Privacy Policy

Draft — pending legal review. This document is being finalized and reviewed by counsel. Bracketed [PLACEHOLDER] values will be completed before launch.

This Privacy Policy explains how Artemis Design Labs [LEGAL ENTITY NAME](“we”, “us”) collects, uses, and protects information when you use Bakufu(the “Service”). It is written to meet our obligations under the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended (CCPA/CPRA).

The short version

• Your code and prompts are yours. We never use your content to train models or to serve any other customer. It is isolated to your workspace (tenant).
• We use only anonymized, aggregated usage statistics (no code, no personal data) to improve the Service.
• On Free and Pro plans, your code is processed on our own infrastructure. Third-party AI models are used only for the paid Expert tier, and only with the sub-processors we disclose.
• You can access, export, or delete your data at any time — email privacy@bakufu.ai.

Information we collect

• Account & identity. When you sign in with Google we receive your name, email address, and profile image. We do not receive your Google password.
• Content you submit. The goals, tasks, rulebooks, and source code your governed runs produce. Generated code is stored in your tenant’s private workspace and an optional, per-tenant learning corpus, with secrets and personal data scrubbed before storage.
• Operational records. An audit log of governance decisions and run events, used to make the Service explainable and to operate it.
• Usage analytics. Anonymized, aggregated product metrics (e.g. feature usage, error rates) that contain no code and no personal data.
• Billing. If you purchase a paid plan, our payment processor (Stripe) handles your payment details; we do not store full card numbers.

How we use information

• To provide, secure, and operate the Service for your account.
• To ground your future runs in your own prior work (never another customer’s).
• To improve the Service using anonymized, aggregated metrics only.
• To communicate with you about your account, support, and service changes.

We do notuse your code, prompts, or other content to train or fine-tune AI models, and we do not sell or share personal information (as “sell” and “share” are defined in the CCPA/CPRA). We do not use or disclose sensitive personal information for purposes other than providing the Service.

AI processing and sub-processors

On Free and Pro plans, model inference runs on infrastructure we control and your code is not sent to third-party AI providers. If you use the paid Experttier, the relevant content is sent to a third-party large-language-model provider to produce the result. The agents that are cloud-backed are labeled in the product. We list every sub-processor on our Sub-processors page.

Service-continuity failover. If our own inference infrastructure is temporarily unavailable, processing may fail over to Microsoft Azure (a disclosed sub-processor) until it recovers, under the same no-training commitment. Failover events are logged.

The Service is hosted in the United States (Hetzner, Ashburn datacenter); Free/Pro model inference runs on hardware we operate. Bakufu’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Cookies

We use only strictly-necessary cookies: your sign-in session and security (CSRF) protection. We set no advertising, cross-site tracking, or third-party analytics cookies — which is why the Service shows no cookie banner. Our product analytics are first-party, anonymized, and contain no personal data.

Legal bases (GDPR)

We process personal data to perform our contract with you (providing the Service), on the basis of our legitimate interests (securing and improving the Service in an anonymized way), and with your consent where required.

Your rights

Depending on where you live, you have rights to access, correct, delete, port, or restrict the processing of your personal data, to object to certain processing, to opt out of any “sale” or “sharing” of personal information (we do neither), to limit the use of sensitive personal information, and to not be discriminated against for exercising these rights. Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal. If you are in the EU/UK, you also have the right to lodge a complaint with your data-protection supervisory authority.

To exercise any of these rights, email privacy@bakufu.ai — as a service operated exclusively online, email is our designated request method — and we will respond within the time required by law.

Data retention

We retain your data for as long as your account is active, and then deleted within 30 days of account closure (backups within 90 days), unless we must retain it to meet a legal obligation.

Security

We encrypt data in transit and at rest, isolate each tenant’s data, and scrub secrets and personal data before any content is embedded into the learning corpus. No method of transmission or storage is perfectly secure, but we work to protect your information.

International transfers

We may process data in the United States and other countries. Where required, we rely on appropriate safeguards (such as the Standard Contractual Clauses) for transfers of personal data out of the EU/UK.

Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data.

Changes

We may update this policy; we will post the new effective date here and, for material changes, notify you.

Contact

Artemis Design Labs [LEGAL ENTITY NAME], [COMPANY ADDRESS]. Privacy enquiries: privacy@bakufu.ai.