Privacy Policy

1. Purpose and scope

1.1 We respect your privacy and recognise the importance of protecting the personal data we collect and process. This Privacy Policy explains what personal data we collect, how we use and share it, and the choices you have.

1.2 When we say "Bunkhouse", "we", "us" or "our", we mean Lanius Limited, a company registered in New Zealand, trading as Bunkhouse AI.

1.3 This Privacy Policy applies to you if you:

visit bunkhouse.ai or docs.bunkhouse.ai (the "Sites") ("website visitors");
create or use an account on the Bunkhouse dashboard at app.bunkhouse.ai, or use the Bunkhouse API, embed script, agent trials or external-agent connections (together, the "Services") ("customers"); or
contact us, for example by email.

The Services are intended for businesses and developers acting in a professional capacity, not for consumer use.

1.4 This Privacy Policy does not cover personal data we process on behalf of a customer about the people who use that customer's website or application ("end users"). For that data the customer decides how it is used and we act as their processor or service provider under our Terms of Service. Section 3 describes that processing so end users and customers can see what happens, but questions or requests about it should go to the customer whose site you were using.

1.5 For the purposes of the New Zealand Privacy Act 2020, the EU General Data Protection Regulation and the UK GDPR (together, "data protection law"), Lanius Limited is the controller (or agency) of the personal data described in Section 2.

2. Personal data we collect

2.1 Some data you give us directly, some is collected automatically when you use the Sites or Services, and some comes from service providers we use.

Website visitors

Usage and device data: pages viewed, referring site, approximate location derived from your IP address, browser and device type, and date and time of visits, collected through Google Analytics (loaded by Google Tag Manager). See Section 2.2.
Request logs: our hosting provider (Cloudflare) processes IP addresses and request metadata to deliver the Sites and protect them from abuse.

Customers

Account data: your email address and password (stored only as a hash by our authentication provider), your workspace name, and email confirmation and password reset records.
Site configuration: the names you give your sites, the website origins and API origins you allow, and the settings you choose, such as anonymous access limits and external-agent access.
Credentials: publishable keys, and secret keys and signing secrets we generate for you. Secret keys are stored only as a one-way hash; signing secrets are stored encrypted.
Billing data: your Stripe customer identifier, subscription status, payments, refunds, disputes and credit balances. Card details, billing address and tax IDs are collected and held by Stripe; we do not receive full card numbers.
Usage data: for each assistant request, the site, time, model used, token counts, cost, outcome and request identifiers. We use this for billing and the usage reports in your dashboard.
Service logs: our API records one line per request (request ID, method, path, status and duration). Our hosting and database providers also process IP addresses and request metadata to run and secure the Services.
Communications: the content of emails and support requests you send us.

Agent trials

When you or your coding agent start a free agent trial, we create a temporary anonymous account and store the trial's configuration and the messages exchanged during the trial. Trials are for dummy data only. We also send a "trial created" event to Google Analytics without any account identifiers, email addresses, IP addresses, origins or URLs.

External agents

If you connect an external AI agent (for example an MCP client) to your browser tab, we store the client's registration details, the access grant you approved, and the requests and results relayed between the agent and your tab.

2.2 Cookies and similar technologies

Sites: bunkhouse.ai and docs.bunkhouse.ai load Google Tag Manager, which loads Google Analytics 4. Google Analytics sets first-party cookies (such as _ga and _ga_*) to distinguish visitors and sessions. We use this to understand which pages are useful. We do not use advertising cookies. You can block these cookies in your browser or use Google's opt-out add-on.
Dashboard: app.bunkhouse.ai stores your sign-in session and your light or dark theme choice in your browser's local storage. These are strictly necessary for the dashboard to work.
Embed: the Bunkhouse embed sets no cookies. It stores whether the assistant pane is open in local storage, and short-lived connection identifiers for external-agent consent in session storage. Without sign-in, generated page skills are also kept in that browser.

Do Not Track. We do not currently respond to "Do Not Track" browser signals.

3. Data we process on behalf of customers

3.1 Customers add the Bunkhouse embed to their own websites and applications. When an end user uses that assistant, we process the following on the customer's behalf:

Before anything is sent: the embed shows a notice naming who receives the data and sends nothing until the end user accepts. The notice is shown again if the signed-in user changes.
Messages and page data: the end user's messages, a summary of the page's controls and visible content, and any page or application data the end user's request reads. Passwords, payment fields and sections the customer marks private are never read. Actions that change application data need the end user's approval.
One-time page review: before the first request on a site, the permitted visible page content and the shapes (not the values) of requests the page made, so the model can describe what the page can do. The resulting skills are stored privately for that user, or kept in the browser when there is no sign-in, and expire after seven days.
User identifiers: if the customer signs sessions, the user ID the customer supplies, and the page origin. We store these so customers can see usage by user. Anonymous sessions carry no user ID.

3.2 AI model providers. To generate responses, we send the messages and page data above to large language models through OpenRouter. We instruct OpenRouter to route requests only to model providers whose data policies, as reported by OpenRouter, do not permit storing or training on the data. Providers may still retain data briefly where needed for abuse monitoring or legal compliance. Model providers receive a pseudonym derived from the user ID, never the user ID itself.

3.3 No transcript storage. We do not store conversation transcripts from the hosted assistant. We keep only the usage data described in Section 2. The exceptions are agent trials and external-agent relays, whose messages are stored temporarily as described in Section 6.

3.4 No training. We do not use customer or end-user content to train AI models.

4. How and why we use personal data

4.1 We use personal data for the following purposes and, if you are in the EEA or UK, on the following legal bases:

Providing the Services and Sites: to create and manage your account, run the assistant, authenticate requests and show your usage. This is necessary to perform our contract with you, or where there is no contract, for our legitimate interest in operating the Services.
Billing: to charge subscriptions and usage, apply credit and handle refunds and disputes, to perform our contract and meet tax and accounting obligations.
Communicating with you: to send account, security, billing and service messages and to answer your questions, under our contract with you or our legitimate interests.
Improving the Services and Sites: to understand how the Sites are used and which features work, based on our legitimate interests or, where required, your consent.
Security and abuse prevention: to enforce origin allowlists and rate limits, detect misuse and protect our users, based on our legitimate interests.
Legal compliance: to comply with laws, respond to lawful requests and establish or defend legal claims.

4.2 We do not sell personal data, and we do not use it for targeted advertising. If we want to use personal data for a purpose that is materially different from those above, we will tell you first.

5.1 We share personal data only with:

Service providers that process it for us under contract:

Provider	Purpose	Location
Google Cloud	API hosting and scheduled jobs	United States
Supabase	Database and authentication, including account emails	United States
Vercel	Dashboard and embed script hosting	Global edge network
Cloudflare	Hosting for the Sites, and DNS	Global edge network
OpenRouter and the model providers it routes to	AI model inference	United States and other countries
Stripe	Payments and billing	United States and other countries
Google Analytics	Website analytics	United States

Professional advisers, such as lawyers, accountants and insurers, where needed for the services they provide to us.
Authorities, where required by law or to protect our rights, our users or the public.
Business transferees, if we are involved in a merger, acquisition, financing or sale of assets, subject to this Privacy Policy.

5.2 We may share aggregated or de-identified information that does not identify you.

5.3 The Sites link to third-party websites. Their privacy practices are their own.

6. Retention

6.1 We keep personal data only as long as needed for the purposes in this Privacy Policy:

Account, site configuration and per-user usage data: while your account is open.
Billing and usage records: as long as required for tax and accounting, generally seven years.
Generated page skills: seven days after publication, then deleted. Customers can delete them sooner.
Agent trials: a trial expires after 24 hours; its data and anonymous account are deleted about an hour after it expires or is revoked.
External-agent relay requests and results: 24 hours. Access grants: 30 days after expiry or revocation, and never more than 90 days.
Rate-limit records: one hour.

6.2 When you close your account we delete or de-identify your personal data within 90 days, except records we must keep by law.

7. International transfers

7.1 We are based in New Zealand. The Services are hosted in the United States, and our service providers may process personal data in other countries that may not have equivalent data protection laws. We protect personal data in line with this Privacy Policy wherever it is processed.

7.2 Where data protection law requires it, we rely on safeguards such as our providers' data processing terms, including the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, and we take reasonable steps under Information Privacy Principle 12 of the New Zealand Privacy Act 2020 to ensure comparable protection.

8. Security

We use reasonable technical and organisational measures to protect personal data. These include encryption in transit, row-level access controls in our database, one-way hashing of secret keys, encrypted storage of signing secrets, short-lived session tokens, per-site origin allowlists and rate limits. More detail is in the security guide. No system is perfectly secure. If a breach is likely to cause serious harm, we will notify you and the relevant regulator as required by law.

9. Your rights and choices

9.1 Depending on where you live, you may have the right to:

access the personal data we hold about you and ask us to correct it;
ask us to delete it, or to restrict or object to how we use it;
receive a copy of it in a portable format;
withdraw consent where we rely on it, without affecting earlier processing; and
not be discriminated against for exercising these rights.

9.2 To exercise any of these rights, email [email protected]. We may need to verify your identity. If your request relates to an end user of a customer's site, we will refer it to the customer and help them respond.

9.3 You can complain to a data protection authority: in New Zealand, the Office of the Privacy Commissioner; in the UK, the Information Commissioner's Office; in the EEA, your local supervisory authority. We would appreciate the chance to address your concern first.

10. Children

The Sites and Services are not intended for anyone under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes and contact

11.1 We may update this Privacy Policy as the Services, the law or our practices change. We will update the effective date above and, for material changes, notify customers by email or in the dashboard before the changes take effect.

11.2 Questions about this Privacy Policy or our handling of personal data: [email protected], Lanius Limited (trading as Bunkhouse AI).