Last Updated: January 1, 2025 · Effective Date: January 1, 2025 · BondInvestment Bank N.A. Charter No. 24817-B
Summary: We collect only the information necessary to provide banking services and comply with federal regulations. We do not sell your data. We use industry-standard encryption to protect everything we store.
1. Information We Collect
1.1 Information You Provide
When you open an account, apply for a loan, or contact us, we collect:
- Identity information: full name, date of birth, government-issued ID details
- Contact information: email address, phone number, mailing address
- Financial information: income, employment status, account balances, transaction history
- Authentication credentials: username, encrypted password, security questions
- KYC documents: identity document photographs, selfie images
- Communications: messages, support tickets, loan application notes
1.2 Information Collected Automatically
When you use our platform, we automatically collect:
- Device and browser information (type, operating system, browser version)
- IP address and approximate geographic location
- Pages visited, features used, and session duration
- Transaction metadata (timestamps, IP addresses, device fingerprints)
2. How We Use Your Information
We use your information for the following purposes:
- Account management: Opening, verifying, and maintaining your account
- Transaction processing: Executing and recording transfers, deposits, and payments
- Regulatory compliance: Meeting Bank Secrecy Act, AML, KYC, and FDIC requirements
- Fraud prevention: Detecting and investigating suspicious activity
- Customer support: Responding to queries and resolving disputes
- Service improvement: Analysing usage patterns to improve features and performance
- Legal obligations: Complying with court orders, subpoenas, and regulatory requests
We do not use your information for targeted advertising or sell it to third-party marketers.
3. Information Sharing and Disclosure
We share your information only in the following circumstances:
- Service providers: Third-party vendors who assist in operating our platform (e.g., email delivery, cloud hosting) under strict data processing agreements
- Financial partners: Correspondent banks and payment networks necessary to execute your transfers (SWIFT, ACH network)
- Regulatory authorities: Federal Reserve, FDIC, OCC, FinCEN, and law enforcement as required by law
- Legal process: In response to valid court orders, subpoenas, or government requests
- Business transfers: In the event of a merger, acquisition, or sale of assets, subject to equivalent privacy protections
We will never sell, rent, or trade your personal information to any third party for commercial or marketing purposes.
4. Data Security
We implement comprehensive security measures including:
- 256-bit AES encryption for all data at rest and in transit (TLS 1.3)
- Bcrypt password hashing with a minimum cost factor of 12
- OTP-based transaction authorization requiring staff verification
- Regular penetration testing and security audits by independent third parties
- Strict access controls — staff access customer data only on a need-to-know basis
- 24/7 automated anomaly detection and fraud monitoring
While we implement the highest industry standards, no digital system can guarantee absolute security. We encourage you to use a strong, unique password and never share your credentials with anyone.
5. Data Retention
We retain your information for the following periods:
- Active account data: For the lifetime of your account plus 7 years after closure (required by federal banking regulations)
- Transaction records: 7 years minimum (BSA requirement)
- KYC documents: 5 years after account closure
- Support communications: 3 years
- Marketing preferences: Until you withdraw consent
6. Your Rights and Choices
Subject to applicable law, you have the right to:
- Access: Request a copy of the personal data we hold about you
- Correction: Request correction of inaccurate or incomplete data
- Deletion: Request deletion of your data (subject to regulatory retention requirements)
- Portability: Receive your data in a structured, machine-readable format
- Opt-out: Unsubscribe from non-essential communications at any time
To exercise any of these rights, contact our Privacy Officer at privacy@bondinvestmentbank.com. We will respond within 30 days.
7. Cookies and Tracking Technologies
We use essential cookies to operate our platform (session management, CSRF protection). We do not use advertising or tracking cookies. You can disable cookies in your browser settings, though this may affect platform functionality.
8. Children's Privacy
Our services are not directed at individuals under 18 years of age. We do not knowingly collect personal information from minors. If we discover that we have collected information from a minor, we will delete it promptly. Contact us if you believe a minor's information has been submitted.
9. International Data Transfers
BondInvestment is headquartered in the United States. If you access our services from outside the US, your information may be transferred to and processed in the US. We ensure all international transfers comply with applicable data protection laws and use standard contractual clauses where required.
10. Changes to This Policy
We may update this Privacy Policy periodically to reflect changes in our practices or applicable law. We will notify you of material changes by email and by posting a notice on our platform at least 30 days before the changes take effect. Your continued use of our services after the effective date constitutes acceptance of the updated policy.