Privacy
Bobbin is operated by Thoughtgears Ltd, a company registered in the United Kingdom. This policy explains what we process and why. Last updated 5 August 2026.
Who we are
Thoughtgears Ltd — contactprivacy@getbobbin.dev. For customer telemetry we act as a data processor; you remain the controller of anything inside your Google Cloud projects.
What we process
| Data | Why | Retention |
|---|---|---|
| Account details (name, work email, company) | To create your tenant, contact you, and bill you | While you are a customer, then 6 years for tax records |
| Telemetry excerpts read during an investigation | To determine the cause of an alert | Not stored — read transiently at investigation time |
| Investigation reports and transcripts | So you can re-read an answer, and so we can improve accuracy | While you are a customer; deleted with your tenant |
| Early-access requests (email, optional context) | To contact you about access | Until you ask us to delete it, or 12 months of no contact |
Transcripts are redacted before storage: email addresses and IP addresses found in log excerpts are replaced. We do not deliberately collect personal data from your telemetry, but logs are your data and may contain it — which is why redaction runs by default and why we store excerpts rather than streams.
Where it is stored
Google Cloud, region europe-west1 (Belgium). Model inference runs on Google's Vertex AI within Google's infrastructure; prompts are not used to train Google's models.
Who we share it with
- Google Cloud — hosting, storage, model inference.
- Slack — to deliver the report into your workspace.
- GitHub — commit and diff reads, only if you install our app.
- Resend — to send you email from accounts@thoughtgears.co.uk.
- Stripe — payment processing, once billing is live.
We do not sell data, and we do not run advertising or third-party tracking on this site.
Cookies and analytics
This site sets no cookies and runs no analytics scripts. Our host records standard server-side request counts, which we use to know whether anyone visited.
Your rights
Under UK GDPR you may request access to, correction of, or deletion of your personal data, and you may object to processing or request portability. Emailprivacy@getbobbin.dev and we will respond within 30 days. You may also complain to the Information Commissioner's Office (ico.org.uk).
Deleting your data
Ask us and we delete your tenant, its reports and transcripts, and its credentials. Revoking the four IAM roles stops all access immediately, whether or not you have told us first.
Changes
If this policy changes materially we will email customers rather than quietly editing the page.