Privacy Policy

Bountii is operated by Kazz, Inc., a Delaware corporation ("Bountii", "we"). You can reach us about anything in this policy at welcome@getbountii.com.

Our own data. For account data, hunter payout data, payment records and our website analytics, we are the controller: we decide why and how that data is used.

Data a company gives us. When a company names prospects at its target accounts, or shares its target list, pitch kit or messaging, the company is the controller of that prospect data and we process it on the company's behalf, only to run its bounties. On request we sign a data processing agreement with any company that sets out those terms.

Account data: your name, email address, and role (company or hunter). Hunters may additionally provide a LinkedIn URL, bio, countries, and languages. If you sign in with Google or LinkedIn, we receive your name, email address and profile picture from that provider.

Marketplace data: bounties, target accounts, claims, and meeting records (prospect name, title, and — if provided — email) that users create while using the platform.

Payment records: bounty amounts, prepaid credit, and payout history. Company card payments are processed by Stripe; we do not store card numbers.

Payout verification data (hunters): before a hunter's first payout we collect their country of tax residence, legal name, address, date of birth, a signed US tax form (W-9, W-8BEN or W-8BEN-E) with the tax identification number it requires, any VAT or business registration number they choose to give, and their declarations of self-employed and contractor status. Bank account details are collected by our payout provider on its own secure form, or, while that provider is not yet live, stored by us in a restricted table that only the hunter and the person running payouts can read. We screen every payee's name, date of birth and country against US sanctions lists and keep a log of each check. We do not store identity-document images.

Demo requests: the name, work email and company details you send when you book a demo.

We collect it to pay you (performance of our agreement with you), to meet legal obligations that apply to a US company paying contractors (US tax documentation and reporting, sanctions law) and, where you are resident in the European Union, Canada or Australia, to meet digital-platform reporting rules (DAC7 and its equivalents), under which we report your identification details, bank account identifier and yearly earnings to your tax authority once a year and send you a copy. Where no specific law requires a field, we rely on our legitimate interest in paying the right person and keeping accurate records.

Retention: tax forms and the data on them, four years after the form expires; platform-reporting records, five years after the end of the reporting year; sanctions-screening logs, five years; bank details, until you replace them or close your account, plus the period our payment records require. Payout statements form part of our accounting records and are kept for the period tax law requires.

To operate the marketplace: matching hunters with bounties, verifying meetings against qualification criteria, moving bounty funds, and keeping both sides informed by email. We rely on performance of our agreement with you for this, and on our legitimate interest for security, fraud prevention and improving the product. We also use aggregate, de-identified data to improve the product.

Cookies and analytics: we set the cookies needed to keep you signed in, plus one first-party cookie that remembers how you first found Bountii (for example a LinkedIn post or a search engine) so we know which channels bring in users. We measure page views with Vercel Web Analytics, which does not use cookies or track you across sites, and with Google Analytics, which sets its own cookies to count visits, sign-ups and demo requests. We do not run advertising trackers and do not use analytics data for advertising.

We do not sell your personal data. Ever.

Companies see the profiles and path notes of hunters who claim their accounts. Hunters see open bounties and the qualification criteria attached to them, including the names of target accounts. A company's brief, messaging and prospect details are visible only to the hunters it has approved on that bounty, and a company that posts confidentially is not named until it approves a hunter.

We use these providers to run Bountii. Each processes data only to provide its service to us, under a contract that protects it:

• Supabase — database, file storage and sign-in (data stored in Frankfurt, Germany).
• Vercel — website hosting and cookieless page-view analytics (United States and global edge network).
• Stripe — card payments, bounty pool deposits and hunter payouts (United States).
• Resend — sending account and marketplace emails (United States).
• Google — our company email (Google Workspace), Google Analytics and Google sign-in (United States).
• LinkedIn — LinkedIn sign-in, when you choose it (United States / Ireland).
• Zoom — meeting links, where a meeting is booked through Zoom (United States).
• Slack — internal notifications to our team about new sign-ups (United States).

We will update this list before adding a provider that processes company-provided prospect data.

Our main database is hosted by Supabase in the European Union (Frankfurt, Germany), protected by encryption in transit and at rest and row-level access controls. Bountii is a US company, and some of the providers above process data in the United States. Where personal data from the EU, EEA, UK or Switzerland is transferred outside those areas, we rely on the European Commission's Standard Contractual Clauses (with the UK addendum where it applies) or on the provider's certification under the EU-US Data Privacy Framework.

Access to personal data is limited to the people and systems that need it. If a breach affects your personal data, we will notify you and, where the law requires, the relevant authority without undue delay. Where we process data for a company, we notify that company within 72 hours of becoming aware of the breach.

You can request access to, correction of, or deletion of your personal data at any time by emailing welcome@getbountii.com. If you are in the EU/EEA or the UK, you also have the rights to restrict or object to processing, to data portability, and to lodge a complaint with your supervisory authority. If you are a prospect named by a company, we will pass your request to that company and help it respond.

When this policy changes in substance we update the version and date above and, for material changes, tell account holders by email.

Privacy questions? Email welcome@getbountii.com.