Effective Date: August 17, 2026
1. Introduction
Welcome to Bonobee ("Bonobee," "we," "us," or "our"). Bonobee is the discovery, matching, and verification infrastructure for the agentic AI ecosystem. We operate a marketplace connecting AI vendors (including AI agent vendors and infrastructure providers), implementation agencies, and buyers.
This Privacy Policy explains how we collect, use, store, and protect personal information when you visit our website, join our waitlist, use our platform, or engage with our services (collectively, the "Services"). It applies to all users of Bonobee regardless of tier, including waitlist visitors, free buyer accounts, and paid vendor and agency subscribers.
We are committed to handling information responsibly and transparently, in accordance with applicable privacy laws including the General Data Protection Regulation (GDPR), UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), the EU Artificial Intelligence Act (Regulation (EU) 2024/1689), and other relevant regulations.
By using our Services, you agree to the terms of this Privacy Policy. If you do not agree, please discontinue use of the website and Services.
2. Data Controller
Bonobee Inc., a Delaware corporation, with a registered address at 1111B South Governors Avenue, STE 99339, Dover, DE 19904, United States, operating as Bonobee ("Bonobee," "we," "us," or "our").
Contact: hello@bonobee.ai
Website: https://www.bonobee.ai
3. Who Uses Bonobee, and What We Collect From Each
Bonobee serves distinct user types, and what we collect depends on which one applies to you.
A. Waitlist visitors
Name, email address, company name, and role, collected when you join the waitlist. Until official launch, we use this only to notify you of launch and confirm eligibility for the pre-launch offer (six months free from launch date, not from signup date).
B. AI vendors and implementation agencies (paid tiers)
Account information: full name, email address, company name, password, billing details.
Subscription data: plan tier (for example Growth, Scale, or Enterprise for vendors, or Essential, Verified, or Partner Pro for agencies), payment status, renewal preferences, invoices.
Profile and verification data: the business information you submit to build your listing, including framework and vertical tags, compliance and deployment information, and the documentation used to support a Bonobee Verified badge or Verified Program Seal. This is business data about your company and offering, not personal data about you as an individual, except where it identifies you as a point of contact.
Directory Builder data: if you use Directory Builder as a standalone product to publish a partner directory on your own domain, we process the profile and structural data needed to build and host that page.
C. Buyers
At this stage, buyer access is free. We collect the account information needed to create a buyer account (name, email, company) and the usage data generated as you browse, filter, or request an introduction to a vendor or agency. If a paid buyer tier is introduced in future, this policy will be updated before that tier goes live, and this section will describe what added data that tier requires.
D. Information collected automatically
Usage data: IP address, device type, browser, operating system, actions taken on the platform.
Log data: dates, times, and duration of access.
Cookies and analytics: see Section 13.
E. Information from third parties
Payment processors (for example Stripe) for billing confirmation and fraud prevention.
Analytics tools (for example Google Analytics, HubSpot) for website insights.
Partners and APIs for cross-platform integrations or authentication.
4. How We Use Your Information
We use the information we collect for the following purposes.
Account management. We use your information to register, verify, and manage your Bonobee account.
Marketplace matching. We use your information to power the matching engine that connects buyers with vendors and agencies based on framework, vertical, compliance, and other structured criteria you or your company provide.
Verification and scoring. We use submitted documentation and data to assess and display Verified badges, Verified Program Seals, and profile depth scores.
Service delivery. We use your information to provide marketplace listings, Directory Builder, and other platform tools.
Payments and billing. We use your information to process transactions, subscriptions, and invoices for paid tiers.
Customer support. We use your information to resolve issues and communicate service updates.
Marketing and engagement. We use your information to send newsletters, waitlist updates, and partner updates, only with your consent.
Analytics and product improvement. We use your information to evaluate performance and improve the user experience.
Security and compliance. We use your information to detect fraud, enforce our Terms, and comply with the law.
5. Legal Basis for Processing (GDPR)
We process personal data only when a valid legal basis applies:
Contractual necessity, to perform our obligations under your waitlist signup, subscription, or service agreement.
Consent, for optional analytics, cookies, or marketing communications.
Legitimate interest, to improve platform security, matching quality, and usability.
Legal obligation, for tax, accounting, and compliance purposes.
6. Data Retention
Waitlist data: retained until official launch conversion or for up to 12 months after signup if no account is created, whichever is sooner.
Account and billing data: retained while your account is active and for up to 24 months after closure.
Financial and tax records: retained for 7 years.
Communications and logs: retained for 12 months for service optimization.
After the applicable retention period, data is securely deleted or anonymized.
7. Sharing and Disclosure
We do not sell personal data. We share information in the following circumstances.
Payment processors. We share information with payment processors, such as Stripe, for secure payment collection and subscription management.
Hosting and infrastructure. We share information with hosting and infrastructure providers, such as AWS and Vercel, for secure platform hosting.
Analytics providers. We share information with analytics providers for site usage tracking and performance improvement.
Email and CRM platforms. We share information with email and CRM platforms, such as SendGrid and HubSpot, for notifications, onboarding, and marketing.
Matched counterparties. When a buyer requests an introduction, or a matching or verification process connects two parties, we share the relevant profile and contact information with the matched party as part of the core Service. This only happens as a result of an action you or the matched party initiated.
Legal or regulatory authorities. We share information with legal or regulatory authorities when required by law, court order, or government request.
All third parties act as data processors and are bound by confidentiality and security obligations.
8. International Data Transfers
Your data may be transferred to and processed in countries outside your jurisdiction, including the EU, UK, or US. Where data is transferred internationally, Bonobee uses GDPR-approved mechanisms, including Standard Contractual Clauses (SCCs).
9. AI Data Usage, Model Transparency, and EU AI Act Compliance
Bonobee's core Service depends on AI, most directly through the matching engine and the verification and profile depth scoring systems. This section explains what these systems do with data and how we meet our obligations under the EU AI Act, including the Article 50 transparency obligations that took effect on August 2, 2026.
What our AI systems do
The matching engine processes profile and structured criteria data (framework, vertical, compliance, deployment model) to generate ranked recommendations between buyers, vendors, and agencies.
Verification and profile depth scoring evaluate submitted documentation to support Verified badges and Verified Program Seals.
Certain support and profile-summary features may use generative AI to draft or assist with content.
Our role under the AI Act
Bonobee acts as a deployer of the AI systems used in our matching and verification features. Where we use third-party AI models to power these features, the underlying model providers act as providers under the Act, and we deploy those systems within our platform.
Transparency commitments
Where you are interacting with an AI-driven feature, such as the matching engine or an AI-assisted support tool, we disclose that you are interacting with an AI system, in line with Article 50(1), unless this is already obvious from the context.
Where content is AI-generated or AI-assisted, we mark it as such in line with Article 50(2), to the extent technically feasible.
Matching results and verification scores do not produce legal or similarly significant effects on you without the possibility of human review. You can request human review of any automated matching or verification outcome by contacting hello@bonobee.ai.
What AI does not do
It does not use customer-uploaded confidential data to train public AI models.
It does not share or expose private business data to external systems without explicit consent.
Human oversight
AI-driven outcomes on the platform, including matching results and verification decisions, are reviewable and auditable to prevent bias or unintended exposure.
10. Data Processing Addendum (DPA)
For business and enterprise clients, Bonobee provides a Data Processing Addendum governing how we process and safeguard customer data.
Key provisions
Bonobee acts as the Data Processor, the client acts as the Data Controller, for data the client submits about its own end customers or partners.
Data is processed only on documented instructions of the Controller.
Clients may request audit rights and deletion of data upon contract termination.
Breach notifications are provided without undue delay, in accordance with GDPR Article 33.
To request a copy of Bonobee's standard DPA, contact hello@bonobee.ai.
11. Your Privacy Rights
Under GDPR, CCPA, and similar laws, you have the following rights:
Access, obtain a copy of your data.
Rectification, correct inaccuracies.
Erasure, request deletion ("right to be forgotten").
Restriction, limit processing in certain cases.
Portability, receive your data in a machine-readable format.
Objection, opt out of processing based on legitimate interests.
Withdraw consent, revoke consent for marketing or optional analytics.
Requests can be submitted to hello@bonobee.ai. We respond within 30 days of a verified request.
For California residents (CCPA/CPRA)
You may request to know the categories of personal data collected, request deletion, and opt out of the sharing of your data for cross-context behavioral advertising. Bonobee does not sell personal data. To exercise your opt-out right, use the "Do Not Sell or Share My Personal Information" link in the site footer, or contact hello@bonobee.ai. We recognize Global Privacy Control (GPC) signals as a valid opt-out request where technically supported.
12. Cookies and Tracking Technologies
Bonobee uses cookies and similar technologies to operate the platform, analyze usage, and enhance experience.
Essential cookies are required for platform functionality and authentication.
Performance cookies measure site usage and technical performance.
Functional cookies remember your preferences and settings.
Marketing cookies track engagement with marketing campaigns, only with your consent.
You can modify cookie preferences through your browser or Bonobee's Cookie Settings Panel. See our separate Cookie Policy for details.
13. Data Security
Encrypted data transmission via HTTPS/TLS.
Secure servers with access controls and multi-factor authentication.
Continuous monitoring for unauthorized access or vulnerabilities.
Regular security audits and penetration testing.
No system is completely secure. Users share information at their own risk.
14. Children's Privacy
Bonobee is intended for users aged 18 or older. We do not knowingly collect personal data from minors. If we discover such data has been collected inadvertently, it will be promptly deleted.
15. Third-Party Links and Integrations
Our website may link to or integrate with third-party websites, APIs, and partner applications. Bonobee is not responsible for their privacy practices. Review third-party privacy policies before interacting with them.
16. Marketing Communications
Bonobee sends marketing or partner updates only to users who have explicitly opted in. Unsubscribe at any time via the "Unsubscribe" link or by emailing hello@bonobee.ai.
17. Automated Decision-Making and Profiling
Bonobee uses automated processing to power matching recommendations, verification scoring, and profile depth scoring, as described in Section 9.
This processing does not produce legal or similarly significant effects on you without human review being available.
You can request human review of any automated matching or verification outcome by contacting hello@bonobee.ai.
Matching and scoring criteria are based on structured data you or your company submit, such as framework, vertical, and compliance tags, not inferred sensitive characteristics.
18. Data Breach Response
In the event of a data breach, Bonobee will:
Notify affected users and authorities within 72 hours, per the GDPR standard.
Provide information on scope, impact, and mitigation actions.
Cooperate fully with authorities to ensure resolution and prevention.
19. Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect operational, legal, or regulatory changes. The updated version is always posted on this page with the effective date. Material changes may also be communicated by email or in-app notification.
20. Contact Us
Bonobee Inc.
1111B South Governors Avenue, STE 99339
Dover, DE 19904, United States
Email: hello@bonobee.ai
Website: https://www.bonobee.ai
21. Summary of Commitments
Bonobee commits to:
Transparency in all data practices, including how our AI systems are used.
Compliance with GDPR, CCPA, the EU AI Act, and other applicable frameworks.
Secure data processing and ethical AI governance.
Immediate responsiveness to data rights and deletion requests.