Privacy Policy

Effective: 31 July 2026 · Version: privacy@2026.3

Pending counsel review: the wording of this notice is an engineering draft derived from what the software actually does. It has not been reviewed or approved by legal counsel.

1. Data Controller and Data Operator Roles

Bhapi (“we”, “us”, “our”) operates the bhapi.ai platform. Which role we hold depends on whose data it is:

• Account holder and payer data. For the data of the person who creates and pays for an account, Bhapi is the data controller (controlador).
• Members enrolled by a school or organisation. Where a school, club or other organisation enrols its members, the data processing agreement we use with organisations allocates the data controller (controlador) role to that organisation, with Bhapi acting as data operator / processor (operador) on its instructions. You can raise a data-protection request from your account settings; where the organisation is the controller, the decision on that request rests with that organisation’s administrators.

If you have an account, the Privacy tab of your account settings shows the role recorded for it, and states plainly whether that role has actually been recorded or is only the role presumed from your account type. Where it has not been determined, it is shown as undetermined rather than assumed.

Data Protection Officer: dpo@bhapi.io

2. Data We Collect

Group membership (parent-child relationships and roles) and LLM spend data (API costs, provider, token counts) are also recorded, for access control and budget alerting respectively.

3. Lawful Basis for Processing

• Contract (GDPR Art. 6(1)(b)): Account data, billing, and service delivery.
• Legitimate interest (GDPR Art. 6(1)(f)): Safety monitoring of children’s AI usage where the guardian has enrolled the child. We have conducted a balancing test confirming that the child’s safety interest outweighs the privacy intrusion, given our data minimisation measures.
• Consent (GDPR Art. 6(1)(a)): Processing of children’s data requires verifiable guardian consent, enforced per jurisdiction (see Section 7).
• Legal obligation (GDPR Art. 6(1)(c)): Consent records, audit logs, and data retention as required by COPPA, GDPR, and LGPD.

4. Data Minimisation and What We Store

We follow the principle of data minimisation. To be precise about what that does and does not mean:

• Captured AI prompts and responses are stored. On the browser-extension ingest path they are stored as text; on the /capture/content endpoint they are stored encrypted (Fernet). Storage does not depend on the content having been flagged as risky.
• Personal identifiers detected inside flagged excerpts (such as emails, phone numbers, ID and card numbers, and postal addresses) are automatically masked before the excerpt is stored.
• Content excerpts are kept for up to 365 days. Excerpts containing special-category data are kept for 90 days. Content linked to a mandatory child-safety report is held under legal hold and is not deleted on that schedule.
• We collect only the minimum data necessary for each stated purpose, and we do not use content for advertising.

5. Data Retention

The periods above are the platform defaults. A group administrator can shorten some of them, subject to regulatory minimums; the live values for your group are shown in Settings > Privacy.

When you delete your account, all associated data is deleted immediately via cascading soft-delete, except where retention is required by law.

6. Your Rights (Data Subject Rights)

Under GDPR, you have the following rights:

• Access (Art. 15): Request a copy of your personal data.
• Rectification (Art. 16): Correct inaccurate personal data.
• Erasure (Art. 17): Request deletion of your personal data (“right to be forgotten”).
• Portability (Art. 20): Receive your data in a machine-readable format (ZIP export).
• Object (Art. 21): Object to processing based on legitimate interest.
• Restrict processing (Art. 18): Request limitation of processing.
• Withdraw consent (Art. 7(3)): Withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise these rights, use the compliance features in your dashboard or email contactus@bhapi.io. We respond within 30 days.

7. Children’s Data

Bhapi processes children’s data for safety monitoring purposes. We comply with:

• COPPA (US): Verifiable parental consent required for children under 13.
• GDPR Article 8 (EU): Parental consent required for children under 16.
• LGPD Article 14 (Brazil): Parental consent required for children under 18.
• Australian Privacy Act: Parental consent required for children under 16.

Monitoring cannot begin until the guardian has provided consent for the specific child member. Consent can be withdrawn at any time, which immediately stops data processing for that member.

8. International Transfers and Data Location

All Bhapi user data is hosted in the European Union (Frankfurt, Germany) on cloud infrastructure operated by our provider, encrypted at rest.

• All user data (including data for users in Brazil and other regions) is stored in EU data centres in Frankfurt. Bhapi does not operate data centres in other regions.
• Storage is not the whole picture. Some processing happens outside the EU: our safety classifier sends AI conversation text to Google Vertex AI in the region set by VERTEX_AI_LOCATION, which currently defaults to us-central1 in the United States, and the conversation-summary and image-safety providers listed in Section 9 are also United States services. The “Receives child content?” column in Section 9 shows which of these apply.
• Brazil → European Union. Because all data is stored in Frankfurt, storing the personal data of users in Brazil is itself a permanent international transfer under Article 33 of the LGPD — not an occasional one. Which Article 33 basis applies to that transfer has not been determined; it is under legal review. Where a basis has been recorded for an account it is shown in that account’s settings, and where none has been recorded it is shown there as undeclared — it is never presented as consent or as any other basis by default.
• Onward transfers to sub-processors outside the EEA. Where a sub-processor we use (for example transactional email or content classification) processes data outside the EEA, our requirement is Standard Contractual Clauses (SCCs) approved by the European Commission together with that sub-processor’s data processing agreement. We are still completing the verification that an executed copy is on file for every sub-processor, so we do not present this as established for all of them yet.

9. Third Parties

The table below is generated from the service integrations present in our code, so it lists who can actually receive data rather than a summary written by hand. The last column states plainly whether the provider receives content your child wrote.

CSAM reporting: when our system detects suspected child sexual abuse material, the content is blocked and the incident is recorded for human review. Automated transmission to the NCMEC CyberTipline is implemented in code but switched off pending a legal decision on the reporting destination — no data is sent to NCMEC today.

The second table adds where each recipient sits, and covers two further groups: the biometric processors used for age and identity checks, and the recipients we must disclose even though there is no consent switch for them.

Some of these providers process biometric or biometric-adjacent data (face liveness, identity documents, image and video analysis, perceptual hashing). Child-safety scanning for known illegal material cannot be switched off.

We never sell personal data. We never share children’s data with advertisers.

10. Cookies

We use a single session cookie (bhapi_session) for authentication. This cookie is:

• HttpOnly: Not accessible to JavaScript.
• Secure: Only transmitted over HTTPS in production.
• SameSite=Lax: Protected against CSRF attacks.

We do not use tracking cookies, analytics cookies, or third-party advertising cookies.

11. Security

We protect your data with:

• Encryption at rest (AES-256) and in transit (TLS 1.2+)
• LLM API credentials encrypted with Fernet/Cloud KMS
• bcrypt password hashing
• Rate limiting and brute-force protection
• Multi-tenant data isolation
• Append-only audit logging of privileged and compliance-relevant actions

12. Changes to This Policy

Every version of this notice carries a version identifier and an effective date at the top of the page, and the same values are published in machine-readable form at /legal/versions. When the notice changes we publish it as a new version with a new identifier and effective date. The version in force when parental consent was collected is recorded against that consent record.

We do not send an email when a version changes: no such notification is built. Check the version and effective date at the top of this page for the notice currently in force.

13. Contact

Data Protection Officer: dpo@bhapi.io

For privacy inquiries: contactus@bhapi.io

For general support: contactus@bhapi.io