Privacy Policy

Bahamut is operated by Revolink CY LTD, a company registered in Cyprus. Our registered address is 18 Nikis, Voroklini, 7040, Cyprus.

For anything in this policy, including requests to see or delete your data, write to hello@bahamut.ai.

For the account data of the businesses who subscribe to Bahamut — name, email address, billing details, usage records — Revolink CY LTD is the data controller.

For the conversations themselves, we are a data processor. The business that connected its WhatsApp number is the controller of its customers' messages. We act on that business's instructions and do not decide what those messages are used for.

If you are a guest who messaged a business and you want your data removed, the fastest route is to ask that business. If you would rather come to us, write to hello@bahamut.ai and we will pass it on and act on their instruction.

Messages sent to and from the connected WhatsApp number, including the text, the sender's WhatsApp phone number and display name, timestamps, and any replies Bahamut generated.

Business account data: the account holder's name and email address, the business name, its WhatsApp Business account identifiers, subscription status and invoices.

Operational records: message counts, model usage and cost per conversation, errors, and an audit log of administrative actions taken on the account.

We do not ask for or store payment card numbers. Card details are handled by our payment provider and never reach our servers.

To provide the service the business is paying for: receiving a customer's message, working out an answer, and sending it back. Without the message content there is no product.

To bill accurately and show the business what it is spending.

To keep the service safe and working: detecting abuse, diagnosing faults, and keeping an audit trail of who changed what.

Our legal basis for account data is the performance of our contract with the business, and our legitimate interest in running a secure and solvent service. For conversation data we act on the business's legal basis as its processor.

Meta Platforms Ireland Limited, which operates the WhatsApp Business Platform. Every message necessarily passes through WhatsApp; that is what the product connects to. Meta's own terms govern that leg.

Anthropic, whose Claude models write the replies. Message content is sent to Anthropic's API to generate an answer. Anthropic does not train its models on data submitted through its API.

Railway, which hosts the application and the database, in its EU West region.

Brevo, which sends transactional email such as sign-in links.

Stripe, which handles subscription payments.

We do not sell data, and we do not share it with advertisers. Nobody outside this list receives conversation content.

Application data is stored in the European Union. Some of the providers above process data outside the EU under standard contractual clauses or an equivalent transfer mechanism.

Access tokens and other credentials are encrypted before they are written to the database. Each business's data is isolated at the database level, so one account's queries cannot reach another's rows.

Conversations are retained while the business's account is active, because the product needs history to answer well and the business needs it to check what was said.

When an account is closed, its conversation data is deleted within 30 days, except where we are required to keep records for longer — invoices, for example, which Cypriot tax law requires us to retain.

A business can ask us to delete specific conversations at any time, and we will.

Under the GDPR you can ask for a copy of your data, ask us to correct it, ask us to delete it, object to processing, or ask us to restrict it. Write to hello@bahamut.ai and we will respond within one month.

You also have the right to complain to the Office of the Commissioner for Personal Data Protection in Cyprus, or to the supervisory authority where you live.

Bahamut composes answers using a large language model. These are automated messages, not a person typing, and they can be wrong.

Bahamut does not make decisions that have a legal or similarly significant effect on anyone. Anything sensitive is escalated to the business owner rather than answered automatically.

If we change this policy we will update the date at the top, and tell account holders by email when the change is material.