Privacy Policy

We collect information you provide directly, such as your name, email address, business name, and payment information when you create an account. We also collect data generated through your use of the Service, including agent configurations, conversation logs (for the purpose of providing the Service), analytics events, and usage metrics. We use cookies and similar technologies to maintain sessions and understand how you use our product.

We use your information to: (a) provide, operate, and improve the Service; (b) send you transactional emails such as billing receipts, password resets, and security alerts; (c) respond to your support requests; (d) detect and prevent fraud and abuse; (e) comply with legal obligations. We do not use your conversation data to train our AI models without your explicit consent.

We do not sell your personal data to third parties. We share data only with: (a) infrastructure providers (e.g. cloud hosting, database services) necessary to operate the Service — all bound by data processing agreements; (b) payment processors for billing; (c) authorities when required by law. Any third party we work with is contractually required to protect your data to at least the same standard as we do.

When your AI agents handle conversations, the message content may be processed by third-party AI model providers (e.g. OpenAI) to generate responses. We configure these integrations to opt out of data training wherever available. Conversation logs are stored on our servers to enable features like conversation history and analytics. You can request deletion of conversation data at any time.

We retain account data for as long as your account is active. After account deletion, we retain data for 30 days to allow recovery, then permanently delete it. Billing records are retained for 7 years as required by financial regulations. Conversation logs are retained for 12 months by default; you can configure a shorter retention period in your account settings.

Depending on your location, you may have rights including: access to your personal data, correction of inaccurate data, deletion of your data ("right to be forgotten"), portability of your data in a machine-readable format, and the right to object to certain processing. To exercise any of these rights, email us at privacy@bunshin.app. We will respond within 30 days.

We implement industry-standard security measures including encryption in transit (TLS 1.2+) and at rest (AES-256), access controls, audit logging, and regular security reviews. API keys and access tokens are hashed before storage. We maintain an incident response process and will notify affected users within 72 hours of discovering a data breach, as required by applicable law.

We use strictly necessary cookies to maintain your login session and prevent CSRF attacks. We use analytics cookies (e.g. Posthog) to understand product usage — you can opt out of these in your account settings. We do not use advertising cookies or sell cookie data to advertising networks.

The Service is not directed to children under 16. We do not knowingly collect personal information from children. If we become aware that a child under 16 has provided us with personal information, we will delete it promptly. If you believe a child has provided us with data, contact us at privacy@bunshin.app.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-app notice at least 14 days before they take effect. The date of the most recent update is shown at the top of this page.

If you have questions about this Privacy Policy or how we handle your data, contact our Data Protection team at privacy@bunshin.app. For urgent security concerns, contact security@bunshin.app.