Privacy Policy

Last updated: 27 August 2026

Who we are

BundyAI ("we", "us") is a web application that helps Australian hospitality and booking teams turn handwritten timesheet photos into structured rows in Google Sheets. This policy explains what information we collect, how we use it, and your choices.

Contact: tomar.nitin@gmail.com

Information we collect

Google account details — when you sign in with Google we receive your name, email address, and profile picture (if provided) via Google's OAuth userinfo endpoint. Your Google email is our customer identifier for credits and support.
Google Sheets / Drive access — with your consent we use the Google Sheets API scope https://www.googleapis.com/auth/spreadsheets to create or update a BundyAI timesheet spreadsheet in your Google account and write approved hours into it.
Timesheet images — photos or images you upload are sent to our servers solely to extract timesheet data (employee name, days, clock-in/out times).
Account / billing metadata — remaining credits, trial status, and related account fields stored so we can enforce free trials and paid top-ups.
Technical data — standard server logs (IP, timestamps, error messages) for security and reliability.

How we use information

Authenticate you and operate the BundyAI product
Read handwritten timesheets and show you a review screen
Write confirmed times into your Google Sheet
Track and deduct credits; process upgrade / top-up requests
Respond to support emails and improve reliability

We do not sell your personal information.

Google user data & Limited Use

BundyAI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We only use Google Sheets data to provide and improve user-facing features of BundyAI that you initiate (creating/updating your timesheet sheet and writing times you confirm).
We do not use Google user data for advertising, or to train generalized AI / ML models.
We do not transfer Google user data to third parties except as needed to operate BundyAI (e.g. hosting), to comply with law, or with your direction.
Human access to Google user data is limited to security, compliance, or support cases where you have requested help and access is reasonably necessary.

AI processing of timesheet images

Uploaded timesheet images are processed by Anthropic's Claude Vision API on our servers to extract structured time data. Images are transmitted for that processing purpose and are not used by us to train models. Do not upload images that contain unnecessary sensitive personal data beyond what is needed for payroll hours.

Storage & retention

Credit balances and account email identifiers are stored in our database (currently Upstash Redis / keyed by email).
Your spreadsheet content remains in your Google Drive / Sheets account under your control.
Timesheet images are processed in memory / short-lived request handling for extraction; we do not operate a long-term image gallery of customer timesheets.
You may request deletion of your BundyAI credit account data by emailing us. Revoking BundyAI's Google access in your Google Account settings stops further Sheets access.

Cookies & local storage

We use browser local storage for preferences (e.g. theme), Google sign-in session tokens needed to call Google APIs, and the ID of your active BundyAI sheet. We do not use third-party advertising cookies.

Security

We use HTTPS, keep the Anthropic API key on the server (not in the browser), and verify Google access tokens before spending credits or processing timesheets. No method of transmission or storage is 100% secure.

Children

BundyAI is intended for business use by adults. We do not knowingly collect data from children under 16.

Changes

We may update this policy from time to time. The "Last updated" date at the top will change when we do. Continued use of BundyAI after changes means you accept the updated policy.

Contact

Privacy questions or deletion requests: tomar.nitin@gmail.com.