Privacy Policy

1. Who we are and what this policy covers

Mochi Platform, Inc., a Delaware corporation doing business as Bitsbase (“Bitsbase,” “we,” “us,” or “our”), provides AI teammates called Bits, Studio for creating apps, websites and tools, and workspaces for people and Bits to work together. This Privacy Policy explains how we collect, use, disclose and retain personal information when you visit our websites, request access, use these services, connect supported tools or messaging channels, or communicate with us.

The policy covers our Business, Agencies, Founders, Creators and Personal offerings. It does not make every feature available in every plan, integration or region.

Our role depends on the information. We determine how account, billing, website and direct relationship information is used and generally act as its controller or business. When an organization, agency or creator supplies personal information for us to process on its behalf, we act as its processor or service provider to the extent applicable, under its instructions and the applicable agreement. This policy does not expand those instructions or replace a required data-processing agreement.

Apps built by our customers. The person or organization operating a Studio-built app, community, newsletter, course, booking page or other product is responsible for its own privacy practices. Its privacy notice governs its collection and use of your information. We may process that information to host or support the app on the operator’s behalf. Our own account, billing, security and legal-compliance processing remains covered by this policy where applicable.

2. Information we collect

The information depends on what you provide, the features you use and the permissions you or an authorized administrator grant. You may choose not to provide information, but we may be unable to create your account or perform a requested task without the information it requires.

Account and contact information. Name, email, profile information, organization, role, workspace membership, account identifiers and access-request details. Google sign-in can provide the identity information you authorize. One-time email links and sign-in services generate authentication and session records. Do not send us your Google password.

Content and work. Prompts, messages, files, code, images, audio, video, notes, instructions, outputs, app projects, revisions and feedback you provide or create. Where you choose a task-recording or teaching feature, this can include the recording, narration, transcript and on-screen information you choose to capture. Together with the connected-service content and saved task context described below, we call this material “Customer Content.”

Connected-service information. Depending on the connection and scope, this can include email and attachments, calendar entries, contacts, documents, spreadsheets, customer and sales records, tasks, website information, and tool results. Connected social-media features may retrieve profile information, posts, engagement metrics and related response data to prepare the analysis or drafts you request. Authorization tokens, account identifiers and connection permissions are handled by Bitsbase or its integration providers as needed to maintain the connection.

Messaging information. When you interact through a supported channel such as Slack, Microsoft Teams, iMessage or WhatsApp, we process messages, attachments, sender identifiers, relevant conversation context and delivery information supplied to the integration. We do not receive every conversation in an external account merely because you use that channel; access depends on its permissions and the integration’s configuration.

Memory and execution records. Saved preferences, task context, summaries, decisions, routine instructions, schedules, approvals, tool activity and results. Some information is inferred from your instructions or interactions to perform the work, rather than supplied as a separate profile field.

Payment and transaction information. Subscription and credit purchases, invoices, billing contact information, payment status and payment references. Payment processors collect payment details needed to process transactions. Where a Bit helps arrange a purchase or booking, we process the details needed for your request. Customer apps may process their own customers’ transaction information as directed by their operators.

Technical and support information. IP address, browser and device information, approximate location inferred from an IP address, session identifiers, referral information, usage and credit records, error and security logs, and correspondence with us. A support request may contain screenshots or other Customer Content you choose to include.

Sensitive information. Your messages or connected sources may contain sensitive information, such as private communications, health-related appointment details or financial information. Provide only what is necessary for an authorized task. We do not use sensitive information to build advertising profiles. Do not put passwords, private keys or full payment credentials into prompts; use the designated connection or payment flow.

3. Where information comes from and why we use it

We receive information from you; your device; your workspace administrator or collaborators; services you authorize; operators of customer apps; payment and technical providers; and public sources used for research you request. We may also receive professional contact information through referrals, direct business interactions or public professional sources for relevant business communications, subject to applicable law.

We use information to create and manage accounts; provide access invitations; run Bits, Studio and workspaces; retrieve authorized context; generate and revise outputs; execute approved actions and routines; maintain relevant memory; publish and host customer apps; process payments and credits; and provide support.

We also use information to protect the service, investigate misuse, diagnose errors, understand feature usage and reliability, communicate about service changes, satisfy legal obligations, maintain required records and resolve disputes. Product improvement does not override the no-training commitment in Section 4 or the restrictions on connected-service data in Section 6.

We may send relevant product announcements and marketing communications where permitted. You can opt out as described below. An access request is not consent to unrelated third-party marketing. Information collected under an earlier notice remains subject to the commitments made when it was collected; new purposes require the notice, lawful basis and consent, where required, applicable to that change.

4. AI processing, memory and model training

We do not use Customer Content to train or fine-tune AI models. This applies to Free and paid plans. The AI services we engage to process Customer Content on our behalf must operate under terms and settings that do not permit training on that content. We do not opt customer traffic into provider training or feedback programs that would conflict with this commitment.

To perform a task, Bitsbase sends relevant prompts and context to the AI service used for that task. That context may include connected-source information, files, code, messages, saved memory and tool results. A task may involve more than one model or processing service.

Using saved context to personalize a response or retrieve relevant information is different from training an underlying model. Saved memory is nevertheless information we process and is subject to the access, retention and deletion provisions in this policy.

No training does not mean no processing, storage or human access. Providers may retain or review information for service delivery, security, abuse prevention or legal compliance under the applicable commercial arrangements. This policy does not promise zero retention, end-to-end encryption of AI processing, or that no authorized person can ever review information.

When you deliberately send information to a separate third-party service using your own account, that service’s processing is also governed by its own terms. This is distinct from AI providers processing content on Bitsbase’s behalf and does not create an exception to our commitments for those providers.

5. Who receives information

Providers working for us. We disclose information needed for hosting, storage, AI processing, authentication, integration management, message delivery, payments, support and security. These providers may use it only to perform their contracted services, for permitted service-security purposes, or to meet legal obligations, consistently with our commitments. Our infrastructure providers include Vercel, Railway and Neon, and we use Stripe for payment processing. Other providers may be involved depending on the feature or connection you use. You can request information about the providers involved in processing your information using the contact details below.

Your workspace and collaborators. Information you share with a workspace, channel, project or app is available according to its access settings. Administrators may manage membership, connected services and workspace data to the extent their role and product capabilities permit. Check your organization’s policies before placing personal information in a work account. A private message label is not a promise that information is inaccessible under every administrative or legal process.

Your chosen recipients and connected services. We disclose information when you direct a Bit to send a message, update an external record, arrange a transaction or share a document, or when an approved routine does so within its authorized scope. The recipient or connected service may keep its own copy.

Published apps and content. Publishing or sharing can expose information to the users or audience you select, including the public. Public material can be copied or indexed by others. Changing access later does not necessarily remove copies already obtained.

Legal, safety and corporate matters. We may disclose information to comply with lawful requests; establish or defend rights; prevent fraud or harm; and obtain confidential professional advice. Information may be transferred in a merger, financing, acquisition or sale of assets, subject to confidentiality, applicable law and any additional consent restrictions imposed by a connected-service provider. It remains subject to the applicable privacy commitments.

We do not sell personal information or share it for cross-context behavioral advertising, and we do not use it for targeted advertising. Providing your content to a processor to complete your task is different from making it available for advertising. The same no-sale and no-advertising commitments apply to connected-service information. These commitments concern our own use of information. They do not prevent an organization from directing us to prepare its marketing under its instructions, subject to applicable law and connected-service restrictions; that organization is responsible for its own advertising practices.

6. Connected accounts and Google or YouTube data

Connecting a service allows access only within the permissions granted through its authorization flow and the supported functionality. Review those permissions, including whether a connection is shared. Disconnect through Bitsbase or revoke authorization with the provider. Disconnecting normally prevents new access; it does not, by itself, delete information already imported or sent elsewhere. Specific provider deletion rules may require more, as described below.

Google services. Where you connect Gmail, Calendar, Drive, Sheets or another supported Google service, we use the authorized information to provide the user-facing features you request, such as finding documents, summarizing messages, scheduling or preparing a reply. Relevant data may be sent to contracted AI and infrastructure services as necessary for those features and with the required authorization.

Bitsbase’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements, and, where applicable, the Google Workspace user data and developer policy. We do not sell that information, use it for advertising or train AI models on it. Human access is limited to circumstances the applicable policy allows, such as your affirmative permission to view specified information, necessary security investigations or legal obligations. Additional restrictions apply to transfers in corporate transactions. These requirements also apply to derived information where required by those policies.

YouTube. Supported YouTube connections use YouTube API Services. The Google Privacy Policy applies to Google’s processing. You can revoke access through Google’s security permissions settings, in addition to disconnecting in Bitsbase. You can request deletion of stored YouTube data using the contact details in Section 16. When you request deletion, close your account, or revoke consent through Bitsbase, we delete the applicable stored YouTube data as soon as possible and within seven calendar days, as required by YouTube’s policies. If you revoke access through Google’s settings, deletion follows YouTube’s applicable requirements, including its 30-calendar-day maximum for that route. A shorter applicable legal or provider deadline takes precedence. Deleting our copy does not delete information held by YouTube.

Other connected platforms, including social networks, messaging services and customer-selected tools, apply their own terms and privacy policies. Availability of a connection does not mean that Bitsbase is affiliated with or endorsed by that platform.

7. Cookies and similar technologies

We use cookies and similar session technologies to keep you signed in and operate the Services. Technical providers receive device and request information needed to deliver and secure our websites. We do not use advertising cookies to sell or share personal information for cross-context behavioral advertising.

You can manage or delete cookies through your browser settings. Blocking essential cookies can prevent sign-in or other features. Where applicable law requires consent for an optional technology, we provide the relevant information and obtain consent before enabling it. Our no-sale and no-targeted-advertising commitments apply whether or not your browser sends a Do Not Track or Global Privacy Control signal. We honor opt-out preference signals where required by applicable law.

8. How long we keep information

We keep information only for as long as reasonably necessary for the purposes described here, subject to applicable law, customer instructions and connected-service restrictions. The criteria differ by record:

Deleting a chat, disconnecting a service, canceling a subscription, deleting memory and closing an account are different actions. A deletion request may need to address more than one category. Backup copies may take additional time to expire or be removed; they must not be used to circumvent a valid deletion request. We do not promise immediate deletion from every backup or third-party system. Applicable legal and provider deadlines still govern.

Provider retention is separate. Services processing a task may have their own permitted retention periods. We take those periods, applicable provider restrictions and our agreements into account when handling deletion requests.

9. Security

We use administrative, technical and organizational safeguards intended to protect information. Our Security page describes the service’s security approach. No online service can guarantee absolute security.

The use of an independently audited infrastructure provider does not mean Bitsbase itself has obtained that provider’s certification. Customer-managed encryption keys, a particular hosting location, a specific audit or a response-time commitment are not promised by this Privacy Policy. Any separately agreed commitment must be documented and supported by the applicable service configuration.

10. Your choices and privacy requests

You can request access to, correction of or deletion of your personal information by emailing hello@bitsbase.com with the subject “Privacy request.” You may also write to the address in Section 16. Specify the account or workspace and the request, without sending passwords or unnecessary sensitive information.

We may ask for information reasonably necessary to verify your identity or an authorized agent’s authority. We do not require you to create a new account just to submit a privacy request. We will respond within 30 days. Where applicable law allows additional time to complete a request, we will explain the reason and expected timing; any shorter legal or provider deadline takes precedence.

You can opt out of marketing emails using their unsubscribe instructions or by writing to us. Necessary account, billing, security and requested access communications may continue. Where processing relies on consent, you may withdraw it; this does not affect processing that was lawful before withdrawal.

For information managed by an organization or customer-app operator, contact that organization first. We will direct or assist with the request as appropriate and remain responsible for requests concerning our own controller activities.

11. Additional information for U.S. residents

Where an applicable state privacy law gives you these rights, you may request information about our collection and disclosures; access and a portable copy; correction; deletion; and limits or opt-outs concerning sale, targeted advertising, sensitive information or certain profiling. You may use an authorized agent as permitted by law. We will not unlawfully discriminate or retaliate against you for exercising your rights.

The information described in Section 2 falls into categories such as identifiers; customer-record and commercial information; professional information; internet or network activity; approximate geolocation; audio, visual and electronic content; inferences; and sensitive information contained in authorized communications or inputs. Its sources, purposes, recipients and retention criteria are explained in Sections 2–8. Sensitive data is used only as necessary for the requested service and permitted security, legal and operational purposes, not to infer sensitive characteristics for advertising.

We do not sell or share personal information for cross-context behavioral advertising or process it for targeted advertising, including information about users under 16. Where applicable law provides an appeal right, reply to our decision or email hello@bitsbase.com with “Privacy appeal.” We will review the appeal and explain the result and any available regulatory complaint route within the applicable deadline. California residents may also request information about any disclosures for third parties’ direct marketing; we do not make such disclosures for their own marketing.

12. European, UK and Swiss information

Where the relevant law applies to our controller activities, our legal bases are: performance of a contract for providing the service you request and handling billing; legitimate interests for proportionate service security, reliability, administration and lawful business communications; legal obligations for required records and disclosures; and consent where required for optional technologies, marketing or particular sensitive-data uses. Our legitimate interests do not override your rights and interests. An additional legal condition is required before processing special-category data where applicable; providing information is not, by itself, a substitute for that condition.

You may have rights of access, correction, erasure, portability, restriction, objection and withdrawal of consent, and rights concerning significant automated decisions. You may object to direct marketing at any time, and to processing based on legitimate interests on grounds relating to your situation. You may complain to the data protection authority in your country, the UK Information Commissioner or the Swiss Federal Data Protection and Information Commissioner, as appropriate.

Bits generate outputs and recommendations using your context. These are not a substitute for lawful human review of decisions with legal or similarly significant effects. An organization using our service for such decisions is responsible for its own lawful basis, notices and safeguards. Our Terms restrict high-risk uses.

13. International processing

Bitsbase is operated by a U.S. company. Depending on the service, information may be processed in the United States and other countries where authorized providers operate. Laws in those countries may differ from those where you live. Storage, AI processing and connected-app processing can occur in different locations; this policy does not promise a single-region deployment.

Where personal information is subject to international-transfer restrictions, we transfer it only as permitted by applicable law and with the safeguards required for that transfer. You may request details of the countries and transfer protections that apply to your information, including a copy of relevant safeguards where available, by emailing hello@bitsbase.com. Accepting our Terms is not blanket consent to otherwise unlawful transfers.

14. Children and information supplied by others

Bitsbase’s direct services are not intended for children under 13, and we do not knowingly collect personal information directly from them. The Terms require a parent or legal guardian’s agreement where a user is below the age of legal majority and otherwise eligible to use the service. Contact us if you believe a child under 13 has provided information directly to us so we can investigate and take appropriate action.

Customer-app operators are responsible for their own users, age restrictions and required notices or permissions. Our Terms do not authorize child-directed services or regulated children’s-data processing without an appropriate separate arrangement. Do not supply another person’s information unless you have the necessary authority and lawful basis.

15. Changes to this policy

We will update the effective date when this policy changes and notify users by email of material changes. Where required, we will provide additional notice and obtain consent before a new use begins. A revised policy does not retroactively authorize an incompatible use of information collected under an earlier promise.

16. Contact and access-request notice

Mochi Platform, Inc., doing business as Bitsbase
Attn: Privacy
PO Box 25018
Los Angeles, CA 90025, United States
Email: hello@bitsbase.com, subject “Privacy request”

Notice when requesting early access. We collect the email address you submit, any optional details you choose to provide, and technical request information to manage access, send your invitation, prevent abuse and understand the performance of our signup flow. We retain the request while it remains relevant to access or your relationship with us, subject to the retention criteria in Section 8. We do not sell or share this information for cross-context behavioral advertising. You can request removal using the contact method above.