use it to understand and improve the website, not for advertising.
• Snitcher uses your IP address to work out which company a visit comes from, so we can see which businesses are interested in Bronty. It is designed to identify companies, not individual people.

The seller form at bronty.ai/register is provided by HubSpot, which receives what you enter in it and may set its own cookies. We do not use advertising cookies. You can block or delete cookies in your browser, and you can opt out of Google Analytics with Google's opt-out browser add-on; some parts of the site may not work as intended without cookies. These tools run only on bronty.ai: cookies are not used inside the assistant experience.

16. Children

Bronty is not directed at children under 13 and we do not knowingly collect their personal information. Placing an order requires you to be 18 or over. If you believe a child has given us personal information, email privacy@bronty.ai and we will delete it.

17. If something goes wrong

We have an incident response plan. If a data breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, tell you what happened and what information was involved, and explain what you can do about it.

Where an incident or a security vulnerability affects the Bronty app inside an AI assistant, we also escalate it promptly to that AI provider, as our developer agreement with them requires.

If you spot a privacy or security problem, tell us at privacy@bronty.ai. Please do not include passwords, payment details or any unnecessary personal information in the report.

18. Changes to this policy

We may update this policy as the service changes. The current version is always at bronty.ai/privacy with the date it took effect. For material changes we will give notice in the assistant or by email where we have your address before they take effect.

19. Contact and complaints

If you have a privacy question, a request, or a complaint about how we have handled your personal information:

We will acknowledge a complaint within 5 business days and give you a written response within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au, by phone on 1300 363 992, or by writing to GPO Box 5288, Sydney NSW 2001.

Other notices that apply

These organisations handle information for their own purposes under their own notices. Those notices do not replace this policy, and this policy does not change their practices.

• Bronty Terms of Use: bronty.ai/terms
• Payment provider privacy notice and terms: made available in the payment flow
• The privacy policy and terms of the AI assistant you use, which govern the assistant itself
• The merchant selling you an item: its privacy notice is linked from your order confirmation
• Shopify's Privacy Policy, which governs the Shopify platform that a merchant's store runs on

Part B: Merchants and Bronty connect

This part explains how we handle personal information about merchants, and the people who work for them, when they use Bronty connect (our Shopify app) and the merchant workspace. Part A still applies where it is relevant, for example sections 9 (overseas), 10 (retention), 11 (security) and 19 (contact and complaints).

B1. Who this part applies to

It applies to businesses established in Australia that use Bronty connect and the merchant workspace, and to the people who sign in on their behalf. We currently offer merchant services to Australian businesses only.

B2. Your account information

We hold:

• your name, email address and role in the merchant workspace;
• invitations: the email address invited, who sent the invitation and when it expires;
• sign-in records. You sign in with a 6-digit code that we email to you. The code is valid for 5 minutes. We do not use passwords. A session lasts 24 hours, and we record its IP address and browser details;
• your business details: brand name, storefront URL, domain, status, an optional support email, your application and our decision on it (with any reason for declining), and activation;
• channel requests: the channels you ask for and any short note you add.

If you give us a support email, we show it to shoppers on the receipts for your orders.

B3. What we read from your store

When you connect your Shopify store, Bronty connect asks Shopify for permission to read products, inventory and shipment records, to edit products, and to create orders in your store (Shopify's order permission also lets an app read and edit orders; Bronty uses it to create orders and to read the orders it created). Bronty uses the product permission only to update a product's title, description or the product details Bronty adds, and only when you approve that product in Bronty. Shopify updates are off unless you turn them on. We read:

• active products only: title, handle, description, online store URL, vendor, product type, tags, status, dates and options;
• variants: SKU, price, compare-at price, inventory quantity and policy, availability and selected options;
• images, as links with their alt text. We do not copy the image files;
• collection titles and inventory levels;
• shipment status and tracking details, and order cancellations. For a cancellation we keep only the order ID, order number, reason and time;
• basic shop details. We keep only the shop's ID, name and domains, and discard the shop owner's email, phone number and address that Shopify sends us.

We encrypt your store access tokens at rest (AES-256-GCM). Access tokens expire after one hour and are renewed with a token that lasts 90 days.

Your products and variants are shared with connected channels according to settings Bronty manages with you. We may restrict products for policy reasons. We keep a record of these settings.

B4. What we write into your store

When a shopper pays for one of your products on a connected channel, we create an order in your Shopify store. It contains:

• the line items and a shipping line;
• a sale transaction recorded against the payment gateway "Bronty";
• the tag "bronty", a note naming the Bronty order, and Bronty order IDs as custom attributes;
• the shopper's email address, first and last name, and shipping address (name, address lines, city, state, postcode and country). We also create or update a customer record for the shopper in your store.

We never send the shopper's phone number, billing address, or card or bank details. Your inventory is reduced under your store's own inventory policy. Shopify's order and shipping confirmation emails to the shopper are turned off for these orders, because we send the shopper one receipt.

When you create an order in the Bronty workspace, we create it in your Shopify store straight away, as paid. It contains:

• the products and quantities you choose, at your catalogue prices, and the delivery name and price you enter;
• the tag "bronty", plus the channel you enter as a second tag, and a note naming the Bronty order;
• your customer's name and shipping address, and their email address if you enter one. With an email address we also create or update a customer record in your store.

Shopify sends your customer no email for these orders. In your workspace's order list we show the customer's name with suburb and state.

When you turn on Shopify updates and approve a product, we write the title, description and product details you approved to that product. Product details are saved in fields that belong to Bronty connect, shown in your Shopify admin and not on your storefront. We keep the original title and description from our first update so you can undo it. When you turn off Shopify updates you can restore your originals and remove the product details Bronty added. Anything you have changed in Shopify since our update stays as you have it.

B5. Who is responsible for what

You control the data in your Shopify store. When we pass a shopper's details into your store for a sale, each of us handles them for our own purposes: you to process, dispatch and support the order as the seller, and us to run Bronty and support the shopper. You handle those details under your own privacy policy.

When you create an order in the workspace, you give us your customer's details and we handle them for you: to create the order in your store, show it in your workspace and keep a record of it. You are responsible for collecting those details lawfully and for telling your customer how you handle them.

B6. AI enrichment of your product data

AI enrichment runs only when you, or a Bronty operator, confirm a run. The confirmation dialog tells you what will be sent, and we log your confirmation as the record of your consent. Section 13 explains what we send to OpenAI, what we do not send, and what happens to the results.

Suggested titles and descriptions are written only when you press Enrich title or Enrich description on a product. The note beside those buttons says that OpenAI writes the suggestion, and we record each request. Section 13 lists what we send.

B7. When you uninstall Bronty connect

When you uninstall the app, we remove your store access tokens straight away and schedule deletion of the data we obtained through the app for 30 days later. Shopify normally sends us a shop deletion request about 48 hours after you uninstall. When it arrives, we delete the data then. We delete:

• the product catalogue we imported from your store, its enrichment results and the record of your Shopify updates, including the originals we kept;
• your store connection and its sync records;
• the store events we stored.

We do not delete the following. They follow the normal retention periods in section 10:

• your merchant account and its users;
• the record of which products were shared with connected channels;
• Bronty order records, including orders you created in the workspace and the shopper or customer contact details on them. We keep these for 7 years, as section 10 sets out.

If you reinstall before the deletion runs, the deletion is cancelled.

Titles and descriptions you approved stay in your store after you uninstall, because our access ends straight away. Shopify removes the product details Bronty added, in its own time. To restore your original titles and descriptions, turn off Shopify updates before you uninstall.

B8. Shopify customer data and erasure requests

If a shopper asks you, through Shopify, for a copy of their data or for it to be erased, Shopify tells us too. Contact privacy@bronty.ai and we will work with you on the request.

B9. Your rights

You can ask us for a copy of your account information, and ask us to correct or delete it, by emailing privacy@bronty.ai. We will delete what we are not required to keep, and tell you what we must retain and why. To complain, see section 19.