Privacy Policy

Draft — pending legal review. This document is being finalized and reviewed by counsel. Bracketed [PLACEHOLDER] values will be completed before launch.

This Privacy Policy explains how Artemis Design Labs [LEGAL ENTITY NAME](“we”, “us”) collects, uses, and protects information when you use Bakufu(the “Service”). It is written to meet our obligations under the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended (CCPA/CPRA).

The short version

• Your code and prompts are yours. We never use your content to train models or to serve any other customer. It is isolated to your workspace (tenant).
• We use only anonymized, aggregated usage statistics (no code, no personal data) to improve the Service.
• On Free and Pro plans, your code is processed on our own infrastructure. Third-party AI models are used only on the paid Expert tier. We name each one on our Sub-processors page.
• You can access, export, or delete your data at any time — email privacy@bakufu.ai.

Information we collect

• Account & identity. When you sign in with Google we receive your name, email address, and profile image. We do not receive your Google password.
• Content you submit. The goals, tasks, rulebooks, and source code your governed runs produce. Generated code is stored in your tenant’s private workspace. You may also turn on a learning corpus for your tenant alone. We scrub secrets and personal data before we store either.
• Operational records. An audit log of governance decisions and run events. We use it to run the Service and to show you why each decision was made.
• Usage analytics. Grouped, anonymous product metrics, such as which features get used and how often errors occur. They hold no code and no personal data.
• Billing. If you purchase a paid plan, our payment processor (Stripe) handles your payment details; we do not store full card numbers.

How we use information

• To provide, secure, and operate the Service for your account.
• To ground your future runs in your own prior work (never another customer’s).
• To improve the Service using anonymized, aggregated metrics only.
• To communicate with you about your account, support, and service changes.

We do notuse your code, prompts, or other content to train or tune AI models. We do not sell or share personal information, as the CCPA/CPRA defines “sell” and “share”. We use sensitive personal information only to provide the Service, and we disclose it for no other purpose.

AI processing and sub-processors

On Free and Pro plans, model inference runs on infrastructure we control. Your code is not sent to third-party AI providers. On the paid Expert tier, the content needed for the task is sent to a third-party AI provider, which returns the result. Cloud-backed agents are labeled as such in the product. We list every sub-processor on our Sub-processors page.

Failover, to keep the Service running. Our own inference hardware can go down. While it is down, processing may move to Microsoft Azure, a sub-processor we disclose. The same no-training promise applies there. We log every failover.

During the beta, the Service runs on hardware we operate in the United States. That includes Free and Pro inference. If we move hosting to a cloud provider, we will list it on the Sub-processors page first. Bakufu’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Cookies

We use only the cookies the Service needs to work: your sign-in session and CSRF security. We set no cookies for ads, cross-site tracking, or outside analytics. That is why you see no cookie banner. Our own product analytics are anonymous and hold no personal data.

Legal bases (GDPR)

We process personal data on three legal bases. To perform our contract with you, which is to provide the Service. For our legitimate interests, which are to secure the Service and to improve it in an anonymized way. And with your consent, where the law requires it.

Your rights

Where you live decides which of these rights you have:

• To see your personal data, correct it, delete it, or take a copy elsewhere.
• To limit how we process it, or to object to some processing.
• To opt out of any “sale” or “sharing” of personal information. We do neither.
• To limit how we use sensitive personal information.
• To be treated the same whether or not you use these rights.
• To withdraw consent at any time, where we rely on it. Withdrawing it does not make earlier processing unlawful.
• In the EU and UK, to complain to your data-protection supervisory authority.

To use any of these rights, email privacy@bakufu.ai. We run online only, so email is the request method we designate. We will reply within the time the law allows.

Data retention

We retain your data for as long as your account is active, and then deleted within 30 days of account closure (backups within 90 days), unless we must retain it to meet a legal obligation.

Security

We encrypt data in transit and at rest. Each tenant’s data is kept apart from every other tenant’s. We scrub secrets and personal data before any content enters the learning corpus. No way of sending or storing data is perfectly safe, but we work to protect yours.

International transfers

We may process data in the United States and in other countries. Where the law requires it, we use proper safeguards for transfers of personal data out of the EU and UK. The Standard Contractual Clauses are one such safeguard.

Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data.

Changes

We may update this policy; we will post the new effective date here and, for material changes, notify you.

Contact

Artemis Design Labs [LEGAL ENTITY NAME], [COMPANY ADDRESS]. Privacy enquiries: privacy@bakufu.ai.