01The short version
Your keys stay yours. Credentials for the tools you connect are encrypted (AES-256-GCM) and used only by our servers to fetch data. They are never sent to an AI model.
Only data goes to the AI. To answer a question, Bonnie sends the question and the relevant data to an AI model provider. We don't sell your data and we don't use it to train our own models.
Synced and live, always labelled. Some sources are synced and stored so Bonnie can answer quickly; others are read live. Every answer says how fresh its numbers are.
Off the moment you say so. Disconnect a source and Bonnie stops reading it at once; its synced data is deleted within 7 days.
02Who we are
Bonnie Ai ("Bonnie", "we", "us") is operated by BonnieOS. This policy covers our website (bonnieos.com), the Bonnie app and the services we provide through them.
For data that your organisation connects or uploads to Bonnie (your "workspace data"), your organisation decides what is connected and who can see it, and we process that data on its behalf to provide the service. For data about visitors to our website and about the people who use their accounts, we decide how it's used, as described here.
03What we collect
Account information
- Name, work email, role and the workspace you belong to.
- A password, stored only as a one-way hash, if you sign in with email.
- If you sign in with Google, Microsoft or GitHub: your name, email and account ID from that provider. Signing in this way is for identity only; it doesn't connect that account as a data source.
Workspace and product information
- The products you set up (name, stage, platforms, short description) and the context files you add.
- Team members you invite, their roles and which products they can see.
Credentials for connected sources
- API keys, tokens, service-account files and connection details for the tools you connect (for example Firebase / BigQuery, Mixpanel, RevenueCat, app stores, ad networks, GitHub, databases). These are encrypted before they are stored.
Data from your connected sources
- What we read depends on what you connect: for example app analytics events and metrics, subscription and revenue figures, store and ad reports, repository and release information, or rows from a read-only database.
- Synced sources are read on a schedule and stored in your workspace so answers are fast and consistent. Live sources are read when a question needs them; the results are kept with the conversation that used them.
Content you create
- Chat messages, questions and Bonnie's answers; files you attach or upload; documents, standing instructions and memories (facts, decisions, to-dos) in your knowledge base; schedules and the reports they produce.
Usage and technical information
- Log data such as IP address, browser and device type, pages and features used, timestamps, and error reports, used to run, secure and improve the service.
- Website analytics through Google Analytics (via Firebase), described in Cookies and storage.
Support and demo bookings
- Messages you send to support, help sessions you book, and demo calls you book through Calendly (name, email and the time you pick).
04How we use it
- To provide the service: sign you in, connect and read your sources, answer your questions, run scheduled reports, and keep your knowledge base.
- To keep it secure: detect abuse, protect accounts, keep each workspace's data separate, and investigate incidents.
- To support you: reply to messages, run help sessions and demos, and send service emails (invitations, sign-in, scheduled reports, important changes).
- To improve Bonnie: understand which features are used and fix errors. We use aggregated usage information for this, not the contents of your connected data.
- To meet legal obligations and enforce our Terms of Service.
Where a legal basis is required (for example under the GDPR), we rely on performing our contract with you or your organisation, our legitimate interests in running and securing the service, your consent where we ask for it (such as non-essential analytics), and legal obligations.
05AI processing
Bonnie uses large language models to understand your questions and write answers. When you ask a question, Bonnie sends the question, the relevant conversation, and the data needed to answer it (for example query results, document excerpts or memories) to an AI model provider.
- Providers we use: Anthropic (Claude), DeepSeek and Moonshot AI (Kimi), through their business APIs. Which one answers depends on your workspace's model settings.
- Your own keys: if your workspace adds its own key for a model provider, requests for your workspace go to that provider under your agreement with them.
- Never sent: connector credentials. Secrets detected in your messages (such as API keys and passwords) are removed before anything is sent to a model.
- No training by us: we don't use your workspace data to train our own models. AI providers process requests under their API terms; check each provider's terms for how they handle API data.
AI answers can be wrong. Bonnie cites the sources it used so you can check them.
07How long we keep it
- Account and workspace information: while your account is active, and deleted after your workspace is closed, except what we must keep by law.
- Synced event data (for example analytics events): a rolling window of about 30 days.
- Daily metrics computed from your sources: up to 13 months.
- A disconnected source: Bonnie stops reading it immediately; its synced data is deleted within 7 days.
- Conversations, uploads, documents and memories: until you or your workspace admin delete them, or the workspace is closed.
- Backups: daily snapshots, each kept for 30 days and then deleted.
- Logs: kept for a limited period for security and debugging.
08Security
- Connector credentials are encrypted at rest with AES-256-GCM and are never sent to an AI model.
- Data moves over encrypted connections (TLS).
- Each workspace's data is kept separate, and every request is checked against the workspace and products the user can access.
- Sources are read-only by default. Any source that can write says so when you connect it.
- Access to production systems is limited to the people who need it.
No system is perfectly secure. If we learn of a breach that affects your data, we'll tell you without undue delay and as the law requires.
09Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict some processing, and to withdraw consent. You can also complain to your local data protection authority.
To use these rights, email hello@bonnieos.com. If your account belongs to an organisation's workspace, we may refer requests about workspace data to that organisation's admin. We reply within 30 days.
11International transfers
Our servers are in the European Union. Some providers process data elsewhere: Anthropic in the United States, DeepSeek and Moonshot AI in China, and Google, Microsoft, GitHub, Resend and Calendly in the United States and other countries. If your workspace prefers that questions are not processed by a particular AI provider, a workspace admin can turn its models off in the AI model settings. Where the law requires it, we use appropriate safeguards for these transfers, such as standard contractual clauses.
12Children
Bonnie is a business tool and isn't meant for anyone under 16. We don't knowingly collect personal information from children.
13Changes
If we change this policy, we'll update the date at the top. If a change is significant, we'll tell workspace admins by email or in the app before it takes effect.
14Contact
Questions about privacy: hello@bonnieos.com.
BonnieOS.