This policy explains what personal information BitsRun handles and what we do with it. We wrote it to be read, and we give everyone the same rights wherever they live.
The short version
- We never log or store your prompts or your model outputs, and we never train on them or on your models.
- We keep what we need to sign you in, run your endpoints, bill you correctly and keep the service safe.
- We do not sell personal information, show ads, or share data for advertising.
- Your data is stored in the United States.
- You can delete your account yourself at any time, and you can ask us for a copy, a correction or deletion of what we hold.
Who we are
BitsRun is a product of Cabrera-Lalama Enterprises LLC, a New Jersey limited liability company doing business as Web Bits, 355 Chestnut St, 2nd Floor, Union, NJ 07083, USA. We are the business responsible for the personal information described here (the "controller" in some laws).
Privacy questions and requests: privacy@bitsrun.com. You can also write to support@bitsrun.com or to the address above.
What we never keep
- Prompts and outputs. The text, images, audio or documents you send to a model, and what the model sends back, pass through our systems in memory to reach the model and return to you. They are not written to our logs or databases.
- Your API keys. We keep only a fingerprint of each key and its first few characters, so a key can be checked and recognized but never read back.
- Card details. Payments are handled by Link, a Stripe company. We never see or store your card number.
- Remote control content. Sessions between the
bitsrunterminal agent and your phone or browser are end-to-end encrypted. Our relay passes them along and cannot read them.
What we collect and how long we keep it
| What | Why we need it | How long we keep it |
|---|---|---|
| Your email address and a sign-in id | To sign you in and send account emails | Until you delete your account |
| Your first and last name | To know who holds the account, address you, and help when you contact us or dispute a charge | Until you delete your account |
| Passkeys (the public part only) | To sign you in without a code | Until you remove them or delete your account |
| Account settings: plan, balance, alert settings, payment customer and subscription ids | To run your account and billing | While your account is open |
| The record of which version of our Terms you accepted, and when | To show what was agreed | With the billing records |
| Your confirmation that you are 18 or older, and when you gave it | To show that the account holder said they are an adult | With the billing records |
| Your choice about product news emails, and when you made it | To send them only if you asked for them | Until you delete your account |
| Endpoints: name, model, GPU size, settings | To run your endpoints | Until you delete your account. Deleted endpoints stay in your billing history |
| API key names and fingerprints | To check requests and show you your keys | Until you delete them. Revoked keys are kept for 90 days, then removed |
| Models you upload or copy from Hugging Face | To serve your endpoints | Until you delete them, or 7 days after your balance goes below $0 (we email you first, twice). Deleted files leave our storage history within 7 days |
| Your Hugging Face token, encrypted | To check your access and copy the repositories you choose | Until you remove it |
| Usage and billing records: running time, cost, top-ups, refunds, credit changes (hourly detail is kept for 40 days, daily totals longer) | To bill you correctly and meet tax and accounting duties | As long as tax and accounting law requires, usually up to 7 years |
| Request records for calls to your endpoints: time, endpoint, which key, a scrambled form of the caller's IP address, and the caller's approximate location (country and state or province) and network provider | To show who used an endpoint, stop abuse, follow sanctions law and settle billing disputes | 180 days |
| Storage access records: when a model file is uploaded or read, including the IP address of an upload | To investigate security incidents | 180 days |
| Service logs: request ids, timings and error codes, with no prompts or outputs | To find and fix faults | 180 days |
| Signed-in browsers, command line sessions and paired computers and devices: a name, when added and last used | So you can see and revoke them | While they are active. A revoked computer or device is kept, marked as revoked, so it cannot be used again. When you delete your account, all of them are erased |
| Push notification details from our mobile apps: a notification token, an installation id, the device name and your notification choices | To send the notifications you turned on | Until you sign out of the app, remove the device or delete your account |
| Remote control session records: which account, computer and device connected, and when | To connect your devices and protect the relay | Up to 24 hours after a session was last active |
| Emails you send to support and our replies, including your name, address, attachments and mail headers | To answer you, follow up and handle disputes | 2 years, then deleted automatically |
The scrambled IP address can be matched against an address you give us, but it cannot be read back. We do not keep the city or the raw IP address of callers to your endpoints.
Like any online service, our systems and our hosting provider process the IP address of each connection to deliver pages and block attacks.
We do not buy information about you from others. We receive a payment confirmation from Link (the amount, the date and a payment id) so we can add your credit.
The terminal agent and apps
- The
bitsrunterminal agent and command line tool run on your computer. Your sessions, code and settings stay there. Prompts go from your computer straight to the model provider you chose; if that is not BitsRun, that provider's privacy policy applies, not this one. API keys for other providers are kept in your computer's own secure storage and are not sent to us. - The mobile apps keep your sign-in in the device's secure storage. Notifications are delivered through Apple (for iPhone and iPad) and Google (for Android), who receive the notification token and the notification itself. We keep notifications free of prompts and outputs.
- We do not put advertising or tracking tools in the site, the apps or the terminal agent.
Cookies and browser storage
We do not use cookies. The dashboard keeps your sign-in and a few display settings in your browser's own storage so the site works; this is not used to track you.
We do not run analytics on the site or dashboard today. If we add analytics, we will choose a tool that does not use cookies or build profiles of visitors, and we will update this policy first.
How we use information
We use personal information only to:
- provide the service: sign you in, run your endpoints, show your usage (this is needed for our contract with you),
- bill you, keep accounting records and handle refunds and disputes (contract and legal duties),
- keep the service safe: prevent fraud and abuse, follow sanctions law, investigate incidents (our legitimate interest in a safe service, and legal duties),
- send service emails: sign-in codes, balance and endpoint alerts, security notices, and notices about changes to our terms (contract),
- answer you when you write to us (our legitimate interest in helping you).
We send product news and tips by email only if you ask for them by ticking the box when you set up your account or on the Account page (your consent). The box is never ticked for you. You can turn them off any time on the Account page, and every such email will have an unsubscribe link.
We do not make decisions about you by automated means that have legal or similarly significant effects.
Who helps us run BitsRun
We share personal information only with companies that provide a service to us, and only what each needs:
| Company | What they do for us |
|---|---|
| Amazon Web Services | Hosting, storage, sign-in, sending email, receiving support email and scanning it for spam and viruses |
| Stripe and Link | Payments. Link is the seller of record for purchases and handles your payment details under its own privacy policy |
| Apple and Google | Delivering push notifications to the mobile apps |
| Hugging Face | Only when you ask us to fetch a model: we contact it with your token to check access and copy the repository |
| Ollama registry | Only when you deploy a model by its Ollama name: we fetch the public model files. No personal information is sent |
We may also disclose information:
- when the law requires it, such as a valid court order. We ask for the proper legal process, give only what is required, and tell you when we are allowed to;
- to report child sexual abuse material to the National Center for Missing and Exploited Children, as United States law requires;
- to a company that takes over BitsRun, which must keep honoring this policy. We will tell you before your information moves.
We do not sell or license personal information, including sensitive information, and we do not share it for advertising.
Where your data is
Your account data and stored models are kept in the United States, and your models run on GPUs in the United States. If you use BitsRun from another country, you are sending your information directly to us in the United States, where privacy laws may differ from those where you live.
How we protect it
- Data is encrypted in transit and at rest.
- API keys are kept only as fingerprints. Hugging Face tokens are encrypted with a separate key.
- Each customer's stored models are kept separate and are used only for that customer's endpoints.
- Staff access is limited to what a task needs and is protected by multi-factor sign-in.
No system is perfectly secure. If a security incident affects your personal information, we will tell you by email without unreasonable delay, and we will notify the authorities the law requires.
Your choices and rights
Wherever you live, you can:
- See and change your account details in the dashboard.
- Delete endpoints, keys, uploads, tokens and devices yourself at any time.
- Delete your account yourself in the dashboard or the apps. The delete account page lists what is deleted and what we must keep.
- Ask for a copy of the personal information we hold about you, in a common format.
- Ask us to correct something that is wrong.
- Ask us to delete information, including support emails, before its normal time.
- Object to a use of your information, or ask us to limit it.
To ask, email privacy@bitsrun.com from the address you sign in with. That is how we check it is you; we may ask one more question if we are not sure. We answer within 30 days. If a request is complicated we may need up to 30 more days and will tell you why. Requests are free.
If we say no to a request, we will explain why, and you can ask us to look again by replying to that message. We will answer the appeal within 45 days. You also have the right to complain to the data protection or consumer authority where you live.
We will never treat you worse for using these rights.
Some information we must keep even if you ask us to delete it, such as billing records the law requires. We will tell you when that applies.
Personal information in your prompts and models
You decide what you send to your models and what your models contain. If your prompts, files or models include personal information about other people, you are responsible for having the right to use it, and for your own privacy notice to your users. We handle that content only to run your endpoints for you, as described above, and we do not store prompts or outputs.
If your organization needs a data processing agreement with us, email privacy@bitsrun.com.
Children
BitsRun is for adults. You must be at least 18 to have an account, and we do not knowingly collect information from children. If you believe a child has given us information, email privacy@bitsrun.com and we will delete it.
More detail for some places
United States. If you are protected under New Jersey's Daniel's Law, you can ask us in writing at privacy@bitsrun.com not to disclose your home address or unpublished phone number, and we act on it within 10 business days. We do not sell personal information, share it for cross-context advertising, or use sensitive information to learn things about you. Because we do neither, there is nothing to opt out of. The rights above apply to you whatever state you live in.
United Kingdom and European Economic Area. The reasons the law allows us to use your information are given under "How we use information": our contract with you, our legal duties, and our legitimate interests in running a safe service and answering you. You can complain to your data protection authority, such as the Information Commissioner's Office in the UK.
Latin America. The rights above apply to you, including the rights your local law names, such as access, correction, deletion and objection. You can use them by writing to privacy@bitsrun.com, and you can complain to your national data protection authority.
Changes to this policy
We update this policy when what we do changes. The date and version at the top show the current one. If a change affects how we use information we already hold in a way that matters to you, we will email you at least 30 days before it takes effect.
Contact
- Privacy: privacy@bitsrun.com
- Support: support@bitsrun.com
- Mail: Cabrera-Lalama Enterprises LLC, doing business as Web Bits, 355 Chestnut St, 2nd Floor, Union, NJ 07083, USA