Version 2.0 ｜ Last updated 2026-10-02 ｜ The English version governs
OpenBulu ("we", "us") is committed to protecting your privacy. This Privacy Policy (this "Policy") explains how we collect, use, store and share your personal information when you use OpenBulu (the "Service"), and the rights you have.
Please read this Policy carefully before using the Service. Using the Service means you agree to this Policy. We may update this Policy periodically; material changes will be notified through the email address linked to your account or an in-platform notice.
Data Protection Officer (DPO): not applicable. For matters relating to the protection of personal information, please contact us at privacy@openbulu.com.
2. Personal Information We Collect
2.1 Information You Provide Directly
Account information: name or nickname, email address, password (stored encrypted), third-party login identifiers;
Request content: the prompts and instructions you submit, and the output generated by the Service from them;
Payment information: transaction amount and payment status. We do not store full card numbers — card data is handled by our payment processor (see Section 5);
Correspondence: emails, support tickets and feedback that you send us.
2.2 Information Collected Automatically
Device and network: IP address, device model, operating system, browser type, time zone;
Third-party login: when you sign in with Google or GitHub, we receive the basic profile information shared by that provider (account identifier, email address, nickname and avatar).
3. How We Use Your Information
Purpose
Legal basis
Service delivery and maintenance
Performance of a contract
Billing and payment processing
Performance of a contract
Customer support
Performance of a contract / legitimate interests
Service notifications (billing, security, policy)
Legitimate interests
Security and fraud prevention
Legitimate interests
Content safety moderation
Legitimate interests / legal obligation
Product analytics and improvement
Legitimate interests
Legal compliance
Legal obligation
Marketing (product updates, new models and features, pricing changes)
Your consent
We may aggregate or anonymise data for statistical purposes. Such data cannot be linked to any individual.
4. Cookies and Tracking Technologies
Type
Purpose
Can be disabled
Strictly necessary
Login sessions, core functionality
No
Functional
Language preferences, personalisation
Yes
Analytics
Anonymous usage statistics, product optimisation
Yes
Marketing (optional)
Targeted advertising and measurement
Yes
Analytics tools currently in use: the Platform does not currently deploy any third-party analytics or advertising cookies. You can manage your preferences through your browser settings.
5. Sharing and Disclosure
We do not sell your personal information (including as "sale" is defined under applicable law such as the CCPA). We share your information only in the following circumstances:
Service providers: cloud hosting, payment, support and analytics vendors, each bound by confidentiality obligations. Payment card data is handled by our PCI-DSS compliant payment processor (Waffo Pancake) and is not stored on our servers.
Legal requirements: where required by law, court order, or a lawful regulatory request;
Business transactions: in a merger, acquisition or similar event, with prior notice and equivalent protection maintained;
With your consent: for any other purpose, with your prior explicit consent;
Upstream model providers: to execute your request, the input you submit, necessary conversational context and technical metadata are sent to upstream model providers (third-party AI model providers, and the underlying model providers they route to). Those upstream providers may be located outside your country or region;
Content moderation providers: to meet our content safety obligations, the prompts you submit and the output generated by the Service are submitted to an independent third-party content moderation service (OpenAI Moderation API) for safety assessment. That provider may be located outside your country or region.
6. Data Security
Transport encryption: site-wide TLS / HTTPS encryption with HSTS enabled;
Secure storage: passwords and sensitive data are encrypted or hashed;
Access control: the least-privilege principle is applied; all personnel and service providers are bound by confidentiality obligations;
Regular security audits and vulnerability assessments;
Browser security policies: clickjacking protection, content-type sniffing protection, referrer policy and browser permission restrictions are configured.
If a security incident affects your rights, we will notify you and the relevant authorities within 72 hours of discovery as required by applicable law. Please keep your credentials safe and do not share them with others.
7. Data Retention
Data type
Retention period
Action on expiry
Account information
For the life of the account; 90 days after deletion
Deleted or anonymised
Transaction records
7 years, per tax and accounting regulations
Deleted or archived
Support ticket records
24 months
Securely deleted
Security audit logs
90 days
Securely deleted
Request bodies and output
Not stored at rest
—
8. Your Data Rights
To exercise any of the following rights, please contact us; we will respond within 30 calendar days.
Right
Description
Right to be informed
Know what data we collect and how we use it
Right of access
Obtain a copy of your personal information
Right to rectification
Correct inaccurate or incomplete data
Right to erasure
Request deletion where the conditions are met
Right to restriction
Request suspension of processing in certain circumstances
Right to data portability
Receive your data in a machine-readable format
Right to object
Object to processing based on legitimate interests or for marketing
Right to withdraw consent
Withdraw consent-based processing
You may also lodge a complaint with the data protection authority in your country or region.
9. Marketing and Opt-out
With your consent, we may send you marketing messages by email or in-app notification about product updates, the launch of new models and features, and pricing changes. You may opt out at any time by clicking "unsubscribe" in any email, turning off marketing notifications in your account settings, or contacting us. Opting out does not affect service-essential notices (such as billing, security alerts and policy changes).
10. International Data Transfers
Our servers, service providers and upstream model providers may be located outside your country or region. For cross-border transfers we safeguard your data by:
signing Data Processing Agreements (DPAs) with recipients, requiring through contractual terms a level of protection substantially equivalent to this Policy;
transferring only where necessary to deliver the Service, following the principle of data minimisation;
applying encryption in transit and at rest.
The Platform does not currently provide services to European Union member states or the United Kingdom, so the General Data Protection Regulation (GDPR) and the UK GDPR do not apply to this Service; the safeguards above are best practices that we adopt voluntarily.
11. Children's Privacy
The Service is intended for users aged 18 and over. We do not knowingly collect information from anyone below that age. If you believe your child has provided information, please contact us immediately and we will delete it promptly.
12. Third-Party Links and Services
The Service may contain links to, or integrations with, third-party services. This Policy applies only to data that we collect directly. We are not responsible for the privacy practices of third parties, and recommend that you review their policies before using them.
13. Policy Changes
For material changes, we will notify you through a platform announcement or your registered email address at least 15 days in advance, and update the "Last updated" date at the top of this page. Continued use after the effective date constitutes acceptance.
Language: The English version of this Policy governs. Translations into other languages are provided for convenience only; in the event of any inconsistency between a translation and the English version, the English version prevails.
This Privacy Policy is provided for general information only and does not constitute legal advice. We strongly recommend that it be reviewed by qualified legal professionals in your target markets before publication.
