Privacy
How Bondstone handles information
What we read about businesses, what you give us, who helps us run the service, and how to have any of it stopped or removed.
Written on , changed on . It will be reviewed by counsel, and any change will be dated here.
Who we are
Bondstone is operated by Bondstone Global, ABN 46 950 504 862, of Melbourne, Victoria, Australia, whose UK address is Hollywell House, Hollywell Lane, Leeds LS12 3HP. Its founder, Rudi Myers, is from Leeds. Write to [email protected] about anything on this page.
What we read about businesses
Bondstone works for IT support firms in the United Kingdom. For each city we work in, we read what office businesses publish about themselves:
- their own websites, as any visitor would see them: their home page; up to six more of their own pages to find how to reach them, those the home page links to about contact, about or team, then common addresses such as /contact, /about and /legal; the privacy, terms, cookie and data processing pages the home page links to; their robots.txt, sitemap and llms.txt; and their careers page, the one the home page links to or /careers;
- their DNS records, including those for email authentication (SPF, DMARC, DKIM, MTA-STS, TLS reporting and BIMI), and the certificate their website presents, read with one TLS handshake;
- up to two public job boards their pages link to, and their domain’s public registration record (RDAP);
- the Companies House register, used under the Open Government Licence;
- Overture Maps, used under its open licences, for where a business is.
We never scan or probe a system, log in anywhere or submit a form on anybody's site. Where a business publishes a person's name or work address on its own site or on the register, we may hold it as part of that business's record, for contact between businesses about that business. We do not write to sole traders. We never name a business on a public page: the city reports on this site are counts only. A business is named only in an Evidence Pack, to the one IT firm that pack is made for.
What you give us
When you use the form on this site we keep what you type into it: your name, email address, phone number, website and message. We use it to answer you, to count the businesses around your office, and to record that you asked, so that if your firm is one we had planned to write to, we stop and answer you instead. Cloudflare, which carries this site, tells our server the town your connection comes from so the Data Intelligence page can show the city reports nearest you; we use it for that page only and never store it, unless you ask us for a first look, when we keep the town and the point we drew it around with your request for 90 days.
When the form or the free website audit is used, we keep a one-way hash of the connecting address, salted with a secret, to limit how often one connection can use them. We do not keep the address itself. The hash is stored with an enquiry and with a free audit.
Cookies
One cookie: a session cookie, set only when you sign in to the app, so that it knows it is you. There are no advertising or analytics cookies on this site, and no third-party scripts that could set one.
Who helps us run it
These companies process information for us, each for its own part of the service:
- Railway: hosting the application and its database;
- Cloudflare: DNS, the TLS certificate for this site, and routing email to us;
- Google Workspace: our email;
- Anthropic: AI reading of the public pages of businesses, and of replies to our messages;
- ConnectSafely: our LinkedIn activity;
- Stripe: taking payments;
- Companies House: looking up the public register.
Messages we send, and stopping them
Every message we send is written for one firm and signed by the person it comes from, and a reply to it reaches us. To stop us, reply and say so, or write to [email protected]. We keep a do-not-contact list, and it covers every channel we use: email, phone and LinkedIn. Once a business or a person is on it, we do not contact them again by any of them.
The laws we work to
For the UK businesses we read and write to, the UK GDPR and the Privacy and Electronic Communications Regulations (PECR). In Australia, where we are based, the Privacy Act 1988 (Cth) and the Spam Act 2003. This page says what we do; it is not a claim to have been assessed against any of them.
What you can ask of us
You can ask what we hold about you or your business, ask us to correct it, ask us to delete it, and ask us to stop contacting you. Write to [email protected] and we will answer from a person. We keep an enquiry for as long as we are in touch about it, and delete it when you ask. The do-not-contact list is kept for good, because it is what stops us writing again.
If you are not happy with our answer, you can complain to the Information Commissioner's Office in the United Kingdom or the Office of the Australian Information Commissioner.