Privacy Policy

Who is responsible

The controllers are César Arroba, David Martín Bragado, Pedro Miguel Díaz Peña and Pepe Fagoaga, who together operate Bunbird, C/ Menorca 23, Bajo B, 28290 Las Rozas de Madrid, Madrid, Spain. They act as joint controllers: you can exercise your rights against any of them, and support@bunbird.com reaches all of them. For anything about your data, write there.

For the data people enter inside an app, the controller is the organisation that published the app, and Bunbird acts as its processor. See “Data inside apps” below.

What we collect and why

Your account. Your email address, the name you give, whether your address has been confirmed, when the account was created, and how you sign in: a password, stored only as a salted hash (argon2id), or a Google account, of which we keep the stable identifier and the email address Google vouches for. We use this to create and secure your account, to send the emails the service needs (address confirmation, password reset, invitations, welcome) and to tell you about changes to the service or to these documents.

Signing in with Google. When you choose Google, Google tells us your identifier, email address, whether it is verified, your name and your profile picture (scopes: openid, email, profile). We keep the identifier, the email and the name. We do not keep Google’s tokens and we never ask Google anything about you afterwards. Google’s own processing is governed by Google’s privacy policy.

Your organisations and apps. The organisations you belong to and your role in each, the apps and drafts in them, the invitations you send or receive, and the names of any secrets or connections configured for an app (never their values, which are stored encrypted for the organisation).

Your AI assistant’s connection. When you connect an assistant, it registers as an OAuth client and receives tokens to act for you. We keep the client’s name and redirect addresses, a hash of the token it renews its access with (never the token itself), when you allowed it and when it last renewed, and a record of what the assistant did (drafts, builds, publications).

Bunbird does not have access to your conversations with your AI assistant. We do not see your chat history, your other messages, the assistant’s memory, what it does with other services, or the files you share with it unless it sends them to Bunbird as part of your app. Bunbird only receives what your assistant sends when it uses a Bunbird tool to build or change your app, such as the app’s files, its name and description, or the address of someone you asked it to invite, together with the account you are signed in with. That is processed and kept as the rest of this policy says. With each call the assistant may also add a short note on why it is making it and which model it is, and it may report something you asked for that Bunbird cannot do yet. The assistant writes those notes itself, and Bunbird asks it to leave personal data out of them. They go to our product analytics with any email address removed, and are kept for one year like the other analytics events. Your conversation is held by your assistant’s provider, under that provider’s terms and privacy policy.

Server logs. Our servers write technical logs of requests: IP address, time, the address requested, the response code and the browser’s identification string. They go to Google Cloud Logging and are deleted after 7 days.

Product analytics. Our servers send events to PostHog about what happens in the service: an account created, an organisation made, an app published, an invitation taken, a build that failed. Apart from the assistant’s notes described above, events carry your account identifier and never free text you typed. Your profile in PostHog carries your email and name so that events can be matched to an account. We also send error reports, with addresses removed. PostHog is hosted in the EU and is set to discard IP addresses: it uses the address to work out an approximate location (country and city) and does not store it. PostHog keeps the events for one year.

The website. bunbird.com is a static site. It sets no cookies. It remembers the language you chose in your browser’s local storage, which stays on your device. It uses PostHog, hosted in the EU, for analytics without cookies: nothing is stored in your browser, so every page you load counts as a new anonymous visitor and we cannot follow you from one visit to the next. The analytics requests go to p.bunbird.com, an address of ours that PostHog serves from the EU. The events record the page and its language, what you did on it (a section viewed, the demo played, a prompt copied, a button clicked) and the technical data any web request carries, such as your browser type. Your IP address is used to work out an approximate location and is then discarded; PostHog does not store it. There are no session recordings and no profiles of visitors.

Support and contact. If you write to us, we keep the correspondence to answer you and to keep a record of the conversation. Our mailboxes run on Google Workspace. We delete the correspondence two years after the last message.

Legal bases

We rely on the following bases under Article 6 of the GDPR:

• performance of the contract with you: your account, your organisations and apps, your assistant’s connection, the sessions and the emails the service needs;
• our legitimate interests: keeping the service secure and working (server logs), understanding and improving it (product and website analytics), answering you and keeping a record (support), and telling you about changes;
• legal obligation: what we must keep or disclose by law;
• consent: only where we ask for it, which you can withdraw at any time.

Data inside apps

An app published on Bunbird stores the data its users enter: records, files, notifications, and who signed in. That data belongs to the organisation that published the app. The organisation decides what the app collects, who may use it and how long it keeps data. Bunbird processes it on the organisation’s instructions, as a processor under Article 28 of the GDPR.

As a processor we process the data only to run the app and keep it secure, keep it in the EU, isolate each organisation’s data from every other, let the organisation delete it, tell the organisation without undue delay if we learn of a breach affecting it, and delete it when the app or the organisation is deleted. The subprocessors listed below apply. The Data Processing Agreement (bunbird.com/dpa/) sets out these terms in full.

If you use an app someone else published and want to exercise your rights over the data in it, contact the organisation that published it. If you do not know who that is, write to us and we will help you reach them.

Where your data is hosted

Bunbird runs on Google Cloud in the europe-west1 region (Belgium), on infrastructure we operate. Databases, files, secrets and backups stay in the EU. Disks are encrypted at rest, and every connection, inside and outside the platform, is encrypted in transit.

We plan to offer more regions in the future, so that an organisation can choose where its apps and the data inside them live. Until then everything stays in the EU. If that choice becomes available, this policy will describe it before any data is stored anywhere else.

Who else processes your data (subprocessors)

We use these providers to run Bunbird:

Google Cloud. Hosting of the platform and its data in europe-west1, plus system logs and host metrics.

Resend. Transactional email (address confirmation, password reset, invitations, welcome, and app notifications delivered by email), sent from EU servers.

PostHog. Product analytics and error tracking for the platform, and cookieless analytics for the website, hosted in the EU.

Google. Identity provider, only if you choose to sign in with Google.

Google Workspace. The mailboxes behind support@bunbird.com, security@bunbird.com and abuse@bunbird.com. Google may process that mail outside the EU under its data processing terms, which include the EU standard contractual clauses.

We will update this list before adding a provider that handles personal data.

How long we keep data

Account data. While your account exists. When you ask us to close it, we delete it within 30 days, except what we must keep by law.

Organisations and apps. While they exist. A deleted app or organisation is kept, restorable, for the period set by its plan, then permanently deleted. Its owners can ask for permanent deletion sooner.

Drafts. A draft that is not used falls asleep after the period in the organisation’s plan and is deleted after a further period (7 and 30 days by default).

Data inside apps. As the app declares. A collection can have a retention period, after which its records are deleted automatically.

Backups. Daily disk snapshots, kept for 14 days.

Server logs. 7 days.

Support mail. Two years after the last message.

Analytics events. One year, PostHog’s retention on our current plan.

Sessions. A console session lasts up to 12 hours, an app session up to one hour. An access token issued to your assistant lasts one hour, and the assistant renews it while you use it. Its connection ends 30 days after it was last used, 90 days after you allowed it, when you change or reset your password, when you revoke it under My AI assistants in the console, or if the token it renews its access with is used twice. Once it ends, the assistant can no longer renew its access, and the access it already holds expires within the hour.

Security

We protect your data with encryption in transit (TLS everywhere, including between internal services) and at rest (encrypted disks), passwords hashed with argon2id, secrets kept in a dedicated encrypted store, isolation between organisations enforced by the platform on every request, least-privilege access for the people who operate the service, signed sessions that apps cannot forge, a content security policy that confines every app to what it ships, and dependency and image scanning in our build pipeline. No system is perfectly secure. If you find a weakness, tell us at security@bunbird.com; our security page (bunbird.com/security/) says how.

Cookies

The website (bunbird.com) sets no cookies. Its analytics works without cookies or any other storage in your browser (see “The website” above).

The console (app.bunbird.com) sets these cookies:

• session: your signed session, so you stay signed in. HttpOnly, Secure, sent only to Bunbird, valid for up to 12 hours or until you sign out.
• lang: the language you chose. Kept for one year.
• attempt: while you sign in with Google, a cookie that ties the sign-in to your browser. Kept for 10 minutes.

Each app on bunbird.app sets, on its own address only: __Host-session, your session in that app, valid for one hour; __Host-handover, used for 10 minutes while the console hands your session to the app; and, in a draft preview only, bunbird_as, which test person you are viewing the draft as.

The console also keeps a few choices in your browser’s local storage, which stays on your device: the theme, how your apps are shown (cards or list, and their order), and your progress in the getting-started guide, including what you said you do, the idea you picked and, until you sign out, the app you described in your own words.

All of these are strictly necessary to provide the service you asked for, so they need no consent. We set no advertising or tracking cookies.

Your rights

Under the GDPR you can ask us to access the data we hold about you, correct it, delete it, restrict or object to its processing, give it to you in a portable format, and withdraw consent where processing is based on it. Write to support@bunbird.com. We will answer within one month, and we may ask you to prove who you are first.

You can also complain to a data protection authority, in particular in the EU country where you live or work.

We make no decisions about you by automated means that have legal or similarly significant effects.

Transfers outside the EU

Your data is stored and processed in the EU. Some of our providers belong to groups headquartered outside the EU and may access data from outside the EU for support or operations. Where that happens, we rely on the European Commission’s adequacy decisions or on its Standard Contractual Clauses, with the additional safeguards the law requires.

Your AI assistant is a separate service. What you type into it, including what you ask it to build, is sent to its vendor under the vendor’s terms and may be processed outside the EU.

Children

Bunbird is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, write to us and we will delete it.

Changes to this policy

We may update this policy as the service changes. The date at the top says when it was last changed. If a change matters to you, we will tell you by email or in the console before it takes effect.

Contact

César Arroba, David Martín Bragado, Pedro Miguel Díaz Peña and Pepe Fagoaga, trading together as Bunbird. C/ Menorca 23, Bajo B, 28290 Las Rozas de Madrid, Madrid, Spain. Email: support@bunbird.com.