Privacy Policy

Last Updated: June 1, 2026

Bruce ("bruce.bot") is a done-for-you client relationship and reviews engine for licensed professionals. With your authorization, Bruce stays in touch with your past clients in your name, sending genuinely useful local heads-up, and invites those clients to leave a review. This Privacy Policy describes how Tanda Technologies, Inc. ("Bruce," "we," "us," or "our") collects, uses, and protects your information when you use our platform, including our website, AI-powered voice onboarding, outbound client outreach, and review tools.

1. Overview

Bruce is an AI-powered relationship and reviews engine designed for licensed professionals across three categories:

Real Estate Mortgage Insurance

We are privacy-first: your data, and the data you entrust to us about your clients, exists to serve your professional relationships and reputation, not to be sold or exploited.

This Privacy Policy covers two groups of people. As a member, you provide your account, license, and voice data and authorize Bruce to contact your clients on your behalf. As a client contact of a member, your information is provided to Bruce by the member, and Bruce contacts you in that member's name. Members are responsible for ensuring they have a relationship with, and the right to contact, the clients they upload.

By creating an account or using Bruce, you agree to the terms described in this Privacy Policy. If you do not agree, please do not use our services.

2. Information We Collect

We collect information that you voluntarily provide to us. Bruce does not scrape, crawl, or harvest data from external sources. All information in our system is provided directly by members or generated through interactions on our platform.

Account and Profile Information

  • Full name, email address, and phone number
  • Professional role, specialization, and service areas
  • License information (e.g., NMLS #, NPN #, DRE #, or state-specific license number) for verification purposes
  • Business name, location, and years of experience
  • Profile photo and professional bio

Voice Conversation Data

  • Audio recordings and transcripts from your AI-powered onboarding voice call
  • Profile details, story, and preferences expressed during the call
  • Follow-up conversation data used to keep your profile and voice current

Client Contact Data You Upload

To run outreach on your behalf, you upload a list of your past clients. For each client this may include:

  • Full name
  • Phone number and email address
  • Mailing or property address
  • Sold or closing date and similar relationship details

You provide this information about your clients directly. By uploading it, you confirm you have an existing relationship with these clients and the right to share their contact details with us so we can contact them in your name.

Outreach and Review Data

  • Messages Bruce sends to your clients in your name, by SMS and email, and their responses
  • Delivery, engagement, and opt-out status for those messages
  • Your connected Google Business Profile and the access it grants Bruce
  • Reviews captured through Bruce or posted to your Google Business Profile

Usage and Technical Data

  • Device information, browser type, and IP address
  • Pages visited, features used, and interaction timestamps
  • Cookies and similar tracking technologies for session management and analytics

3. How We Use Your Information

We use the information we collect to:

  • Client Outreach on Your Behalf: Use the client contacts you upload to send useful, local heads-up and review invitations by SMS and email in your name, on the cadence and within the boundaries you authorize.
  • Reviews: Invite your clients to leave a review, capture reviews, and connect to your Google Business Profile to help post and track those reviews.
  • Reputation Building: Generate and maintain your public professional profile, including your captured reviews.
  • Profile and Voice Generation: Use AI to create and update your professional profile from your onboarding voice call, and to learn your voice so outreach sounds like you.
  • Communications to You: Send notifications about client responses, posted reviews, profile updates, and platform announcements.
  • AI Model Improvement: Use anonymized and aggregated data to improve our outreach, voice processing, and platform features.
  • License Verification: Validate your professional credentials against public regulatory databases (NMLS, NIPR, DRE, and state-specific licensing authorities).

4. AI and Voice Processing

Bruce uses large language models (LLMs) and voice processing technology to power core platform features. Specifically, AI assists with:

  • Voice Onboarding: Your initial profile is generated through a voice call with Bruce's AI. The call is recorded, transcribed, and processed to build your professional profile and to learn your voice.
  • Profile Updates: Ongoing voice conversations allow you to update your specializations, recent wins, and focus areas without manually editing your profile.
  • Outreach Drafting: AI uses your profile and voice to draft the messages Bruce sends to your clients in your name.
  • Identity Matching: Voice biometric data derived from your calls may be retained to verify your identity on future calls.

Biometric Data Notice: Voice recordings processed by Bruce may constitute biometric identifiers under applicable state laws, including the Illinois Biometric Information Privacy Act (BIPA) and the Texas Capture or Use of Biometric Identifier Act (CUBI). By consenting to voice onboarding, you expressly consent to the collection, storage, and use of voice biometric data for identity verification purposes. Bruce does not sell or profit from biometric data. Biometric identifiers are deleted upon account deletion or upon request.

No third-party model training: Bruce does not authorize its voice AI provider (VAPI) or any subprocessor to use your voice recordings or transcripts to train generalized AI models.

Important: Avoid sharing sensitive personal information (Social Security numbers, financial account details, client confidential information) during voice conversations. Voice conversations are processed by third-party AI providers and should be treated accordingly.

Voice recordings are retained for the purpose of profile generation and identity matching. You may request deletion of all voice data and biometric identifiers at any time by contacting support@bruce.bot. Deletions are processed from both Bruce's systems and our voice provider's systems within 30 days.

5. Client Outreach and Reviews

Contacting your past clients in your name, and turning their goodwill into reviews, is the core of what Bruce does. Here is how that data is handled:

Your Authorization

Bruce contacts your clients only after you authorize outreach. You review the first message before it goes out, and you control the cadence. We act on your behalf and in your name; you are responsible for the relationship with each client you upload.

Messages We Send

On your behalf, Bruce sends your clients useful local heads-up and, after a genuine value moment, invitations to leave a review. Messages are sent by SMS and email. Every message includes a way for the client to opt out, and we honor opt-outs promptly and permanently.

Reviews

When a client chooses to leave a review, the review is captured through Bruce and the client may post it to your Google Business Profile from their own account. Bruce does not write or post reviews on a client's behalf. With your one-click connection to your Google Business Profile, Bruce reads your reviews to detect and display new ones.

What We Store

For each client you upload, we store the contact and relationship details you provide (name, phone, email, address, sold or closing date), the messages exchanged in your name, opt-out and engagement status, and any review captured.

6. Data Protection

Security Measures

We implement industry-standard security measures to protect your data, including:

  • Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
  • Access controls and role-based permissions for internal systems
  • Regular security audits and vulnerability assessments
  • Secure, authenticated API endpoints for all platform interactions

Data Retention

We retain your account, profile, and uploaded client data for as long as your account is active so we can continue outreach on your behalf. Captured reviews published to your profile are retained as part of your professional reputation. Reviews you or your clients post to your Google Business Profile are controlled by Google and your client, not by Bruce. Voice recordings are retained for profile and voice generation unless you request deletion.

No Sale of Data

We do not sell, rent, lease, or license your personal data to third parties. We do not share your data with advertisers. Your information is used exclusively to operate and improve Bruce.

Third-Party Services and Subprocessors

Bruce uses the following third-party providers to operate the platform. Bruce is the data controller; each provider acts as a data processor under applicable law and is bound by contractual obligations to protect your data and use it only for the purposes we specify. None of these providers use your data to train their AI models by default.

  • VAPI: Voice AI infrastructure. Processes call audio, transcripts, and voice biometric data. Bruce does not authorize VAPI to use voice data for model training. Voice recordings and biometric identifiers are deleted from VAPI's systems upon a verified deletion request. Privacy policy: vapi.ai/privacy.
  • OpenAI: AI inference for profile generation and outreach drafting. Data submitted via the API is not used to train OpenAI models. API data logs are automatically deleted within 30 days. Privacy policy: openai.com/policies/privacy-policy.
  • Anthropic: AI inference for profile generation and voice call analysis. API data is not used to train Anthropic models. Inputs and outputs are automatically deleted from Anthropic's systems within 30 days of receipt. Ad hoc deletion of specific API requests within this 30-day window is not technically available; automatic deletion is the primary mechanism. Privacy policy: anthropic.com/privacy.
  • Amazon Web Services (AWS): Cloud infrastructure, storage, and hosting. Customer content is not used for AWS model training and is not shared with model providers. You control storage location, retention, and encryption of your data within AWS. Privacy notice: aws.amazon.com/privacy.
  • Messaging providers: Bruce uses third-party SMS and email delivery providers to send outreach to your clients in your name. These providers process recipient names, phone numbers, email addresses, and message content solely to deliver messages and report delivery and opt-out status.
  • Google (Business Profile): When you connect your Google Business Profile, Bruce reads your reviews to detect and display them. Your use of Google services is governed by Google's own terms and privacy policy. Bruce accesses only what you authorize through the connection and does not post reviews on your clients' behalf.

Important note on deletion requests and third-party processors: If you submit a deletion request, Bruce will immediately delete your data from its own systems. For data that passed through OpenAI or Anthropic API calls, automatic deletion occurs within 30 days of the original request. We cannot guarantee instant deletion from these providers' systems within that 30-day window, but no data is retained beyond it. Voice data is deleted from VAPI's systems upon request with no retention.

7. Your Rights

You have the following rights regarding your data on Bruce:

  • Edit Your Profile: You may update your professional information, specializations, and preferences at any time through your dashboard or through a voice conversation with Bruce.
  • Request a Data Copy: You may request a complete copy of the personal data we hold about you in a machine-readable format.
  • Delete Your Account: You may request account deletion. Upon deletion, your profile will be removed from public view and outreach to your clients in your name will stop. Reviews your clients posted to your Google Business Profile remain on Google, as they are controlled by Google and the client who posted them.
  • Opt Out of Communications: You may opt out of non-essential communications (promotional messages) at any time. Transactional notifications (client responses, posted reviews, security alerts) cannot be opted out of while your account is active.
  • Request Voice Data Deletion: You may request deletion of all voice recordings associated with your account.

To exercise any of these rights, contact us at support@bruce.bot.

8. California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

  • Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of that information, the business purposes for collection, and the categories of third parties with whom we share it.
  • Right to Delete: You may request deletion of your personal information, subject to certain exceptions (e.g., data necessary to complete a transaction or maintain security).
  • Right to Correct: You may request correction of inaccurate personal information.
  • Right to Opt Out of Sale/Sharing: Bruce does not sell or share your personal information for cross-context behavioral advertising. No opt-out is necessary, but you may still submit a request for confirmation.
  • Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To submit a CCPA/CPRA request, contact us at support@bruce.bot with the subject line "California Privacy Request." We will verify your identity before processing your request and respond within 45 days.

9. Account Deletion and Data Retention

When you request account deletion, Bruce processes the following:

  • Voice and call data: All call recordings and voice biometric identifiers are permanently deleted from Bruce's systems and from our voice provider (VAPI). No retention.
  • Profile and identity data: Your name, email, phone number, license details, and AI-generated profile summary are permanently deleted.
  • Client contact data: The client list and contact details you uploaded are permanently deleted, and outreach to those clients in your name stops.
  • Reviews on Google: Reviews your clients posted to your Google Business Profile remain on Google. They are controlled by Google and the client who posted them, and are outside Bruce's control. You may manage your Google Business Profile connection at any time through your Google account.

10. GDPR: EU and EEA Residents

If you are located in the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR):

  • Right of Access: Request a copy of the personal data we hold about you.
  • Right to Rectification: Request correction of inaccurate personal data.
  • Right to Erasure: Request deletion of your personal data, subject to the deletion approach described in Section 9. Reviews posted to a Google Business Profile are controlled by Google and the client who posted them and remain outside Bruce's control.
  • Right to Restriction: Request that we restrict processing of your data in certain circumstances.
  • Right to Data Portability: Request your data in a structured, machine-readable format.
  • Right to Object: Object to processing of your data for certain purposes including direct marketing.
  • Right to Withdraw Consent: Where processing is based on consent (e.g., voice biometric collection), you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any GDPR rights, contact us at support@bruce.bot. We will respond within 30 days. If you believe we have not handled your data lawfully, you have the right to lodge a complaint with your local supervisory authority.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you by email or through a prominent notice on the platform prior to the changes taking effect.

We encourage you to review this Privacy Policy periodically. Your continued use of Bruce after changes are posted constitutes your acceptance of the updated policy.

12. Contact

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us: