Privacy policy.

Bob collects two categories of personal information. Operational — names, email addresses, phone numbers and customer correspondence that brokerages enter into the dashboard or that customers send to the portal. Telemetry — page views, click events, and performance metrics on bob.so and the app, kept for 90 days for product improvement.

Operational data is used solely to run the brokerage’s tenant. Bob does not train shared models on tenant data; every model used is either an external API (with no persistence) or a per-tenant fine-tune kept inside the tenant’s row-level boundary. Telemetry is anonymised before any internal review.

We share data with three classes of subprocessor: infrastructure (Supabase, Cloudflare, AWS for redundancy), AI models (OpenAI, Anthropic via API, no persistence), and voice (Twilio + Eleven Labs, both bound by DPAs). Full list at /legal/dpa. We never sell personal data and we never share it for advertising.

Audit ledger retention is configurable per tenant: 13 months by default, up to 7 years on Enterprise. Operational data (customers, policies, conversations) stays until the tenant deletes it or terminates the agreement. Telemetry: 90 days. Deletion is cryptographic — the rows are anchored to the hash chain at deletion so the deletion is itself auditable.

Under the NZ Privacy Act and GDPR, you can request a copy of your data, correct it, ask us to delete it, or restrict our use of it. Brokerage tenants get those rights for their own operational data; their customers should contact the brokerage first. For data Bob holds about you directly, email [email protected].

Privacy questions: [email protected]. Data Protection Officer: Anita Marlow. Postal: Thinkspace, 30 Pollen Street, Grey Lynn, Auckland, New Zealand.