Privacy Policy

Effective: September 30, 2026 · Version 2026-09-30-v2

Byndro is operated by Noah Graff trading as Byndro, an individual business in the United Kingdom. Business contact address: Ridgemead Road, Englefield Green, TW20 0YD, United Kingdom. This policy explains how Byndro collects and uses personal information in the marketplace, verification, support, and Client Influx services. Contact support@kraitos.app for privacy questions or requests.

This policy describes data handling; it does not promise a particular number of leads, sales or other business results. The Terms of Service describe what a plan provides, and the cancellation and refund policy explains billing rights. You can save this version of the Privacy Policy.

Who controls the information

Noah Graff trading as Byndro controls account, marketplace, security, verification, support, and service-operation information. A user operating Client Influx determines which lawful markets, sources, and recipients to research or contact and is responsible for their own role as a controller or business under applicable privacy and marketing laws. Byndro processes that tenant's Client Influx records to provide the service and separately uses limited operational data for security and reliability.

Information we collect

• Account and profile: name, email, role, authentication provider, phone verification status, onboarding answers, availability, languages, capabilities, proof links, and profile choices.
• Marketplace activity: project briefs, privacy selections, offers, milestones, conversations, files, reviews, reports, disputes, system-access grants, notifications, and fee records.
• Subscription billing: billing name and address supplied to Stripe, plan and payment status, Stripe billing references, dated subscription-consent records, cancellation and refund requests, one-time retention offers and their acceptance, and subsequent paid invoice totals. These records support billing, prevent repeated discounts, and help us evaluate subscription offers. We do not store card numbers.
• Verification: phone and email status, Didit session references and results, identity-match fingerprints, public proof, reviewer notes, and audit history. Byndro does not intentionally store raw identity documents returned by Didit. Didit separately processes the documents and, where used by the verification flow, facial/liveness information under its provider notice; deleting local account references does not itself erase provider-held verification records. Contact support for a provider erasure request.
• Security and support: revocable session identifiers, hashed network identifiers, device/browser information, authentication events, support conversations, and administrative actions.
• Client Influx: encrypted tenant API and mailbox credentials, search configuration, public-source candidates, evidence, contact details, qualification decisions, suppression records, outreach status, and conversion outcomes.

Sources

Information comes from users, Firebase/Google authentication, Firebase phone verification, Didit identity checks, marketplace participants, support staff, and public or user-configured Client Influx sources such as Overture Maps, Google Places, Exa, Jina, Reddit where separately approved, public websites, and OpenStreetMap. Client Influx users must follow each source's terms and must not use gated or unlawfully obtained data.

Purposes and legal bases

• Perform our contract: create accounts, show profiles, manage projects and offers, provide messaging, verification, support, Client Influx, and account controls.
• Legitimate interests: prevent abuse, secure accounts, maintain audit trails, improve reliability, match projects, and operate a trustworthy marketplace, balanced against individual rights.
• Consent: where required for optional communications, source integrations, or marketing activity. Consent may be withdrawn without affecting earlier lawful processing.
• Legal obligations and claims: accounting, fraud response, regulatory requests, disputes, and enforcement of agreements.

Subscribers can access and export the business research results produced for their workspace. Those results may contain personal information, such as a named business contact or a sole trader’s details. Public availability does not remove privacy rights. We do not use identity-verification information for advertising, and we do not give one tenant access to another tenant’s private credentials or workspace.

Sharing and service providers

Information is shared only as needed with the relevant client, builder, administrator, or service provider. Current or optional providers may include VPS and database hosting, Firebase and Google authentication/phone services, Didit, SMTP/mailbox providers, OpenAI or NVIDIA model APIs used for included AI or selected by the user, Overture Maps, Google Places, Exa, Jina, Reddit, OpenStreetMap, and Stripe for subscription payment, billing management, receipts and fraud prevention. AI services may receive relevant search instructions and public-source evidence used to research and qualify a lead. Only send data you are permitted to provide. Providers may process information outside your country. Where transfer safeguards or processing agreements are required, they must cover the relevant processing; contact support for information about a particular integration. Our service-provider notice explains the main services and their purposes.

Public and private visibility

The public idea request form collects your idea, contact email, and any optional name or request type you provide. No account is required. These tickets and internal review notes are available only to Byndro administrators and are used to review and respond to your request. They are not posted in the request forum or shown to builders. To request access, correction, or deletion, contact support@kraitos.app with your ticket number.

Verified builders who enable a public profile may expose selected professional information and proof links. Project visibility follows the chosen project privacy level and server-enforced detail grants. Email, phone, identity documents, private details, and tenant API credentials are not public profile fields. Users should not place secrets or unnecessary personal data in public text.

Automated processing

Byndro uses deterministic project matching and AI-assisted Client Influx search and lead qualification. Matching explanations and lead evidence are shown to users, but may be incomplete, outdated or incorrect. Lead scores and labels are research aids, not a determination that a person has consented to marketing or is ready to buy. These research tools are not intended to make legal, employment, credit or similarly significant decisions about individuals. Verification also uses provider results and automated eligibility or duplicate checks; contact support to request review of a verification decision.

Retention and deletion

• Login sessions expire after seven days at most and after 24 hours of inactivity; OAuth handoffs expire after two minutes.
• Account, project, message, verification, and Client Influx records are kept while the service is used and afterward only where needed for security, disputes, legal duties, suppression, or legitimate business records.
• Deletion requests immediately restrict account use. After review, direct identifiers, profile text, user-authored messages, uploads, tenant credentials, and tenant Client Influx data are deleted or anonymized. Records required for fraud, disputes, fees, taxes, or legal claims may be retained with access limited.
• Protected backups use a rotation of 7 daily, 4 weekly and 6 monthly snapshots; deleted information may remain in those backups until rotation removes it. A separately retained disaster-recovery or legal-hold archive may require specific review. Backups are not used to reactivate deleted accounts, and deletion decisions must be reapplied after restoration.

Your choices and rights

The account Settings page lets users download their data, manage active sessions, and request access, correction, restriction, objection, or deletion. Requests can also be sent to support@kraitos.app. We may verify identity and may retain information where law permits or requires. People covered by the GDPR may also withdraw consent, request portability, and complain to their supervisory authority. People in the UK may complain to the Information Commissioner’s Office. People in Israel may exercise applicable access and correction rights and contact the Israeli Privacy Protection Authority. We handle requests within applicable statutory deadlines, ordinarily one month under UK/EU data protection law, subject to lawful extensions and identity verification. A lead subject does not need a Byndro account to contact us.

Commercial outreach and public leads

A public email address is not by itself consent to receive advertising. Client Influx users must establish a lawful basis and obtain any consent required by the recipient's location before sending. Client Influx keeps bounce, opt-out and suppression records for its outreach checks. These checks do not determine every recipient's legal status or control messages sent outside Byndro; users must honor objections and opt-outs in their own records and other tools too. To object to lead processing or Byndro-assisted outreach, email support@kraitos.app; include the address or business record concerned. We will review and act on the request in accordance with applicable data-protection and marketing law.

Billing requests

The cancellation form accepts your name, account email, request type, optional subscription reference and message. We use these to identify your contract, record your notice, verify ownership and handle cancellation, withdrawal, refunds or complaints. Requests are private to you and authorized support staff. Submitting a form does not give someone access to the named account or automatically cancel another person’s subscription.

Security and incidents

Byndro uses encrypted transport, host-only secure cookies, revocable sessions, administrator MFA, request-origin checks, encrypted tenant credentials, private database binding, and access controls. No system is perfectly secure. Suspected incidents should be reported promptly to support@kraitos.app. Byndro will investigate and notify affected people and regulators where required.

Children and changes

Byndro is for people aged 18 or older and is not directed to children. Material policy changes will be dated and users will be asked to review the new version before continuing to use account features that require acceptance. Cancellation, withdrawal and privacy requests remain available without accepting new terms. Acknowledging this policy is not consent to optional marketing or a waiver of data-protection rights.