1. Overview
Bai – Bisaya AI ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains what personal data we collect, why we collect it, how it is processed across our technical infrastructure and AI backends, and your rights under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and other applicable privacy regulations.
2. Age Restriction (16+)
Bai is intended solely for individuals aged 16 and older. We do not knowingly collect personal data from anyone under the age of 16. If we become aware that an account belongs to a person under 16, we will promptly terminate the account and delete all associated records.
3. Information We Collect
Account and Authentication Data: We collect your verified email address and basic public profile details (e.g., name or avatar image if provided by Google) when you authenticate via Google Sign-In or request an OTP Magic Link through Better Auth.
Conversations and Prompt Inputs: When you are authenticated, we store your search queries, chat prompts, language learning interactions, and the resulting conversation histories so that you can resume previous discussions across sessions.
Generated Static Content: When you create shareable content cards, the application renders them as HTML components and exports them as PNG images directly within your client browser. These elements are preserved solely as part of your saved conversation thread in the database, rather than in separate public object storage buckets.
Transaction and Credit Records: We maintain a record of your available "load" credit balance, consumption history, and transaction references provided by Polar.sh. We do not collect or store full credit card numbers or banking credentials.
Network and Technical Metadata: Our hosting provider (Cloudflare Workers) automatically processes technical metadata such as your IP address, browser user-agent, device characteristics, and request timestamps to maintain edge security, caching, and rate limiting.
4. Third-Party Service Providers and Data Processors
We engage trusted third-party services to deliver Bai. Data shared with these processors is limited to what is strictly necessary:
- Hosting and Edge Infrastructure: Cloudflare Workers hosts the web application and handles edge routing and request security.
- Authentication: Better Auth handles session management, token issuance, and OTP distribution. Google OAuth verifies credentials when you select Google Sign-In.
- Payment Processing: Polar.sh manages the checkout and billing processes for load credit packages.
- AI Model Inference Providers: User prompts and conversation context are
transmitted to backend AI APIs to generate responses:
- Gemma 4 via Cloudflare Workers AI: Cloudflare processes inputs and outputs for inference without using customer content to train AI models or improve services.
- Gemini 3.5-Flash & Flash-Lite via Google Gemini API: Processed according to Google's API service terms. (When operating under billing-enabled enterprise/paid API accounts, Google does not use prompts to train models or conduct human review).
- GPT OSS 120B via Groq: Groq does not retain inference prompts by default, does not use customer prompts to train foundation AI models, and only retains temporary logs for up to 30 days for service reliability and abuse prevention.
5. Cookies and Local Session Storage
Bai utilizes strictly functional cookies and session tokens managed by Better Auth to maintain authenticated user sessions and verify account states. We do not use persistent advertising cookies or sell data to third-party ad networks.
6. Data Retention and Account Deletion
Retention Period: We retain your conversation history and account details for as long as your account remains open to provide continuous access to your past chats and load balance.
7. Security Measures
We implement administrative and technical safeguards—including TLS encryption in transit, Cloudflare edge security defenses, and secure session tokens—to protect your personal information against unauthorized access, loss, or alteration.
8. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in our operational procedures or applicable legal frameworks. When revisions are made, the updated Effective Date at the top of the policy will be modified.
9. Contact Us
For any privacy questions, data access requests, or deletion inquiries, reach out to contact@kumustabai.com.