This policy explains what Bonito collects, what we store, who we send it to, and how long we keep it. We have tried to make it specific rather than reassuring — where something is stored, we say so.

1. Information We Collect

Account information (name, email, organisation), usage and billing data (API call counts, tokens, cost, feature usage), and the cloud provider credentials you supply to connect your own accounts. We also collect the content you put into the product — described in section 2.

2. What We Store, and What We Don't

This distinction matters, so it is worth being precise about it.

Gateway traffic is not stored. When you call the gateway directly (/v1/chat/completions and the image and video endpoints), the prompt and the completion are relayed and not persisted. We record only metadata about the call: model, provider, token counts, cost, latency, and status. There is no field in our request log that holds the content of your prompts or responses.

Product features that need memory do store content. Where a feature exists to remember things, the content is retained so it can work:

Agent conversations — full transcripts of agent runs, including the messages sent to an agent and the agent's replies and tool calls, so conversations have history and can be audited.
Knowledge bases — documents you upload are parsed, and the extracted text and its vector embeddings are stored. That extracted text is the search index; retrieval cannot work without it. If you connect your own storage bucket, the original file stays in your bucket, but the extracted text and embeddings still live in our database.
Agent memory — where you enable it, facts extracted from conversations are stored so agents remember across sessions.
Studio conversations — your chat with Bonito Studio, so a build can continue across turns.

We do not use any of it to train models, ours or anyone else's. We do not sell it. We do not access your cloud accounts beyond what is needed to run the models and deployments you configure.

3. Cloud Provider Credentials

Credentials you supply (AWS access keys, Azure service principal secrets, GCP service account JSON, provider API keys) are stored, not merely passed through — we need them to route your requests on your behalf. They are held in a secrets manager, with an encrypted database column (AES-256-GCM) as a fallback store, and are encrypted in transit. They are used only to interact with your own accounts: routing inference, listing and activating models, managing deployments, and reading cost data. We recommend least-privilege credentials as described in our documentation, and you can rotate or remove them at any time.

4. Who We Send Data To

AI providers. Bonito is a routing layer, so your requests are sent onward to the AI provider you have chosen — OpenAI, Anthropic, AWS Bedrock, Google Vertex AI, Azure AI, or Groq. When you connect your own provider accounts, those requests are made with your credentials, against your account, under your agreement with that provider. Where you rely on a Bonito-supplied key (for a demo, or a fallback we operate), the request is made under our account with that provider instead. Failover may send a request to a different provider than the one you first named; that behaviour is the point of the product, and the provider used is recorded in your logs.

Embeddings. Knowledge-base search needs an embedding model. If your organisation has connected one, yours is used. If it has not, the extracted text of your documents is sent to OpenAI's embedding model under a Bonito account so that search works at all. If you would rather that never happen, connect your own embedding-capable provider, or tell us and we will disable the fallback for your organisation.

Infrastructure and operations. We use Railway (application, database and cache hosting), Vercel (website and app hosting), Google Cloud Storage (uploaded knowledge-base files and log archives), Sentry (error monitoring, which can capture request context including identifiers and IP addresses), and Resend (transactional email). Billing is handled by our payment processor. Where you configure an outbound log destination or an integration — Datadog, Splunk, Slack, Notion and similar — data goes there at your direction.

We do not sell data to anyone, and we do not share it with data brokers.

5. How We Use Your Information

To provide and operate the service, to route and bill your usage, to send operational notifications (spend alerts, deployment and model status), to support you when you ask, and to improve the product in aggregate. Not to train models, and not to build advertising profiles.

6. Retention and Deletion

Platform logs are deleted automatically on a schedule that depends on your plan, currently thirty days on Free, forty-five on Starter, sixty on Pro, and ninety on Enterprise and Scale.

Everything else is kept until it is deleted. Request records, audit entries, agent conversations, knowledge-base text and embeddings, and agent memory have no automatic expiry today — they are retained until you remove them or ask us to. We are building scheduled retention for these; until it ships, we would rather tell you they persist than imply they age out.

Deleting a knowledge base deletes its documents, extracted text and embeddings, and removes the stored original files. You can ask us to delete your data, or your whole organisation, at any time by writing to the address in section 9. We will do it within thirty days, by hand where our automated paths do not yet reach, and confirm when it is done — except where we are required to retain something for legal or accounting reasons.

7. Security

Data is encrypted in transit and at rest. Every record in the platform is scoped to an organisation, and queries are filtered by the organisation of the authenticated user. Access to production systems is restricted and audit-logged. We are working toward SOC 2; we are not certified today, and we would rather say that plainly than imply otherwise. If you are evaluating Bonito and need a security review, a data-processing agreement, or a subprocessor list, write to us and we will provide what we have.

8. Cookies and Analytics

We use a small number of third-party services to understand how visitors use the site and to measure our advertising. They are loaded across the site, including on signed-in pages, and neither of them receives the content of your AI requests, your knowledge-base documents, or your agent conversations.

Microsoft Clarity — product analytics. Records anonymised interaction data (page views, clicks, scroll depth, session replays) so we can see where the site is confusing. Sensitive input fields are masked.
OpenAI — advertising measurement for the ads we run in ChatGPT. It tells us when a visit that began with one of our ads ends in a sign-up, so we can tell whether the advertising is worth paying for. It records that a sign-up happened, not who you are.

These services set cookies or use similar browser storage. You can block them with your browser's privacy settings or an ad blocker, and the site will continue to work normally. We do not sell or share this data with data brokers, and we do not use it to build advertising profiles beyond measuring our own campaigns.

9. Your Rights and How to Reach Us

You can ask what we hold about you, ask for a copy, ask us to correct it, or ask us to delete it. Bonito AI Enterprise Inc. is an Ontario company and handles personal information in accordance with Canadian privacy law; if you are in a jurisdiction with additional rights, such as the UK or EU, we will honour those requests as well. Write to support@getbonito.com and a person will answer.

Privacy Policy