Bronty

Bronty Privacy Policy

The short version

This summary is here to help. The full policy below is what applies.

• Bronty helps Australian businesses (merchants) sell their products through AI shopping assistants and other channels. Shoppers buy from the merchant; Bronty runs the checkout and passes the order to the merchant.
• If you are a shopper, we collect what we need to take your order, arrange your payment through our payments partner, send you a receipt and order and delivery updates, and pass the order to the merchant: your name, email address, mobile number, delivery address and order details, plus payment references.
• Shoppers pay only the merchant's listed prices and delivery. Bronty charges shoppers no fee or surcharge; merchants pay Bronty's fee and the payment processing fees.
• We never receive your full bank account details, banking login or card number. Our payments partner, Quidkey, and your bank handle those.
• We never receive your chat history with an AI assistant.
• If you are a merchant or work for one, we hold your account details, your store's product data and the orders we create in your store.
• If you visit bronty.ai, we use analytics tools to understand visits.
• We do not sell personal information.
• You can ask us for access to or correction of your information, or ask us to delete it, by emailing privacy@bronty.ai.

1. Who we are and what this policy covers

1.1 This policy explains how Bronty AI Pty Ltd (ACN 702 754 998, ABN 77 702 754 998) ("Bronty", "we", "us", "our") handles personal information. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1.2 Bronty is a platform for Australian businesses that sell through a Shopify store ("merchants"). It syncs and improves their product data, makes their products available to AI shopping assistants and other channels, takes shopper orders and payments through those channels, and delivers the orders into the merchant's Shopify store.

1.3 This policy covers:

1. (a) merchants and their users: businesses that use the Bronty merchant workspace or the Bronty connect app for Shopify, and the people who sign in for them;
2. (b) shoppers: people who buy from a merchant through the Bronty app in an AI assistant; and
3. (c) website visitors: people who visit bronty.ai, including anyone who registers their interest through the form on the site.

1.4 The merchant who sells to a shopper is a separate business. It handles the shopper's information it receives for its own purposes, under its own privacy policy. The AI assistant a shopper uses, Shopify and our payments partner also handle information under their own policies (section 13).

1.5 Our privacy contact is privacy@bronty.ai.

2. Information about merchants and their users

2.1 What we collect.

2.2 How we collect it. From you and your users when you apply, sign in, set up your workspace and use it; from Shopify when you connect your store; from Quidkey about the status of your payments account; and automatically in our system and security logs.

2.3 What we read from your store. When you connect your Shopify store, the Bronty connect app reads:

1. (a) active products: title, handle, description, online store URL, vendor, product type, tags, status, dates and options;
2. (b) variants: SKU, price, compare-at price, inventory quantity and policy, availability and selected options;
3. (c) images, as links with their alt text (we do not copy image files);
4. (d) collection titles and inventory levels;
5. (e) the shipping, delivery and tracking details of the orders Bronty created, and order cancellations, so we can keep shoppers updated; and
6. (f) basic shop details. We keep only the shop's identifier, name and domains, and discard the shop owner's email, phone number and address that Shopify sends us.

Product data is mostly not personal information, but it can include names, for example in a vendor field or a description.

2.4 What we write into your store. We create orders in your store (section 5, "The merchant selling to a shopper", and section 2.7), and, if you turn on Shopify updates and approve a product, we write the title, description and product details you approved to that product.

2.5 Setting up payments. When a user starts payments set-up, we send Quidkey your brand name, website and industry category, and that user's name and email address, so Quidkey can create your business and invite the user. When a user signs in to Quidkey with "Sign in with Bronty", we confirm the user's name, verified email address and Bronty user identifier to Quidkey. When you accept Quidkey's terms and conditions at the Connect payments step in the platform, we record that acceptance and may share the record with Quidkey. You complete Quidkey's own onboarding with Quidkey, including identity checks and bank account details. We do not collect or store your bank details or identity documents.

2.6 Why we use it. To assess your application; to run your account and the workspace; to sign you in securely; to sync your catalogue, run the enrichment you ask for and write the updates you approve; to make your products available on channels; to create orders in your store; to set up your payments account; to calculate and collect our fees; to support you; to keep the platform secure; to meet legal obligations; and to tell you about changes to the service. We may send you information about Bronty services that relate to your account; you can opt out of marketing at any time.

2.7 Your customers' details for orders you create. When you create an order in the platform (Create order), you give us your customer's name, email address and delivery address. We use them on your behalf only to create the order in your Shopify store, show it in your workspace and keep a record of it, and we do not email your customer. You are responsible for telling your customers how you and your service providers, including Bronty, handle their information. These details are kept with order records (section 7).

3. Information about shoppers

3.1 What we collect.

3.2 What we never collect. We do not collect, request or store:

1. (a) your chat history or conversation with the AI assistant, beyond the shopping request described above;
2. (b) your saved assistant memories or your AI assistant account profile, including the email address on that account;
3. (c) your full bank account number, BSB, PayID, banking login, card number, security code, password or one-time code;
4. (d) government identifiers; or
5. (e) sensitive information, such as health information.

If you volunteer information we do not need, for example in a support message, we will not use it for any other purpose and will delete it where we reasonably can.

3.3 How we collect it. From you, when you give the Bronty app your details, confirm an order or contact us; from the AI assistant, which passes us your shopping request and an identifier for your account; from our payments partner, which tells us the outcome of your payment and gives us payer references; and from the merchant's Shopify store, which tells us about shipping, tracking and cancellations.

3.4 Your mobile number. We ask for your mobile number at checkout and pass it to our payments partner, Quidkey, which uses it to verify you and your payment. We do not give your mobile number to the merchant. We keep it on your Bronty profile so you do not have to enter it again, and use a hashed form of it in the repeat purchase checks (section 3.1).

3.5 Payments. You pay by PayTo through our payments partner, Quidkey, on Quidkey's secure page and with your own bank. You may set up a PayTo agreement with Quidkey that lets you pay later Bronty orders in one tap. Your bank account details and your banking authorisation are handled by Quidkey, its payment partners and your bank, never by Bronty. When you make a one-tap repeat purchase, we hold the payment for a short time and email you a link to cancel it.

3.6 Why we use it.

We do not use shopper information for marketing.

3.7 Automated decisions. We use automated checks to decide whether to offer one-tap payment (for example, whether the request reaches us from the AI assistant's network, whether your delivery address and contact match your earlier payment, and whether the order is within the limits). If a check fails, you can still pay on the secure payment page. You can ask us to review an automated decision by emailing support@bronty.ai.

3.8 Using Bronty is optional. You do not have to give us your details, but we cannot take an order without them.

3.9 No fees for shoppers. You pay only the merchant's listed prices and the delivery fee shown at checkout. Bronty does not charge shoppers any fee, surcharge or markup. The merchant pays Bronty's fee and the payment processing fees.

3.10 Order and delivery updates. Shopify's shipping emails are not sent for orders placed through Bronty. Instead, we may send you order and delivery updates by email, using the shipping and tracking information the merchant records in its Shopify store, which we receive from that store.

4. Information about website visitors

4.1 Analytics. bronty.ai uses two analytics tools:

1. (a) Google Analytics counts visits and shows us how the website is used. It sets its own cookies and receives your IP address and browser and device details. We use it to understand and improve the website, not for advertising.
2. (b) Snitcher uses your IP address to work out which company a visit comes from, so we can see which businesses are interested in Bronty. It is designed to identify companies, not individual people.

4.2 Registering your interest. The seller form at bronty.ai/register is provided by our customer relationship management provider (HubSpot). It receives what you enter (your name, work email, phone, business name, website and store size) and may set its own cookies. We use it to follow up on your interest in selling through Bronty.

4.3 Cookies. We do not set advertising cookies ourselves. You can block or delete cookies in your browser, and you can opt out of Google Analytics with Google's opt-out browser add-on. Some parts of the site may not work as intended without cookies. These tools run only on bronty.ai, not inside the Bronty app in an AI assistant or in the merchant workspace.

5. Who we share personal information with

We do not sell personal information, and we do not share it with data brokers or advertisers.

6. Sending information overseas

6.1 Our systems and databases are hosted on Google Cloud in Sydney, Australia.

6.2 Some of the recipients in section 5 are located overseas or store information overseas, so personal information may be disclosed to recipients in:

1. (a) the United States: Twilio SendGrid (email), Honeycomb (logs and monitoring), Better Auth (authentication), Google (website analytics), HubSpot (the seller form), our AI model provider (merchant product text), and AI assistant platforms;
2. (b) the United Kingdom and the European Union: Quidkey (payments) and Snitcher (website company identification); and
3. (c) Canada and other countries where Shopify operates: Shopify (merchant store data).

6.3 Before disclosing personal information overseas, we take reasonable steps to make sure the recipient handles it consistently with the APPs, including through contracts, limiting what we share, and requiring encryption in transit. AI assistant platforms and Shopify handle information under their own policies and arrangements, which we do not control.

7. How long we keep it

We keep personal information only as long as we need it for the purpose we collected it, or as long as the law requires. Search results and data from an uninstalled store are deleted automatically. For other information, we delete or de-identify it at the end of the period below through a manual review process, and earlier on request where the law allows.

8. How we protect it

8.1 We protect personal information with:

1. (a) encryption in transit, and encryption at rest for our databases;
2. (b) additional encryption for Shopify store access tokens;
3. (c) access limited to people who need it for their role, with administrative actions in our systems logged;
4. (d) monitoring and patching of our systems; and
5. (e) keeping bank and card details out of our systems entirely, by having our payments partner and your bank handle them.

8.2 No system is perfectly secure. If a data breach is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

9. Access, correction and deletion

9.1 Access. You can ask for a copy of the personal information we hold about you. We will respond within 30 days and will not charge you for making the request.

9.2 Correction. You can ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.

9.3 Deletion. You can ask us to delete your information. We will delete what we are not required to keep, and tell you what we must keep and why (for example, order records we must keep for tax purposes).

9.4 How to ask. Email privacy@bronty.ai. Tell us which account or order the request is about, but do not send passwords, bank details or identity documents. We may need to confirm who you are before we act, and will ask only for what we need to do that. If we refuse a request, we will tell you why in writing and how to complain.

9.5 Requests through a merchant or Shopify. If you ask a merchant for access to or deletion of your information and it concerns information Bronty holds, the merchant may pass the request to us, and we will work with the merchant on it.

9.6 Other organisations keep their own records. Deleting a conversation in an AI assistant does not delete the order records Bronty holds. Asking us to delete your information does not delete records held by the merchant, Shopify, the AI assistant platform or our payments partner. Cancelling or removing a saved PayTo agreement is done with Quidkey or your bank.

10. Children

Bronty is not directed at children. Merchant accounts are for businesses. Shoppers must be 18 or over to buy. If you believe a child has given us personal information, email privacy@bronty.ai and we will delete it.

11. Complaints

11.1 If you have a complaint about how we have handled your personal information, email privacy@bronty.ai or write to Privacy Officer, Bronty AI Pty Ltd, [REGISTERED ADDRESS: TO BE CONFIRMED].

11.2 We will acknowledge your complaint within 5 business days and give you a written response within 30 days.

11.3 If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, by phone on 1300 363 992, or by writing to GPO Box 5288, Sydney NSW 2001.

12. Changes to this policy

We may update this policy as Bronty changes. The current version, with the date it took effect, is always at bronty.ai/privacy. For material changes we will tell merchants by email or in the workspace before they take effect.

13. Other notices that apply

These organisations handle information for their own purposes under their own notices. Those notices do not replace this policy.

• The merchant's privacy policy, for information the merchant receives about your order.
• Quidkey's privacy notice and terms, shown during payment.
• The privacy policy of the AI assistant you use.
• Shopify's privacy policy, for the Shopify platform a merchant's store runs on.

14. Contact