Legal

Privacy Policy

Last updated September 4, 2026

BerryBell ("we", "us") builds a multi-agent AI app builder. This Privacy Policy explains what personal information we collect, why we collect it, who we share it with, and the choices and rights you have. It applies to our website, the BerryBell app builder, and related services (the "Services"), and is part of, and should be read with, our Terms of Service.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs"). Where we handle personal data of individuals in the EEA, UK or Switzerland, the GDPR/UK GDPR sections below also apply; where we handle personal information of California or other US state residents, those sections apply. In this policy "personal information" and "personal data" are used interchangeably.

1. Scope of this policy

This policy covers personal data we handle as a controller — for example, your account and billing details. Where you build an application on BerryBell and that application collects data from your own end users, you are the controller of that data and we act as a processor on your behalf. You are responsible for having a lawful basis and your own privacy notice for the apps you build. Enterprise customers can request a Data Processing Agreement (DPA).

2. Definitions

Personal data — information relating to an identified or identifiable person.
Project content — the prompts, code, assets and application data you create or upload in the Services.
Usage data — technical and operational data about how the Services are used (logs, telemetry, metering).
AI providers — third-party model providers that power the Services (Anthropic and OpenAI).
Infrastructure providers — third parties used to run the Services and the apps you deploy (for example Neon, Cloudflare, Amazon Web Services and Stripe).

3. Information we collect

a) Information you give us

Account data — name, email address and authentication details (including via an OAuth provider if you sign in that way).
Billing data — plan, transaction history and the last digits/brand of your card. Card details are collected and stored by our payment processor (Stripe); we do not store full card numbers.
Marketing and support data — details you submit through our contact, enterprise or newsletter forms (such as your name, email, company and message, the page you sent it from, and any campaign parameters described in section 12), which we store in our own database hosted by Cloudflare.
Project content — prompts and any files, data or credentials you choose to add to a project.

b) Information we collect automatically

Log data — IP address, browser and device type, pages viewed, timestamps, referring page and error data.
Usage and metering data — builds run, credits consumed, and feature usage, used for billing, security and product improvement.
Cookies — see section 12.

c) What we ask you not to submit

Please do not upload special-category or specially regulated data — such as health records, government identifiers, biometric data, children's data or payment card numbers — into project content unless we have expressly agreed in writing that the Services may be used for it.

4. How we use information (and legal bases)

We use personal data to:

Provide the Services — create and run builds, deploy and host your apps, and provide support. Basis: performance of a contract.
Bill and meter usage — process payments and track credit consumption. Basis: contract; legal obligation.
Secure the Services — detect, prevent and investigate fraud, abuse and security incidents. Basis: legitimate interests.
Improve the Services — analyse aggregated usage to fix problems and prioritise features. Basis: legitimate interests.
Communicate with you — send service, security and billing notices; and, with your consent where required, marketing. Basis: contract; consent; legitimate interests.
Comply with law — meet tax, accounting and legal obligations, and respond to lawful requests. Basis: legal obligation.

Under Australian law, we collect personal information only where it is reasonably necessary for our functions and activities (APP 3), and we use and disclose it only for the purpose we collected it, a directly related purpose you would reasonably expect, or as otherwise permitted by the Privacy Act (APP 6). The "legal bases" listed above are the GDPR concepts that apply to individuals in the EEA and UK.

We do not carry out automated decision-making that produces legal or similarly significant effects about you.

5. AI processing and model training

To generate builds, your prompts and the relevant project context are transmitted to third-party AI providers (Anthropic and OpenAI) for processing, and the resulting output is returned to you. This is necessary to provide the Services.

We do not use your private project content to train foundation models, and we do not sell your data. We may use aggregated or de-identified information — which does not identify you or your projects — to measure reliability and improve the product. Our AI providers process API data under their own terms; we select providers that do not train their models on API inputs by default, but you should review their terms if this matters to you.

6. Sub-processors and third parties

We use a small number of vendors to run the Services. Each is bound by contractual terms requiring appropriate confidentiality and security, and to process data only on our instructions where they act as a processor.

Anthropic, OpenAI — AI model inference (prompts and project context).
Neon — managed Postgres databases for generated applications.
Cloudflare — hosting, CDN, DNS/SSL, databases (including website enquiries), object storage and bot protection (Turnstile).
Amazon Web Services — platform compute, configuration and object storage.
Stripe — subscription billing and payment processing.
Analytics and email providers — product analytics and transactional email.

We will keep an up-to-date list available on request and, for customers with a DPA, give reasonable notice of new sub-processors so you can object.

We do not sell your personal data and we do not share it for cross-context behavioural advertising. We disclose personal data only to: the sub-processors above; professional advisers (legal, accounting); authorities where required by law or valid legal process; and an acquirer in connection with a merger, acquisition or sale of assets (subject to this policy). Where we receive a law enforcement request, we will notify affected customers unless legally prohibited.

8. International data transfers

Overseas disclosure (APP 8). We are based in Australia, but our providers are largely overseas. By using the Services you acknowledge that your personal information may be disclosed to recipients located outside Australia — principally in the United States (for example Anthropic, OpenAI, Stripe, Neon and Amazon Web Services) and in other countries where Cloudflare operates edge infrastructure. Before disclosing personal information overseas we take reasonable steps to ensure recipients handle it consistently with the APPs, including through contractual protections. You acknowledge that where you consent to an overseas disclosure, APP 8.1 may not apply and we may not be accountable under the Privacy Act for that recipient's handling.

We and our providers may process data in countries other than yours. Where personal data is transferred out of the EEA, UK or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards — typically the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum and, where relevant, the Swiss addendum — plus supplementary measures as needed. You can request details of the safeguards we use.

9. How long we keep information

We keep personal data only as long as necessary for the purposes above. As a general guide:

Account and project data — for the life of your account, and deleted within approximately 30 days of account closure.
Logs and telemetry — typically up to 90 days.
Billing and tax records — as long as required by law (often 7 years).
Backups — residual copies may persist for a short period (typically up to 90 days) before being overwritten.

We may retain limited data longer where needed to resolve disputes, prevent fraud or comply with law.

10. Security

We use industry-standard safeguards including encryption in transit and at rest, role-based access control, isolated build sandboxes, least-privilege access to production, logging and monitoring. We aim to align our practices with SOC 2 principles; we are not SOC 2 certified and hold no audit report. No system is perfectly secure, and we cannot guarantee absolute security. We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure (APP 11), and to destroy or de-identify it when no longer needed. Notifiable Data Breaches. If we suffer an eligible data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner ("OAIC") as required by the Notifiable Data Breaches scheme, and any other regulator as required by law. Report a suspected vulnerability to security@berrybell.ai. See our security overview for more.

11. Your privacy rights

Australia. You may request access to the personal information we hold about you (APP 12) and ask us to correct it if it is inaccurate, out of date, incomplete or misleading (APP 13). We will respond within a reasonable period (usually 30 days). We may refuse access or correction in limited circumstances permitted by the Privacy Act, and if we do we will tell you why and how to complain. We do not charge for making a request, though we may charge a reasonable cost for providing access.

Other regions. Depending on where you live, you may also have the right to: access a copy of your personal data; correct inaccurate data; delete your data; port your data; object to or restrict certain processing; and withdraw consent at any time (without affecting prior processing). If you are in the US, you may also have rights to opt out of the sale or sharing of personal data and targeted advertising — we do not sell or share personal data in that sense — and a right to appeal a refused request.

To exercise any right, email privacy@berrybell.ai. We will verify your request and respond within the period required by law (generally 30 days). We will not discriminate against you for exercising your rights.

12. Cookies and tracking

We use a small set of cookies and similar technologies:

Strictly necessary — sign-in, security and bot protection. These are required to run the site and do not need consent.
Analytics — aggregate usage measurement to improve the product.
Marketing attribution — campaign parameters (UTM tags) from the link you arrived on, sent with an enquiry so we know which campaign it came from. With your consent we keep them in your browser's session storage (not a cookie) for that visit, so they still apply if you send an enquiry from a later page.

Analytics and marketing storage is used only after you consent. Our consent banner records your choice in your browser, and if you reject, campaign parameters are not kept between pages. We do not load third-party marketing scripts. You can change your choice at any time via the "Cookies" link in the site footer, or through your browser controls. We aim to honour Global Privacy Control signals where legally required.

13. Children

The Services are not directed to children and are intended for users aged 18 or over. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

14. Third-party sites and integrations

The Services link to and integrate with third-party products (for example GitHub, Slack, Notion, Google and Stripe). When you connect an integration, data is shared with that provider under its own privacy policy. We are not responsible for third-party practices; please review their policies before connecting.

15. Communications

We send service, security and billing messages that are necessary to your account and cannot be opted out of while you hold one. Marketing emails are sent consistently with APP 7 and the Spam Act 2003 (Cth): they identify us, include a functional unsubscribe facility, and are only sent where we have your consent or an existing business relationship. You can opt out at any time without affecting your use of the Services, and we will action unsubscribes promptly.

16. Changes to this policy

We may update this policy. We will change the date above and, for material changes that reduce your rights or materially expand our processing, give advance notice by email or an in-product notice before the change takes effect.

17. Contact and complaints

Controller: BerryBell. For privacy questions or requests, email privacy@berrybell.ai.

Complaints. If you believe we have breached the APPs, please complain to us first at privacy@berrybell.ai. We will acknowledge your complaint, investigate, and respond in writing — usually within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or 1300 363 992.

Individuals in the EEA, UK or Switzerland may also complain to their local supervisory authority (for example the UK Information Commissioner's Office).

18. Severability and entire agreement

If any provision of this policy is held unenforceable, it will be interpreted to reflect its intent as far as possible and the remaining provisions stay in effect. This policy, together with our Terms of Service, forms the entire agreement between you and us regarding privacy and data protection for the Services.