Privacy & Security at bondu

At bondu, Trust Comes First.

bondu is designed for children and their families and we take our responsibility to protect privacy, safety, and security seriously. This page explains clearly and simply how we think about privacy and security, what data we collect, how we protect it, and the controls available to parents and caregivers.

This page is meant to be human‑readable. For full legal details, please review our Privacy Policy and Terms of Service.

Our Privacy & Safety Principles

We design bondu around the following core principles:

Privacy‑by‑design	We build privacy and security into our product from the start, not as an afterthought.
Data minimization	We only collect data that is necessary to operate and improve bondu.
Parent control	Parents and caregivers remain in control of their child’s experience and data.
Security‑first engineering	We use industry‑standard security practices to protect data across devices, apps, and systems.
Transparency	We aim to be clear about what we do and why.

What We Collect & Why

What Data We Collect

bondu collects limited data to provide its core functionality and support families. We do not sell personal data.

Depending on how you use bondu, this may include:

Information You Provide

Account information (such as parent email address)
Purchase and subscription information
Parent‑submitted information about a child (for personalization, when enabled)
Customer support communications

Device & Usage Information

Device identifiers and basic diagnostic information
Interaction metadata (for example, feature usage and performance)
App and firmware version information

Voice & AI Interactions

Voice is processed to power conversations. See our privacy policy for how voice data is handled and protected.
Parents can review and delete their child's conversations in the bondu for parents app.

Children’s Privacy

bondu is built specifically for children and families.

We follow applicable children’s privacy laws, including COPPA where relevant.
Children do not create accounts on their own—accounts are managed by parents or legal guardians.
We limit data collection for children to what is necessary to provide the experience.
Parents can request access to, correction of, or deletion of their child’s data.

How We Use Data

We use data to:

Operate and maintain bondu’s core features
Personalize experiences when parents choose to enable personalization
Improve product performance, reliability, and safety
Provide customer support
Meet legal and regulatory obligations

We do not use children’s data for targeted advertising.

Trust & Safety in Every Detail

bondu is a member of the kidSAFE Seal Program. To learn more, click on the seal or go to www.kidsafeseal.com

How We Protect & Empower Families

How We Protect Your Data

We use multiple layers of technical and organizational safeguards, including:

Technical Safeguards

Encryption in transit and at rest
Secure cloud infrastructure with restricted access controls
Regular vulnerability scanning and penetration testing
Secure firmware and software development practices

Organizational Safeguards

Access to systems limited to authorized personnel
Internal security training and policies
Incident response and breach‑response procedures

IoT & Device Security

Secure device provisioning and authentication
Protection against unauthorized access to devices
Monitoring for abnormal behavior or misuse

AI Safety & Responsible Use

bondu uses AI to support creativity, learning, and interaction.

Our approach includes:

Clear boundaries on how AI is used in child experiences
Safeguards to reduce harmful, inappropriate, or unsafe outputs
Human‑designed prompts and controls
Ongoing testing and review of AI behavior

AI systems are designed to support, not replace, parental judgment.

Your Choices & Controls

Parents and caregivers have meaningful control over data and settings.

You may:

Access and update account information
Request deletion of your account or your child’s data
Control personalization features
Contact us with privacy or security questions

Instructions for exercising these rights are available in our Privacy Policy or by contacting us directly.

Compliance & Standards

bondu aligns its practices with applicable privacy and security laws and frameworks, including:

Children’s privacy regulations (such as COPPA)
State privacy laws where applicable (such as CCPA/CPRA)
Industry best practices for IoT and cloud security

We also work with independent third‑party security and compliance partners to assess and strengthen our security posture.

Vulnerability Reporting

Bondu accepts good-faith security and AI safety research on the systems listed in its Vulnerability Disclosure and Research Safe Harbor Policy.

The systems that may be tested are the bondu for parents app, two API path prefixes on api.bondu.com, the Bondu conversation, and Bondu toys you own. The policy gives the exact limits for each. Nothing else may be actively tested. If you are unsure whether something is allowed, ask first.

If you believe you have found a vulnerability, or a repeatable safety or privacy problem, in an in-scope Bondu product, report it through one of these two channels:

Bugcrowd program: https://bugcrowd.com/engagements/bondu-vdpc
Security email: security@bondu.com

These are Bondu's only official reporting channels. Bondu does not run a program on any other vulnerability-disclosure platform.

Read the policy before testing. It lists the systems that may be tested, Bondu's legal commitments to researchers, the rule to use made-up child and family data only, what to do if you see real customer data by accident, and how disclosure is timed.

Do not put raw child or customer data, or live credentials, in an email or an attachment. Send a redacted report first. If raw evidence is needed, Bondu will tell you in writing and explain how to send it. Reports that involve real child or family data are acknowledged within 24 hours, including weekends and holidays.

If neither channel is available, email support@bondu.com with the subject "Security report routing request" and a short, non-sensitive summary.

Last updated: Mar 3, 2026