Privacy Policy
Privacy Policy
Last Updated: August 12, 2026
1. Introduction
This Privacy Policy explains what personal data we collect when you use Bondis, why we collect it, how we use and share it, how long we keep it, and the rights you have over your data.
We have kept our practices deliberately simple: we do not sell personal data, we do not run advertising, and we do not use tracking analytics.
This Policy applies whenever you access or use the Service and forms part of our Terms and Conditions. We are the controller of your personal data. If you do not agree with this Policy, please do not use the Service.
2. Who We Are (Data Controller)
The Service is operated by:
Bondis Labs Ltd
Registered in Cyprus, registration number HE 496345
Registered office: Arch. Makariou III, 20, Eleneio Megaro,
Flat/Office 202, 6017 Larnaca, Cyprus
Email: help@bondis.app
For any question about this Policy or about your personal data, contact us at help@bondis.app. We aim to respond within 48 hours and to resolve data protection requests within the timeframe required by law (see Section 9).
3. Information We Collect
We collect only the information needed to provide the Service: from you directly, from your device, and — where you choose to sign in with a third party — from that provider. Some of this information (such as your account details and location) is necessary to provide the Service; without it, we cannot offer features such as matching.
3.1 Account and Profile Information
Your email address, display name, biography, photos, and preferences (such as language and notification settings). Bondis is passwordless — we do not store account passwords.
3.2 Location Information
Location information you provide or that we collect from your device, including coordinates and a location name, used to provide location-based features. Your exact coordinates are never shown to other users.
3.3 Information You Provide Through Questions
Answers you provide to profile and compatibility questions, which we use to provide matching features (see Section 5).
3.4 Voice Input
If you use voice input, the audio is transcribed into text. The audio itself is not retained.
3.5 Content You Create
Content you create and share through the Service, such as listings, posts, reviews, and messages.
3.6 Interactions with Other Users
Records of your interactions with other users, including connections, messages, and choices you make about visibility and blocking.
3.7 Authentication Data
One-time codes sent to your email, passkeys, and — if you choose to sign in with Google — the profile information Google shares with us (typically your email address, name, and avatar).
3.8 Device and Technical Data
Your IP address, browser and device information, push notification identifiers (if you enable notifications), and error diagnostics used to fix faults.
3.9 Payment Data
If you subscribe, payment is processed by our payment providers. We do not collect or store your card number or other full payment credentials — we receive only the confirmation needed to grant you access.
4. How We Use Your Information
We use your personal data only for the purposes described below. Under the GDPR we rely on the legal bases shown for each purpose.
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the Service, including matching | Contract performance (Art. 6(1)(b)) |
| Signing you in and securing your account | Contract performance (Art. 6(1)(b)) |
| Processing your optional choices (notifications, visibility, voice input) | Consent (Art. 6(1)(a)) |
| AI-assisted analysis and transcription | Contract performance (Art. 6(1)(b)); consent for optional use (Art. 6(1)(a)) |
| Security, fraud prevention, and abuse detection | Legitimate interests (Art. 6(1)(f)) |
| Improving and debugging the Service | Legitimate interests (Art. 6(1)(f)) |
| Transactional and service emails | Contract performance (Art. 6(1)(b)) |
| Payment processing and billing records | Contract performance (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we balance them against your rights and freedoms and apply appropriate safeguards. You may object to this processing at any time (see Section 9).
5. AI Processing
We use third-party AI services to analyse information you provide (for example, to power matching) and to transcribe voice input. Our AI providers are contractually required to use zero data retention and are not permitted to train their models on your data. We do not use your data for AI training ourselves.
Matching results are suggestions, not automated decisions with legal or similarly significant effects — you always decide who to contact and what to do next.
6. How We Share Your Information
We do not sell your personal data and do not share it for advertising. We share personal data only (a) with other users, as an inherent part of the Service, and (b) with the categories of service providers listed below, who help us operate it.
6.1 Sharing with Other Users
Content you share on the Service is visible to other users in accordance with your visibility settings, and messages are visible to their participants. Do not post information you want to keep private.
6.2 Service Providers
| Category of recipient | Purpose |
|---|---|
| Hosting and infrastructure | Cloud hosting, CDN, security, and bot protection |
| Payments | Payment processing (web) and in-app purchases (Apple App Store, Google Play) |
| App stores | Distribution of our mobile application |
| Push notifications | Delivering notifications you have enabled |
| Email delivery | Sending transactional and service emails |
| Error monitoring | Detecting and fixing technical faults |
| Maps and geocoding | Map rendering and location search |
| Sign-in providers | Sign-in with Google (only if you choose it) |
| AI service providers | Matching analysis and voice transcription (Section 5) |
6.3 Legal, Safety, and Business Reasons
We may disclose personal data where required by law or a competent authority, or to protect the rights, property, or safety of Bondis, our users, or the public. If Bondis is ever involved in a merger, sale, or transfer of assets, personal data may be transferred as part of that transaction, subject to this Policy continuing to apply.
7. International Data Transfers
Your data is primarily stored on servers in the European Union. Some of our service providers are located outside the EEA. Where we transfer personal data outside the EEA, we rely on appropriate safeguards recognised under the GDPR, such as Standard Contractual Clauses or adequacy decisions. You can request details of these safeguards at help@bondis.app.
8. Data Retention
We keep personal data only as long as necessary for the purposes described in this Policy. When you delete your account, your account data is deleted immediately. Some data must be kept longer for legal or technical reasons, as shown below.
| Data | Retention |
|---|---|
| Account, profile, answers, and content | Deleted immediately when you delete your account |
| Messages and interaction records | Deleted when you delete your account; conversations with other users may lose your messages |
| Backup copies | Purged as soon as technically feasible (typically within 30 days) |
| Security and operational logs | Up to 90 days |
| Payment and billing records | As required by applicable law (for example accounting and tax law) |
| Time-limited posts | Stop being shown once they expire; deleted when your account is deleted |
9. Your Rights
If you are in the European Economic Area (or another jurisdiction that grants you these rights), you have the following rights over your personal data:
- Right of access: obtain a copy of the personal data we hold about you
- Right to rectification: correct inaccurate or incomplete data
- Right to erasure ("right to be forgotten"): request deletion of your personal data. You can also delete your account at any time from your profile settings, which removes your data immediately
- Right to restrict processing: ask us to limit how we use your data in certain circumstances
- Right to data portability: receive your data in a structured, machine-readable format (for example JSON)
- Right to object: object to processing based on legitimate interests, including profiling related to such processing
- Right to withdraw consent: withdraw any consent you have given at any time, without affecting the lawfulness of processing before withdrawal
To exercise any of these rights, email us at help@bondis.app with the subject line "Privacy Request". We will respond within one month, as required by the GDPR.
If you are not satisfied with how we handle your request, you have the right to lodge a complaint with a supervisory authority — in particular the Cyprus Commissioner for Personal Data Protection (dataprotection.gov.cy) or the authority of your country of residence.
10. Data Security
We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit, passwordless authentication, restricted access controls, EU-hosted infrastructure behind industry-standard security measures, and encrypted backups.
No system is 100% secure. In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours where required by law, and we will notify you without undue delay if the breach is likely to result in a high risk to your rights and freedoms.
11. Cookies and Local Storage
We use a minimal amount of cookies and browser storage, all of it necessary to run the Service. We do not use cookies or storage for tracking, analytics, or advertising.
| Item | Purpose |
|---|---|
| Session and security cookies | Keeping you signed in and protecting your session |
| Local storage | Remembering your settings and in-progress input on your device, and temporary caches to improve performance |
You can clear cookies and local storage at any time through your browser or device settings.
12. Children's Privacy
The Service is intended for adults only. You must be at least 18 years old to use Bondis. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, please contact us at help@bondis.app and we will delete the information promptly.
13. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page. If a change is material, we will notify you in advance — for example by email or an in-app notice — and, where required by law, ask for your consent.
14. Contact Us
Bondis Labs Ltd
Registration number: HE 496345 (Cyprus)
Email: help@bondis.app
Privacy requests: subject line "Privacy Request"