Privacy Policy

1. Who we are

Open Bee AI ("Open Bee", "we", "us") provides a multi-provider AI platform consisting of a hosted web app, a billing system, and an open-source (Apache-2.0) local agent runtime called open-bee. The agent runtime is the privacy-first deployment mode: when you link a daemon, your files and code are processed on your own machine and never sent to our servers.

2. Data we collect

2.1 Account & identity (via Clerk)

• Email address, name, profile picture (if you sign in with OAuth).
• Authentication metadata: sign-in timestamps, session IDs, IP address.

2.2 Workspace content (in our database)

• Workspace name, plan, member roles.
• Chat conversations: every message you send, every response we generate, uploaded images, model used, token counts.
• Mission Control tasks: titles, descriptions, status, run logs.
• Bridge configuration: Telegram bot tokens (encrypted at rest with AES-256-GCM), webhook secrets, bot username.
• BYOK provider keys (Anthropic / OpenAI / Google) if you choose to bring your own — encrypted at rest with AES-256-GCM and never logged.

2.3 Billing (via Stripe)

We do not see, store, or process your payment card. Stripe handles checkout and the customer portal end-to-end. We store the Stripe customer ID, subscription ID, current plan, and renewal date so we can gate features.

2.4 Usage telemetry

• Per-message metering: token counts, model ID, cost in USD, timestamp — for billing and rate limits.
• Server logs: request paths, response codes, latencies. Retained 30 days and never linked to message bodies.

3. How we use it

• Provide the service. Render the chat surface, orchestrate tasks, deliver Telegram replies.
• Bill you accurately. Apply per-model rate limits and generate Stripe invoices.
• Improve reliability. Diagnose errors and outages from server logs.
• We do not train any model on your data. Your messages are not used to fine-tune Open Bee, our LLM sub-processors, or anyone else's models. If a sub-processor's default policy includes training on traffic, we use the API tier that opts out.

4. Sub-processors

We rely on the following processors. You consent to their involvement when you sign up. We'll notify customers 30 days before adding a new sub-processor that handles message content.

• Clerk (USA) — authentication, session management.
• Neon (Singapore, ap-southeast-1) — managed Postgres. All your workspace content lives here. TLS in transit, AES-256 at rest on Neon's storage layer.
• Stripe (USA, EU) — payment processing.
• Anthropic (USA) — Claude family LLM provider. Receives message content for the duration of your request only.
• OpenAI (USA) — GPT family LLM provider. Same scope.
• Google (USA, EU) — Gemini family LLM provider. Same scope.
• Telegram (UAE) — only when you create a Telegram bridge. Bot tokens are encrypted on our side; messages flow Telegram → our webhook → your workspace.
• Vercel (USA, EU) — application hosting and edge CDN.

If you'd rather your prompts never touch our shared LLM accounts, switch to BYOK mode in Settings → BYOK and supply your own provider keys. Your prompts then flow directly from our infrastructure to your provider account.

5. Your rights

We honor the rights granted by GDPR (EU), UU PDP (Indonesia), CCPA (California), and equivalent regimes:

• Access & portability. Settings → Privacy → Export downloads a JSON archive of your conversations, tasks, and workspace configuration.
• Erasure. Settings → Danger Zone → Delete workspace marks the workspace deleted immediately and hard-deletes all rows within 30 days. Stripe records are retained for the period required by tax law (typically 7 years).
• Rectification. Update your name and email in the account menu, or email us.
• Objection & restriction. Email privacy@openbee.ai.

6. Security

See the Security page for specifics. Highlights:

• TLS 1.2+ for all traffic. HSTS enabled.
• Sensitive at-rest fields (Telegram tokens, BYOK keys) encrypted with AES-256-GCM using a key Open Bee never logs.
• API keys stored as SHA-256 hashes — plaintext shown once at creation.
• Workspace isolation enforced at the application layer; every database query is scoped by workspaceId.
• Stripe webhook signature verification.

7. Data retention

• Active accounts — content kept while your account is active.
• Soft-deleted workspaces — 30-day grace period, then hard delete.
• Server logs — 30 days.
• Stripe records — 7 years (tax compliance).

8. International transfers

Workspace content is stored in Singapore (ap-southeast-1). Sub-processors may process data in the USA and EU as listed above. We rely on Standard Contractual Clauses for transfers out of the EEA where required.

9. Children

Open Bee is not directed at children under 13 (16 in the EEA). We do not knowingly collect their data.

10. Changes

Material changes are announced 30 days in advance via email and an in-app banner. The Last updated date at the top reflects the current version.

11. Contact & DPO

Privacy questions, access requests, or complaints: privacy@openbee.ai. EU representatives can also lodge a complaint with their local supervisory authority.