Privacy Policy

Last Updated: March 18, 2026

Bruce ("bruce.bot") is the intro system of record for licensed professionals. We operate an invite-only, closed network where trust is the foundation of everything we build. This Privacy Policy describes how Tanda Technologies, Inc. ("Bruce," "we," "us," or "our") collects, uses, and protects your information when you use our platform, including our website, AI-powered voice onboarding, and intro tracking tools.

1. Overview

Bruce is an AI-powered intro system of record designed for licensed professionals across four categories:

Real Estate Mortgage Title & Escrow Insurance

Our platform is invite-only and closed by design. Access requires either an invitation from an existing member or a verified professional license. We are privacy-first: your data exists to serve your professional reputation, not to be sold or exploited.

Bruce currently supports residential property transactions only. Eligible property types are: single-family homes, condominiums, multi-family properties (2 to 4 units), investment and rental properties, and residential land. Commercial real estate is not supported and may not be logged as an intro record.

By creating an account or using Bruce, you agree to the terms described in this Privacy Policy. If you do not agree, please do not use our services.

2. Information We Collect

We collect information that you voluntarily provide to us. Bruce does not scrape, crawl, or harvest data from external sources. All information in our system is provided directly by members or generated through interactions on our platform.

Account and Profile Information

  • Full name, email address, and phone number
  • Professional role, specialization, and service areas
  • License information (e.g., NMLS #, NPN #, DRE #, or state-specific license number) for verification purposes
  • Business name, location, and years of experience
  • Profile photo and professional bio

Voice Conversation Data

  • Audio recordings and transcripts from AI-powered voice onboarding sessions
  • Profile details and preferences expressed during voice conversations
  • Follow-up conversation data used to keep your profile current

Intro and Transaction Data

  • Intro logs including who introduced whom, transaction category, and dollar amounts
  • Intro confirmations and dual-approval records
  • Invite records and partner relationship data

Performance Metrics (Optional)

Members may optionally report an additional performance metric on confirmed intros. For example, a measure of how efficiently a deal was handled. This metric is self-reported by the receiving professional and confirmed by the referring professional. It is optional and never required to complete an intro record. Where reported and confirmed, your average performance metric is displayed on your public profile. The specific metric tracked may vary by professional category and may evolve over time as the platform develops.

Usage and Technical Data

  • Device information, browser type, and IP address
  • Pages visited, features used, and interaction timestamps
  • Cookies and similar tracking technologies for session management and analytics

3. How We Use Your Information

We use the information we collect to:

  • Intro Matching: Connect you with complementary professionals in your market based on role, location, specialization, and intro history.
  • Reputation Building: Generate and maintain your public professional profile, including intro statistics and trust indicators.
  • Profile Generation: Use AI to create and update your professional profile from voice conversations, ensuring your profile always reflects your current focus and expertise.
  • Leaderboard Ranking: Calculate and display your position on local and category-specific leaderboards based on intro volume, frequency, and network engagement.
  • Communications: Send intro notifications, profile updates, warmth nudges, and platform announcements.
  • AI Model Improvement: Use anonymized and aggregated data to improve our intro matching algorithms, voice processing, and platform features.
  • License Verification: Validate your professional credentials against public regulatory databases (NMLS, NIPR, DRE, and state-specific licensing authorities).

4. AI and Voice Processing

Bruce uses large language models (LLMs) and voice processing technology to power core platform features. Specifically, AI assists with:

  • Voice Onboarding: Your initial profile is generated through a voice conversation with Bruce's AI. The conversation is recorded, transcribed, and processed to build your professional profile.
  • Profile Updates: Ongoing voice conversations allow you to update your specializations, recent wins, and focus areas without manually editing your profile.
  • Intro Matching: AI analyzes professional attributes to suggest intro partnerships and identify complementary professionals in your network.
  • Identity Matching: Voice biometric data derived from your calls may be retained to verify your identity on future calls.

Biometric Data Notice: Voice recordings processed by Bruce may constitute biometric identifiers under applicable state laws, including the Illinois Biometric Information Privacy Act (BIPA) and the Texas Capture or Use of Biometric Identifier Act (CUBI). By consenting to voice onboarding, you expressly consent to the collection, storage, and use of voice biometric data for identity verification purposes. Bruce does not sell or profit from biometric data. Biometric identifiers are deleted upon account deletion or upon request.

No third-party model training: Bruce does not authorize its voice AI provider (VAPI) or any subprocessor to use your voice recordings or transcripts to train generalized AI models.

Important: Avoid sharing sensitive personal information (Social Security numbers, financial account details, client confidential information) during voice conversations. Voice conversations are processed by third-party AI providers and should be treated accordingly.

Voice recordings are retained for the purpose of profile generation and identity matching. You may request deletion of all voice data and biometric identifiers at any time by contacting support@bruce.bot. Deletions are processed from both Bruce's systems and our voice provider's systems within 30 days.

5. Intro Data

Intro transactions are the core unit of reputation on Bruce. Here is how intro data is handled:

Logging

When an intro results in a closed transaction, either party may log the intro on Bruce. The log captures the intro direction (who sent, who received), the professional category, and the transaction value.

Verification (Dual Approval)

Intro logs require dual approval. Both the sender and receiver must confirm the intro before it is marked as verified and displayed publicly. Unconfirmed intros remain in a pending state and are not reflected in public profiles or leaderboards.

Display

Verified intros contribute to your public GTV total and intro count, and to your leaderboard ranking. Partner identities and the breakdown of where your GTV originates are visible only on your private dashboard.

Value Rounding and Privacy by Design

All transaction values are automatically rounded down to the nearest $100,000 before being stored or displayed. You enter the exact amount, and Bruce applies the rounding. No exact deal value is ever stored in our systems or shown publicly. This is a platform-wide privacy design decision and is not configurable by individual members.

The minimum deal value is $100,000. Intro records for transactions below this threshold cannot be logged.

Only the month and year of a transaction are stored; no exact dates are kept. No free-text notes are accepted. The only descriptive field is a structured property type selection. These design choices collectively make it impossible to identify a specific client or transaction from an intro record.

6. Data Protection

Security Measures

We implement industry-standard security measures to protect your data, including:

  • Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
  • Access controls and role-based permissions for internal systems
  • Regular security audits and vulnerability assessments
  • Secure, authenticated API endpoints for all platform interactions

Data Retention

We retain your account and profile data for as long as your account is active. Intro data that has been verified and published to other members' profiles is retained as part of the network's shared trust record, even if you deactivate your account. Voice recordings are retained for platform improvement unless you request deletion.

No Sale of Data

We do not sell, rent, lease, or license your personal data to third parties. We do not share your data with advertisers. Your information is used exclusively to operate and improve Bruce.

Third-Party Services and Subprocessors

Bruce uses the following third-party providers to operate the platform. Bruce is the data controller; each provider acts as a data processor under applicable law and is bound by contractual obligations to protect your data and use it only for the purposes we specify. None of these providers use your data to train their AI models by default.

  • VAPI: Voice AI infrastructure. Processes call audio, transcripts, and voice biometric data. Bruce does not authorize VAPI to use voice data for model training. Voice recordings and biometric identifiers are deleted from VAPI's systems upon a verified deletion request. Privacy policy: vapi.ai/privacy.
  • OpenAI: AI inference for profile generation and intro matching. Data submitted via the API is not used to train OpenAI models. API data logs are automatically deleted within 30 days. Privacy policy: openai.com/policies/privacy-policy.
  • Anthropic: AI inference for profile generation and voice call analysis. API data is not used to train Anthropic models. Inputs and outputs are automatically deleted from Anthropic's systems within 30 days of receipt. Ad hoc deletion of specific API requests within this 30-day window is not technically available; automatic deletion is the primary mechanism. Privacy policy: anthropic.com/privacy.
  • Amazon Web Services (AWS): Cloud infrastructure, storage, and hosting. Customer content is not used for AWS model training and is not shared with model providers. You control storage location, retention, and encryption of your data within AWS. Privacy notice: aws.amazon.com/privacy.

Important note on deletion requests and third-party processors: If you submit a deletion request, Bruce will immediately delete your data from its own systems. For data that passed through OpenAI or Anthropic API calls, automatic deletion occurs within 30 days of the original request. We cannot guarantee instant deletion from these providers' systems within that 30-day window, but no data is retained beyond it. Voice data is deleted from VAPI's systems upon request with no retention.

7. Your Rights

You have the following rights regarding your data on Bruce:

  • Edit Your Profile: You may update your professional information, specializations, and preferences at any time through your dashboard or through a voice conversation with Bruce.
  • Request a Data Copy: You may request a complete copy of the personal data we hold about you in a machine-readable format.
  • Delete Your Account: You may request account deletion. Upon deletion, your profile will be removed from public view. Verified intro records that appear on other members' profiles will be anonymized but not deleted, as they form part of the shared trust record.
  • Opt Out of Communications: You may opt out of non-essential communications (warmth nudges, promotional messages) at any time. Transactional notifications (intro confirmations, security alerts) cannot be opted out of while your account is active.
  • Request Voice Data Deletion: You may request deletion of all voice recordings associated with your account.

To exercise any of these rights, contact us at support@bruce.bot.

8. California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

  • Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of that information, the business purposes for collection, and the categories of third parties with whom we share it.
  • Right to Delete: You may request deletion of your personal information, subject to certain exceptions (e.g., data necessary to complete a transaction or maintain security).
  • Right to Correct: You may request correction of inaccurate personal information.
  • Right to Opt Out of Sale/Sharing: Bruce does not sell or share your personal information for cross-context behavioral advertising. No opt-out is necessary, but you may still submit a request for confirmation.
  • Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To submit a CCPA/CPRA request, contact us at support@bruce.bot with the subject line "California Privacy Request." We will verify your identity before processing your request and respond within 45 days.

9. Account Deletion and Data Retention

When you request account deletion, Bruce processes the following:

  • Voice and call data: All call recordings and voice biometric identifiers are permanently deleted from Bruce's systems and from our voice provider (VAPI). No retention.
  • Profile and identity data: Your name, email, phone number, license details, and AI-generated profile summary are permanently deleted.
  • Intro records: Confirmed intro records are anonymized, not deleted. On your partners' private dashboards, your name is replaced with "user removed." The transaction fact, contribution to their reputation score, and confirmation status remain intact. Your own reputation score is removed with your account.

The rationale: a confirmed intro record is co-owned data. When both parties confirm an intro, the partner has independently verified the introduction occurred. Deleting the entire record would destroy the partner's legitimate interest in their own verified professional history based on your unilateral deletion request. Anonymization satisfies your right to erasure while preserving the co-owned record for the remaining party.

This approach is consistent with right-to-erasure obligations under CCPA and GDPR, which require removal of personal identifiers, not destruction of historical transaction facts that belong to both parties.

10. GDPR: EU and EEA Residents

If you are located in the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR):

  • Right of Access: Request a copy of the personal data we hold about you.
  • Right to Rectification: Request correction of inaccurate personal data.
  • Right to Erasure: Request deletion of your personal data, subject to the anonymization approach described in Section 9 for co-owned intro records.
  • Right to Restriction: Request that we restrict processing of your data in certain circumstances.
  • Right to Data Portability: Request your data in a structured, machine-readable format.
  • Right to Object: Object to processing of your data for certain purposes including direct marketing.
  • Right to Withdraw Consent: Where processing is based on consent (e.g., voice biometric collection), you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any GDPR rights, contact us at support@bruce.bot. We will respond within 30 days. If you believe we have not handled your data lawfully, you have the right to lodge a complaint with your local supervisory authority.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you by email or through a prominent notice on the platform prior to the changes taking effect.

We encourage you to review this Privacy Policy periodically. Your continued use of Bruce after changes are posted constitutes your acceptance of the updated policy.

12. Contact

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us: