Privacy Policy

Bonafi B.V. (“Bonafi”, “we”, “us”) operates the Bonafi platform and the website bonafi.ai. Bonafi is a software provider for wealth insight and administration. We are registered in the Netherlands.

• Bonafi B.V., Veerkade 1, Rotterdam, the Netherlands
• Chamber of Commerce (KvK): 42048729
• Contact: info@bonafi.ai

Bonafi B.V. is the data controller for personal data processed through this website and for our own business operations. Where clients use the Bonafi platform to process data about their own clients or family members, Bonafi acts as a data processor on the client’s behalf, under a separate data processing agreement.

Depending on how you interact with us, we may process:

• Contact data: name, email address, phone number and organisation, when you contact us, request a demo or subscribe to updates.
• Account data: name, business email address and login details, when you or your organisation use the Bonafi platform.
• Platform content: documents and financial information that you or your organisation upload to the platform. We process this content only to provide the service.
• Technical data: IP address, browser type and usage information generated when you visit our website or use the platform, used for security, troubleshooting and improving our services.

We do not collect more data than we need, and we do not sell personal data to anyone.

We process personal data to:

• provide and maintain the Bonafi platform (performance of a contract);
• respond to enquiries and demo requests (legitimate interest or pre-contractual steps);
• secure our systems, prevent abuse and meet our legal obligations (legal obligation and legitimate interest);
• send occasional updates you have subscribed to; you can unsubscribe at any time (consent).

This website sets no cookies. Not for analytics, not for anything else.

We use Leadinfo to recognise the organisation behind a visitor’s IP address, by matching it against publicly available business data. That tells us which organisations are interested in Bonafi, so we can follow up. It runs cookie-less: no cookie, no recording of your session, no tracking of what you type. It recognises organisations, not people. We do not use it to identify you personally or to build a profile of you.

• Data: your IP address, the pages you view, and the time and duration of your visit.
• Legal basis: our legitimate interest in knowing which organisations consider our product (Article 6(1)(f) GDPR). We have weighed that against your privacy: no cookie is placed, no individual is identified, and you can stop it in one click.
• Processor: Leadinfo B.V., a Dutch company (Capelle aan den IJssel), acting only on our instructions under a data processing agreement. It processes this data on servers in the European Union (AWS, Ireland). Its own privacy statement is at leadinfo.com/en/legal/privacy.
• Retention: your IP address is matched to an organisation immediately and is not shown to us or stored in our dashboard. Leadinfo deletes collected IP addresses after that matching; it publishes no fixed retention period. We keep no separate copy of visit data.
• Your right to object: choose Tracking at the bottom of any page and select “Don’t track me”. Leadinfo then stops loading on this device. You can also email info@bonafi.ai.

Your objection is remembered in your browser’s local storage, not in a cookie, and never leaves your device.

If you ask for a place on the waitlist, we process what you enter: your name, your email address, your country, and your phone number if you choose to give it; that field is optional. If you subscribe to updates, we process only your email address.

Providing this data is entirely voluntary. You are never required by law or by any contract to fill in these forms. The only consequence of leaving a required field empty is that we cannot place you on the waitlist or send you updates.

• Purpose: to contact you about a place on the platform, or to send you the updates you asked for.
• Legal basis: your consent, given with the tick box on the waitlist form or by submitting the update form. You can withdraw it at any time.
• No database: we do not store these entries in a system. Your details go straight into a notification email to us and live only in our mailbox. That is a deliberate choice: what we do not keep cannot leak.
• Processor: Resend (Plus Five Five, Inc., United States) delivers that notification email for us, under a data processing agreement. Section 7 explains how that transfer is protected.
• Retention: we keep waitlist emails until your signup has been handled, and at most 24 months after our last contact with you. Update subscriptions we keep until you unsubscribe.
• Deletion and unsubscribing: email info@bonafi.ai and we remove your details or stop the updates. You can ask at any time, and you do not need to give a reason.

Bonafi uses AI to read and structure documents. Your data is not used to train AI models. We have no-training commitments in place with every AI provider we use, and all AI processing takes place within the European Union.

The platform: Bonafi runs its application infrastructure and its AI on Google Cloud in Eemshaven, the Netherlands (region europe-west4). Your documents are read there, not sent elsewhere. Client data processed on the platform stays within the European Union.

This website: the website is a separate, simpler system, and we want to be precise about it. These are the providers that touch website data:

• Vercel(Vercel Inc., United States) hosts bonafi.ai. The code that handles the waitlist and update forms runs in Vercel’s Frankfurt region, in the EU. Static pages are served from Vercel’s worldwide network. Technical request data, such as IP addresses in server logs, is processed by Vercel primarily in the United States, in part as a separate controller for its own security and operations; Vercel’s own EU-US Data Privacy Framework certification covers that processing too.
• Resend (Plus Five Five, Inc., United States) delivers our form notification emails. Resend stores email metadata and delivery logs in the United States.
• Google Workspace (Google) hosts the Bonafi mailbox where those notification emails arrive.
• Leadinfo (Leadinfo B.V., the Netherlands) processes visit data on servers in the European Union (AWS, Ireland). Section 4 describes exactly what it does.

Where a provider is based in the United States, two safeguards apply: Vercel, Resend and Google are each certified under the EU-US Data Privacy Framework, and their data processing terms incorporate the European Commission’s Standard Contractual Clauses. You can request a copy of, or more information about, these safeguards via info@bonafi.ai. We transfer personal data outside the EU/EEA on no other basis. The full list of our service providers is published in our Trust Center.

“No longer than necessary” is what every policy says. Here is what it means in practice, per category:

• Waitlist signups: until your signup has been handled, and at most 24 months after our last contact with you. If you become a client, your details move into the client relationship instead.
• Update subscriptions: until you unsubscribe; we then delete your address.
• Enquiries: emails you send us are kept as long as needed to answer you, and at most 24 months after our last contact, unless a client relationship follows.
• Visitor identification: we keep no copy of Leadinfo visit data ourselves; Leadinfo deletes collected IP addresses after matching them to an organisation, as described in section 4.
• Website logs: Vercel keeps technical logs of website requests for a short window, at most 30 days; we do not maintain a separate log archive.
• Platform content: retained for as long as the client agreement runs; on termination, it is returned or deleted in line with that agreement.
• Legal retention: records we must keep by law, such as financial administration, are kept for the statutory period (in the Netherlands generally seven years) and then deleted.

We protect personal data with technical and organisational measures, including encryption in transit and at rest, role-based access controls and continuous monitoring. Bonafi is ISO/IEC 27001:2022 certified, including the ISO/IEC 27017 and ISO/IEC 27018 extensions, audited by Prescient Security with zero non-conformities; you can follow our controls in our Trust Center.

Under the General Data Protection Regulation (GDPR) you have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to processing, and to withdraw consent at any time. To exercise any of these rights, email info@bonafi.ai. We respond within one month.

Exercising your rights is free of charge. If we cannot tell from your request who you are, we may ask you to verify your identity first; we never ask for more than we need for that. Withdrawing consent does not affect the lawfulness of anything processed before the withdrawal. And if you object to the use of your data for direct marketing, we always stop; no balancing test applies.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

Our website and platform are aimed at professionals and adults. We do not knowingly collect personal data from anyone under 16. If you believe a minor has given us personal data, email info@bonafi.ai and we will delete it.

We may update this policy from time to time. The latest version is always available on this page, with the date of the last update shown at the top.

Questions about this policy or about how we handle your data? Contact us at info@bonafi.ai.