Privacy Policy

BumpAI is operated by its co-founders, William Butler and Danish Waheed (together, “BumpAI,” “we,” “us,” or “our”).

This policy explains how we collect, use, disclose, and protect personal information when you visit bumpai.dev, use the BumpAI application, build or publish projects, collaborate with others, purchase a subscription, or contact us.

For privacy questions or requests, contact ________________.

We are responsible for the processing we determine for our own account administration, billing, support, and service operations. Where applicable law uses the term, we act as controllers for that processing.

People and organizations that use BumpAI to build applications are responsible for explaining their own applications’ data practices to their users. Where we process that information solely on a customer’s instructions, we act as a processor or service provider under the applicable agreement. This policy also covers our own processing necessary to operate and protect hosting and access-control services.

The information we collect depends on how you use BumpAI.

We receive information from you, from your use of the service, from collaborators who invite you or share projects, and from providers supporting authentication, payments, AI features, and infrastructure.

Certain information is necessary to create your account and provide requested features. Without it, we may be unable to provide those features. Optional profile information is not required for the core service.

Only submit information you are authorized to share. Avoid placing passwords, financial account details, government identifiers, health information, or other sensitive information in prompts, project files, or support messages unless the service and applicable agreement expressly support that use. Add AI provider credentials through the dedicated connection settings.

We use personal information to:

• Authenticate you and administer your account.
• Generate and revise application plans, code, content, and images.
• Maintain project context and provide builds, saved versions, previews, exports, hosting, and publishing.
• Enable workspace collaboration, invitations, permissions, public profiles, showcases, and custom domains.
• Process subscriptions, administer promotions, calculate usage and credits, and maintain billing records.
• Respond to inquiries and send relevant service, account, billing, or security communications.
• Troubleshoot problems, maintain service reliability, investigate abuse, and protect users and the service.
• Meet applicable legal obligations and establish, exercise, or defend legal claims.

Our systems calculate usage and apply plan, credit, and access limits automatically.

Where applicable law requires a legal basis, we rely on performing our contract with you for necessary service delivery; legitimate interests for proportionate security, troubleshooting, support, and business administration; legal obligations for required records and disclosures; and consent for optional activities where consent is required. Relevant legitimate interests include protecting users, operating a reliable service, and resolving problems, subject to the rights and interests of affected people.

Reading or acknowledging this policy does not itself give consent to optional advertising, tracking, or model training.

To provide AI features, we send relevant information to the provider used for that feature. This can include your prompt, conversation context, code, uploaded references, images, and information returned by development tools. The provider processes the request and returns generated content and technical or usage information.

BumpAI includes Google Gemini processing and connections to OpenCode, Ollama cloud, and DeepSeek, depending on the feature and model you use. OpenCode may route a request to the provider serving your selected model. Image generation and other features can use a different provider from the model selected for a coding conversation.

If you bring your own key (“BYOK”), BumpAI still processes relevant project information and routes requests to the connected provider. The Ollama connection uses its cloud service.

Providers’ retention, abuse monitoring, human review, and model-improvement practices depend on the specific service, account configuration, and applicable agreement. Relevant provider information is available here:

• Google Gemini API terms
• OpenCode privacy and provider information
• Ollama privacy policy
• DeepSeek privacy policy

BumpAI’s use of content for AI training: BumpAI currently does not use your prompts, conversations, uploaded files, source code, or generated project content to train or fine-tune AI models. We process this information to deliver the features you request and for the operational purposes described in this policy. This statement concerns BumpAI’s own training practices; third-party providers’ processing is described above.

We may introduce uses of this content for AI training or model improvement in the future. Before doing so, we will notify affected users through email or a prominent in-service notice and update this policy. The notice will explain what information would be used, the purpose, when the change would take effect, and the choices available to you. We will obtain consent where required by applicable law or our existing commitments. Updating this policy or continuing to use BumpAI does not, by itself, authorize training on information previously collected under a no-training commitment.

When you save an AI provider key, our credential service stores it in encrypted form and displays masked information to help you identify it. The credential service uses AES-256-GCM envelope encryption with Google Cloud KMS protecting the encryption keys.

Authorized service components decrypt credentials when needed to authenticate requests to the connected provider. You can manage saved connections using the available key settings. Removing a BumpAI connection does not revoke the key at its provider; manage provider-side revocation through that provider.

Stripe processes payments for BumpAI subscriptions through Stripe Checkout. We send Stripe information needed for checkout and subscription administration, such as your billing email where available, workspace reference, selected plan, and related metadata.

BumpAI keeps subscription and payment records, including customer, subscription, and invoice references; plan and credit allowance; amounts and currency; payment status; billing periods; and invoice links. Stripe handles payment details submitted through its checkout and may process additional transaction and fraud-prevention information. See Stripe’s privacy policy.

For BYOK, the connected provider bills model usage under your arrangement with it. BumpAI separately records service and runtime usage to administer your plan and credits.

Pricing, recurring payments, introductory offers, cancellation, and refunds are described in the applicable pricing, checkout, and service terms. Subscription cancellation and a privacy deletion request are separate processes.

Changes to prices and usage: We may increase subscription prices and revise usage-based charges, credit allowances, credit-consumption rates, usage limits, and included features from time to time. Where permitted by applicable law and the terms of your existing subscription, these changes may take effect without advance notice. Where advance notice, consent, or an opportunity to cancel is required, we will provide it before applying the change to your subscription. Applicable prices and usage terms will be shown on our pricing page, in your billing settings, or at checkout, as appropriate. This clause does not override the terms of a subscription already purchased or any rights you have under applicable law.

We disclose relevant information in the following circumstances:

• Service delivery: to providers supporting authentication, AI processing, infrastructure, storage, content delivery, domain routing, payments, and support communications. These include Auth0, Google services, Cloudflare, Stripe, and the AI providers described above. Where enabled, Resend delivers support notifications that may include your email address and message. [COMPLETE_VERIFIED_PRODUCTION_PROVIDER_LIST]
• Collaboration: to authorized workspace or project participants according to their roles and access. Owners or administrators can manage the information and settings available to their permissions.
• Public sharing: when profile information, showcases, preview links, or published applications are made public. People with access may copy or redistribute the content. Removing public content cannot recall copies independently made by other people.
• Connections you enable: to services you configure for your project, according to the information that connection needs and the permissions you grant.
• Legal and protective purposes: where required by applicable law or reasonably necessary to address abuse, protect rights, or investigate security incidents, subject to applicable law.
• Business transactions: in connection with a proposed or completed financing, acquisition, restructuring, or transfer of assets, subject to appropriate legal and confidentiality requirements.

Cookies are small pieces of information stored in your browser. BumpAI also uses local storage and session storage to remember preferences and maintain application state. The storage used depends on the features you access.

Provider technologies. Auth0 uses cookies for authentication and related security features. Stripe uses cookies and similar technologies in connection with checkout and its payment services. Depending on the security features enabled, Cloudflare may also set cookies to protect and deliver the service. Provider cookies have their own purposes and lifetimes, and some provider features can recognize a browser across services. Further information is available in Auth0’s cookie documentation, Stripe’s cookie policy, and Cloudflare’s cookie documentation.

Your choices. You can inspect, block, or clear cookies and browser storage through your browser settings. Doing so can sign you out, reset preferences, or prevent sign-in, previews, checkout, or other features from working. Clearing browser storage does not itself delete information held in your BumpAI account. BumpAI does not currently implement a separate response to browser “Do Not Track” signals; this does not limit any rights or requirements under applicable law concerning other privacy signals.

Where consent is required for optional cookies, analytics, or advertising technologies, we will obtain it before using those technologies and provide a way to withdraw it. We will update this policy and provide any required notice before introducing new tracking purposes. Reading this policy or continuing to use the website does not by itself provide that consent.

We keep personal information only for as long as it is needed to provide the service, support your account, administer billing, maintain security, comply with law, or resolve disputes.

• Account, project, and content deletion: When you delete your account, project, prompt, conversation, upload, generated asset, saved version, hosted file, or provider connection, BumpAI permanently deletes the associated information from our systems. We do not keep backups, replicas, cached copies, or other retained copies of deleted information.
• Support, device, usage, and security records: retained only for the period needed for the support, security, operational, or legal purpose for which they were collected, after which they are permanently deleted.
• Billing and legal records: retained only for the period required by applicable accounting, tax, dispute, or other legal obligations, after which they are permanently deleted.

You can use the available project deletion controls or contact ________________ to request deletion of your account or personal information. Once deletion is completed, BumpAI does not retain a backup or other copy of the deleted information.

Deletion of information held by an AI, payment, authentication, hosting, or other third-party provider is governed by that provider's own systems and legal obligations. BumpAI will not use deleted information for any new purpose.

We use technical measures designed to protect personal information, including authentication, access checks, and encryption for stored provider credentials. We also depend on the infrastructure and providers supporting the service.

No online service can guarantee absolute security. Protect your account and provider credentials, review project permissions, and check content before publishing it. Report a suspected privacy or account-security issue to ________________.

We and our providers may process personal information outside the country where you live. Locations depend on the provider and feature: [CONFIRMED_PROCESSING_LOCATIONS].

For transfers subject to legal restrictions, the safeguards applicable to our processing are [VERIFIED_TRANSFER_SAFEGUARDS_AND_INFORMATION_REQUEST_METHOD]. Contact ________________ for information about those arrangements.

Available settings let you edit profile information and manage project visibility, sharing, and provider connections.

Depending on applicable law, you may also have rights to:

• Access your personal information and obtain a copy, including in a portable format.
• Correct inaccurate information.
• Request deletion or restriction of processing.
• Object to certain processing.
• Withdraw consent where processing relies on consent.
• Exercise applicable rights concerning targeted advertising, sale or sharing, or significant automated decisions.
• Complain to a relevant data protection authority.

Send requests to ________________. We may request information reasonably necessary to verify your identity and locate the relevant records. We will respond within the period required by applicable law and explain any applicable exception or extension.

If your request concerns information collected by an application built by a BumpAI customer, contact that application’s operator. Where BumpAI processes information on that operator’s instructions, we assist as required by the applicable agreement and law.

BumpAI’s website and application-building service are intended for adults aged 18 or older. You must be at least 18 to create a BumpAI account or use its AI building features.

We do not direct the service to children or knowingly collect their personal information through accounts intended for adults. If we learn that someone under 18 has created an account, we will take steps to restrict access, investigate, and address the associated personal information in accordance with applicable law.

A parent or guardian who believes a child has provided personal information can contact ________________. Please provide enough information to help us locate the account without sending unnecessary sensitive information.

Operators of applications built with BumpAI are separately responsible for their applications’ age eligibility, privacy notices, and any requirements for processing children’s information.

We may update this policy to reflect changes in the service, our practices, or applicable requirements. We will revise the date above and provide an appropriate notice of material changes, such as an in-service notice or email. Where a change requires consent, we will obtain it before carrying out the relevant processing.

For privacy questions, concerns, or requests:

BumpAI
Operators: William Butler and Danish Waheed
Website: bumpai.dev
Privacy email: ________________