Privacy Policy

Effective Date: February 14, 2026

Last Updated: March 11, 2026

This Privacy Policy describes how Buda ("we," "us," or "our") collects, uses, and shares information about you when you use our drive-based agent platform, including file storage, workspace collaboration, and AI agent services (collectively, the "Service"). By using the Service, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

1.1 Information You Provide

Account Information: When you create an account, we collect your name, email address, and password.
Payment Information: When you make a purchase, payment details are processed by our third-party payment processor. We do not store complete credit card numbers.
Profile Information: Any additional information you choose to provide, such as profile picture, organization name, or workspace preferences.
Communications: When you contact us, we collect the content of your messages.

1.2 File and Workspace Data

Files and Documents: Files you upload, create, or store in your Buda drive and workspaces.
File Metadata: File names, sizes, types, modification dates, folder structures, and access permissions.
Collaboration Data: Sharing settings, team member access logs, and workspace activity.
AI Agent Interactions: Commands, prompts, chat history, uploaded attachments, selected model, generated responses, generated files or artifacts, scheduled tasks, and skill-related content used within your workspace.

1.3 Information Collected Automatically

Usage Data: How you interact with the Service, including features used, files accessed, agent commands executed, and navigation patterns.
Device Information: Device type, operating system, browser type, and unique device identifiers.
Log Data: Server logs including IP address, access times, API calls, and referring URLs.
Cookies and Similar Technologies: We use cookies, pixels, and similar technologies to collect information and improve the Service.

1.4 Information from Third Parties

OAuth Providers: If you sign in using a third-party service such as Google or GitHub, we receive basic profile information from that provider.
Billing and Payment Providers: If you purchase a paid plan, our billing providers and payment processors may send us subscription, invoice, or payment-status information.
Connected Services: If you connect external services to Buda, such as messaging channels or cloud storage systems, we receive the information needed to enable that connection.

2. How We Use Your Information

We use the information we collect to:

Provide the Service: Manage your drive, process files, enable workspace collaboration, and power AI agent capabilities.
AI Processing: Route your requests, files, prompts, and instructions to the AI model or agent runtime needed to provide chat, search, automation, file understanding, and artifact generation features.
Improve the Service: Analyze usage patterns, troubleshoot issues, and develop new features. We do not use your private files or workspace content to train third-party foundation models for their general use.
Communicate with You: Send transactional emails, security alerts, storage notifications, and (with your consent) product updates.
Ensure Security: Detect, prevent, and respond to fraud, abuse, unauthorized access, and security incidents.
Comply with Legal Obligations: Meet legal requirements, respond to lawful requests, and protect our rights.

We do not sell your personal information or file data. We may share your information in the following circumstances:

3.1 Service Providers

We share information with third-party vendors who perform services on our behalf, which may include:

Authentication Providers: email/password authentication infrastructure and, if you choose social sign-in, Google or GitHub
AI Model and Agent Infrastructure: providers or gateways used to serve the model families available in Buda, including Claude, GPT, and Gemini family models, as well as sandboxed or tool-enabled agent runtimes
Object Storage and File Delivery: S3-compatible or other storage providers used for uploads, downloads, and generated files
Billing and Payment: Creem and related payment processors or merchant-of-record services
Email Delivery: providers such as Resend, Postmark, SendGrid, or AWS SES
Hosting, Logging, and Operational Infrastructure: cloud, monitoring, or security providers used to operate the Service
Connected Communication Channels: services such as Discord, Feishu, or WeCom if you configure those integrations

All service providers are contractually obligated to protect your data and use it only for the purposes we specify.

3.2 Workspace Collaboration

When you share files or invite team members to your workspace, we share relevant data with those authorized users according to your permission settings.

3.3 Legal Requirements

We may disclose information if required by law, subpoena, or other legal process, or if we believe disclosure is necessary to:

Comply with applicable law or legal process
Protect the rights, property, or safety of Buda, our users, or others
Enforce our Terms of Service

3.4 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information is transferred and becomes subject to a different privacy policy.

We may share information with third parties when you give us explicit consent to do so.

4. Data Retention

We retain your personal information and file data for as long as your account is active or as needed to provide the Service. We may retain certain information for longer periods as required by law or for legitimate business purposes (e.g., resolving disputes, enforcing agreements).

When you delete your account, we generally aim to delete or anonymize personal information and workspace content within a commercially reasonable period. Some data may remain in backups, logs, billing records, fraud-prevention records, or legal retention systems for longer where reasonably necessary.

You can delete individual files or workspaces at any time through the Service.

5. Data Security

We implement administrative, technical, and organizational safeguards designed to protect your information and files, including measures such as encrypted transport, access controls, credential protection, logging, and operational monitoring. The exact safeguards may vary by feature, environment, and configured provider.

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

6. Your Rights and Choices

Depending on your location, you may have the following rights:

6.1 Access and Portability

You can access files and certain account data through the Service. Export or portability features may vary by plan, feature, workspace role, and product maturity.

6.2 Correction

You can update or correct inaccurate information through your account settings or by contacting us.

6.3 Deletion

You can delete individual files, workspaces, or your entire account. We will delete your data unless we are required to retain it by law.

6.4 Opt-Out

Marketing Emails: Unsubscribe from marketing emails using the link in the email.
AI Processing: You can disable certain AI features in your workspace settings.
Cookies: Manage cookie preferences through your browser settings.

6.5 Data Processing Objection

You may object to certain processing of your personal information where we rely on legitimate interests as the legal basis.

To exercise these rights, contact us at privacy@buda.dev.

7. AI and Machine Learning

7.1 How We Use AI

Buda uses AI to provide chat, file understanding, semantic search, automation, code or text generation, summaries, and artifact generation. Depending on the feature, workspace configuration, and selected model, your requests may be processed:

Within Buda-managed agent runtimes: including tool-enabled or sandboxed execution environments
Through third-party model providers or compatible gateways: including the Claude, GPT, and Gemini model families made available in the product
Using workspace context: such as prompts, files, folder structure, prior messages, selected skills, and task instructions

7.2 AI Training

We do not use your private files, chat content, or workspace data to train third-party foundation models for their general use. We may use aggregated or de-identified operational data to improve Buda itself, such as reliability, product quality, abuse prevention, and feature performance.

7.3 AI Output and Third-Party Processing

AI outputs may be incomplete, incorrect, outdated, biased, offensive, or unsuitable for your use case. Files, summaries, code, analyses, classifications, or other artifacts shown in Buda may be generated wholly or partly by AI systems. You are responsible for reviewing and validating AI-generated output before you rely on it, share it, publish it, execute it, or use it for legal, financial, employment, security, compliance, or other high-impact decisions.

7.4 Model Availability

The specific model, provider, or processing path used for a request may vary over time based on the model you choose, your plan, feature requirements, availability, safety controls, or infrastructure configuration.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by relevant authorities.

9. Children's Privacy

The Service is not intended for children under 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected such information, we will delete it promptly.

10. Third-Party Links and Integrations

The Service may contain links to third-party websites or integrate with third-party services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

11. Cookies and Tracking Technologies

11.1 Types of Cookies We Use

Type	Purpose
Essential	Required for the Service to function (authentication, security, session management)
Analytics	Help us understand how users interact with the Service (anonymized)
Preferences	Remember your settings, workspace preferences, and UI customizations

11.2 Managing Cookies

You can control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Service.

12. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

Right to know what personal information we collect, use, and disclose
Right to request deletion of your personal information
Right to opt-out of the sale of personal information (we do not sell personal information)
Right to non-discrimination for exercising your privacy rights

If you are in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR):

Legal Basis: We process your data based on consent, contract performance, legal obligations, or legitimate interests.
Data Controller: Buda is the data controller for your personal information.
Supervisory Authority: You have the right to lodge a complaint with your local data protection authority.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last Updated" date. For significant changes, we may also send you an email notification.

15. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

Email: privacy@buda.dev

Data Protection Inquiries: For GDPR-related requests, contact dpo@buda.dev

Security Issues: For security concerns, contact security@buda.dev

By using Buda, you acknowledge that you have read and understood this Privacy Policy.