Data Protection & Privacy Effective Date: September 1, 2026

Privacy Policy

Bai – Bisaya AI (kumustabai.com)

Application Bai – Bisaya AI
Operator Individual Developer (Philippines)

1. Overview

Bai – Bisaya AI ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains what personal data we collect, why we collect it, how it is processed across our technical infrastructure and AI backends, and your rights under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and other applicable privacy regulations.

2. Age Restriction (16+)

Bai is intended solely for individuals aged 16 and older. We do not knowingly collect personal data from anyone under the age of 16. If we become aware that an account belongs to a person under 16, we will promptly terminate the account and delete all associated records.

3. Information We Collect

Account and Authentication Data: We collect your verified email address and basic public profile details (e.g., name or avatar image if provided by Google) when you authenticate via Google Sign-In or request an OTP Magic Link through Better Auth.

Conversations and Prompt Inputs: When you are authenticated, we store your search queries, chat prompts, language learning interactions, and the resulting conversation histories so that you can resume previous discussions across sessions.

Generated Static Content: When you create shareable content cards, the application renders them as HTML components and exports them as PNG images directly within your client browser. These elements are preserved solely as part of your saved conversation thread in the database, rather than in separate public object storage buckets.

Transaction and Credit Records: We maintain a record of your available "load" credit balance, consumption history, and transaction references provided by Polar.sh. We do not collect or store full credit card numbers or banking credentials.

Network and Technical Metadata: Our hosting provider (Cloudflare Workers) automatically processes technical metadata such as your IP address, browser user-agent, device characteristics, and request timestamps to maintain edge security, caching, and rate limiting.

4. Third-Party Service Providers and Data Processors

We engage trusted third-party services to deliver Bai. Data shared with these processors is limited to what is strictly necessary:

  • Hosting and Edge Infrastructure: Cloudflare Workers hosts the web application and handles edge routing and request security.
  • Authentication: Better Auth handles session management, token issuance, and OTP distribution. Google OAuth verifies credentials when you select Google Sign-In.
  • Payment Processing: Polar.sh manages the checkout and billing processes for load credit packages.
  • AI Model Inference Providers: User prompts and conversation context are transmitted to backend AI APIs to generate responses:
    • Gemma 4 via Cloudflare Workers AI: Cloudflare processes inputs and outputs for inference without using customer content to train AI models or improve services.
    • Gemini 3.5-Flash & Flash-Lite via Google Gemini API: Processed according to Google's API service terms. (When operating under billing-enabled enterprise/paid API accounts, Google does not use prompts to train models or conduct human review).
    • GPT OSS 120B via Groq: Groq does not retain inference prompts by default, does not use customer prompts to train foundation AI models, and only retains temporary logs for up to 30 days for service reliability and abuse prevention.

5. Cookies and Local Session Storage

Bai utilizes strictly functional cookies and session tokens managed by Better Auth to maintain authenticated user sessions and verify account states. We do not use persistent advertising cookies or sell data to third-party ad networks.

6. Data Retention and Account Deletion

Retention Period: We retain your conversation history and account details for as long as your account remains open to provide continuous access to your past chats and load balance.

verified_user
Your Right to Erasure: Under the Philippine Data Privacy Act of 2012, you have the right to access, rectify, or request the deletion of your personal data. You may delete your account and associated chat records at any time by emailing contact@kumustabai.com. All associated conversation logs and profile records will be permanently removed within 30 days.

7. Security Measures

We implement administrative and technical safeguards—including TLS encryption in transit, Cloudflare edge security defenses, and secure session tokens—to protect your personal information against unauthorized access, loss, or alteration.

8. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our operational procedures or applicable legal frameworks. When revisions are made, the updated Effective Date at the top of the policy will be modified.

9. Contact Us

For any privacy questions, data access requests, or deletion inquiries, reach out to contact@kumustabai.com.