Privacy Policy

1. Information We Collect

2. How We Use Your Information

3. Information Processing and Storage

Your data is stored in a Supabase database that we run ourselves. We use OpenAI's GPT service to generate content for your business development packages: the website pages you point Bundly at and the brief you write are sent to OpenAI to build your playbook, and OpenAI processes them in accordance with its privacy practices. Your playbook stays private to your account unless you create a share link.

4. Data Retention, Self-Serve Export, and Account Deletion

You own all content you create with Bundly. You can delete individual generated bundles or export and delete your entire account at any time through Account Settings.

• Self-serve data export (JSON): You can download a complete machine-readable JSON copy of your profile, briefs, generated architectures and playbooks, revisions, and billing history at any time from Account Settings → Download my data (JSON).
• 7-day grace period on deletion: When you request account deletion in Account Settings, your account enters a 7-day grace window during which you can cancel the request at any time (or choose immediate deletion).
• What is permanently deleted: Once deletion executes, we permanently erase your profile, briefs, generated offer architectures and playbooks, conversations, revisions, saved items, active subscriptions, marketing contact records, and feedback submissions from our database and object storage.
• Stripe & accounting retention: Any active Stripe subscription is cancelled and your Stripe customer record is anonymized (name replaced with deleted-user and email cleared). Historical invoices and payment ledger entries are retained for 7 years in our central accounting ledger under a one-way pseudonymous SHA-256 hashed identifier (xt3-tombstone) to satisfy tax and financial reporting obligations, with all personal identifiers removed.

5. Information Sharing

We do not sell, rent, or share your personal information with third parties except as necessary to provide our services:

• Google (for sign-in)
• OpenAI (for content generation)
• Supabase (for data storage and sign-in)
• Stripe (for payments)
• Resend (for sending email)

We count anonymous page views on our public pages with our own self-hosted Umami server. It sets no cookies, sends nothing when your browser asks not to be tracked, and records only the page address without query strings, never account pages or the codes in share links. If you arrive from another website, it keeps only that site's domain, never the page you came from. Google Analytics and Microsoft Clarity load only after you accept analytics in the consent banner; if you choose essential only, neither runs. Our own self-hosted error-reporting server receives crash reports with personal data removed.

6. Security

We implement appropriate technical and organizational measures to protect your personal information:

• Secure authentication through Google or an emailed sign-in link
• Database encryption at rest
• Secure HTTPS connections
• Regular security audits

7. Your Rights

You have the right to:

• Access your personal information
• Delete your account and associated data
• Export your generated content
• Opt-out of marketing communications

8. Updates to Privacy Policy

We may update this privacy policy from time to time. We will notify you of any changes by posting the new privacy policy on this page and updating the effective date.

9. Contact Us

If you have any questions about this privacy policy or our treatment of your personal information, please write to ian at xt3.us or use our contact page.