Privacy

Section 01Who decides what happens to this information

This is the most important thing on the page, so it goes first.

The bail bond agency decides

The agency chose to use Bondskeeper, put the information in, and decides what happens to it. In privacy law it is the controller. If you are a defendant or a co-signer and you want something changed, corrected or explained, the agency is who decides, and we will point you to them.

We hold it and act on their instruction

Bondskeeper is the processor. We store the file, run the reminders, send the messages and produce the reports the agency asks for. We do not decide on our own account what happens to a defendant’s record, and we do not use it for our own purposes.

Defendants and co-signers never signed up with us

They signed paperwork with an agency. They did not choose a software vendor and most of them will never hear our name. We treat that as a reason for more care rather than less, because they had no say in it.

One thing we do decide for ourselves: the people who sign up and log in, meaning agency owners and their staff, and anybody who contacts us. For their account information we are the controller, and this policy covers that too.

Section 02What we hold, and why

About a defendant

Name, date of birth, address and contact details, physical description, employer, vehicle, the case and charge information the agency entered or a court record returned, court dates and hearing outcomes, bond amount and status, check-in records, and documents the agency uploaded such as a booking sheet or a signed packet. Some agencies also hold a social security number or a driver’s licence number.

About a co-signer

Name, contact details, address, the relationship to the defendant, what they agreed to pay and their payment history, what they put up as collateral, the receipt for it, their signature on the agreement, and their messaging consent.

About agency staff

Name, work email and phone, role and permissions, sign-in records, and what they did in the software.

From the software itself

Sign-in times, IP address at sign-in, browser and device type, error reports, and the audit trail of who did what and when. We keep this to run the service, to keep accounts secure, and because a regulated product needs to be able to say who looked at what.

The purpose for all of it is the same: to run the agency’s bail bond business. Reminding somebody about court, recording a payment, producing a receipt, filing what a regulator asks for. We do not use any of it for advertising, and we do not sell it to anybody, for any purpose, ever.

Section 03The sensitive fields, and how a read is recorded

Social security number, date of birth and driver’s licence number are treated differently from everything else in the system. They are encrypted in the database, with the key held separately from the data.

Reading one is not a normal database read. Every read goes through a function that writes the log entry first and decrypts second, and that will not run at all without a stated purpose. So for every one of those fields there is a record of who read it, when, and why. If somebody reads a field for a person who is not connected to one of their cases, that shows up.

Section 04Check-ins: location, photographs and liveness

When an agency asks a defendant to check in, the check-in can include a photograph taken at that moment and the device’s location at that moment. Both are recorded against the check-in and both are visible to the agency.

Location

The location is captured at the moment of a check-in, from the device, and only when the person allows it. We do not track anybody continuously. Bondskeeper does not follow a phone around between check-ins, and there is no feature in this product that does.

The photograph and liveness

A check-in photograph is checked for liveness: whether a real person is in front of the camera at that moment rather than a photograph of a photograph. That check produces a yes or a no about the moment. It does not identify anybody.

OPEN FOR COUNSEL · the consent wording, the state gating list and the retention schedule for any biometric feature, before one ships rather than after.

Section 05How long it is kept

Longer than you might expect, and not because we want it.

Case records

Kept for at least three years from the date the liability on that bond ended. Virginia requires a bondsman to hold those records and produce them for inspection. Deleting a case in the software hides it from the working views; it does not destroy the file, and it cannot before that floor passes.

The audit trail

Kept as long as the records it describes. An audit log that can be trimmed is not an audit log.

Messages and their consent records

Kept while they are needed to show what somebody agreed to and what was sent, which in practice tracks the case they belong to.

Agency account and billing records

Kept while the account is open and afterwards for as long as tax and accounting rules require.

Sign-in and security records

Kept for a limited period, long enough to investigate a problem and no longer.

A legal hold, a subpoena or a regulator’s inspection stops any deletion clock until it is lifted.

Section 06Who else sees it

We do not sell personal information and we do not share it for anybody else’s marketing. Information is shared in four situations only.

1. With the agency whose file it is, and only that agency. Agencies cannot see each other’s data. There is no feature in this product that shows one agency anything about another’s cases, and there will not be one.
2. With the companies that run pieces of our service, listed below, under contract and only to do that job.
3. When the law requires it, in the way described in the next section.
4. If Bondskeeper is ever sold or merges, in which case the same commitments follow the data and customers are told before anything moves.

The companies we use

Supabase

Hosts the database and stored files. This is where the records live.

Vercel

Runs and serves the application itself.

Bird

Sends the text messages and emails, and handles inbound replies including stop requests.

Stripe

Bills the agency for its Bondskeeper subscription. Stripe never sees a bail premium payment. See the note below.

Electronic signature provider · not yet selected

Signing a packet is handled inside Bondskeeper today. When we bring in a specialist signature provider, it is named here before it is switched on rather than after.

Payment gateway · none, and not ours

Bail premium is taken by the agency on its own merchant account. We are not the merchant, we do not hold the money and we are not a payment facilitator. When an agency connects its own gateway, that gateway is the agency’s supplier, not ours, and the agency’s own agreement with it governs.

This list is current at the date on this page. It changes when we change a supplier, and the page is updated when it does.

Section 07Law enforcement, subpoenas and court orders

This system holds criminal-justice information about people who are already inside the criminal justice system. Requests for it will come, so here is exactly how one is handled.

1. A person reads every request. Every one. There is no automatic disclosure and no exceptions for urgency.
2. We check that it is valid, that it is properly served, and that it actually covers what it is asking for. We narrow anything broader than it needs to be.
3. We log it: who asked, when, what for, what we decided and what we handed over. That log is reviewed.
4. Where we are allowed to tell the agency whose data it is, we tell them, and we do it before we hand anything over unless we are legally prohibited.
5. If we think a request is invalid, overbroad or wrong, we push back.

OPEN FOR COUNSEL · when we are permitted to notify a customer, what a valid service looks like in each state, and whether a published transparency count belongs on this page.

Section 08If you are a defendant or a co-signer

You did not choose this software, and you may not have heard of us before today. This is what you can do.

Ask your bondsman first, and that is not us passing you along

The agency decides what happens to your file. They put the information in, they are responsible for it, and they can correct it, explain it or act on your request. We hold it for them. If you ask us directly, we will pass your request to the agency and tell you we have done so, and we will help them answer it. What we will not do is change or delete an agency’s record because somebody asked us to, because it is not ours to change.

Stopping messages

Reply STOP to any text and the messages stop. You do not have to explain and nobody has to approve it. If you do that, the agency is told that they have no way to text you, so they will likely call instead.

What we cannot do

If a bond is live or the retention period has not passed, the record cannot be destroyed, and we would rather tell you that plainly than let a request sit unanswered. That is section 6 of the terms and it is the same rule for everybody.

OPEN FOR COUNSEL · which state privacy laws reach this data and what they require of a processor, what a defendant may demand directly from us rather than through the agency, and whether any of those rights survive the retention floor.

Section 09Young people

Bondskeeper is not for children and nobody under eighteen may hold an account.

A defendant on a case can be a minor, though. That is real and we do not pretend otherwise. A juvenile’s record is treated as sensitive, held under the same encryption and access logging as the fields in section 3, and it is never used for anything except running that case. Juvenile court records are restricted in most states, and an agency putting one in here is responsible for having the right to hold it.

OPEN FOR COUNSEL · whether additional handling, consent or retention rules apply to juvenile defendant records, and whether the software should restrict who inside an agency can open one.

Section 10Where the data is

Bondskeeper runs on infrastructure in the United States and the records are stored in the United States. We do not currently offer or intend an arrangement that stores this data outside it.

Some of the companies in section 6 are global businesses with staff in other countries, which can mean support access from outside the United States. If that changes for us in a way that moves where records are stored, this page says so before it happens.

Section 11Keeping it safe

Encryption of the sensitive fields, separation between agencies, access logging and the rest are described on our security page. It claims no certification, because we hold none.

Section 12Reaching us

Write to hello@bondskeeper.com. Say whether you are an agency, a defendant or a co-signer, and a person will read it and answer.

If you are a defendant or a co-signer, tell us the name of the bail bond agency if you know it. It is how we find who holds your file, and we would rather ask than guess at a match.