Privacy notice
Bamboo operates Bamboo Relay. This notice explains how the service handles account, API, payment, and support data. Effective 14 October 2026.
Data we handle
We handle account identifiers, email and profile information supplied during registration or enabled GitHub/Google sign-in, authentication records, and essential session data. API requests may contain prompts, messages, files, images, and other input. The gateway processes that input and receives upstream responses. Usage and operational records can include model, token counts, charges, timestamps, errors, network address, and request identifiers, depending on server settings.
Why we use it
We use this information to authenticate users, route and deliver API requests, maintain balances and payment records, investigate errors and abuse, and review support or privacy requests. Do not submit secrets or personal data that are unnecessary for your task.
Providers and payments
Requests are sent to the model provider selected by routing and channel configuration. Infrastructure and payment providers also process the information needed to provide their services, potentially in other countries. Their own privacy rules apply to their processing. Hosted payment providers process card details; the Bamboo recharge form does not ask for a full card number or card security code. We retain order references, payment status, and credited amounts for accounting.
Cookies and local settings
The site uses session cookies and stores language/theme preferences. These are needed for sign-in and your selected display settings. Your browser can clear them; clearing session cookies signs you out. Third-party sign-in and hosted checkout may set their own cookies.
Retention and security
Retention depends on record type, gateway settings, provider requirements, and accounting or security needs. Request content may be processed or retained where required for relay, task results, diagnostics, or configured logging. We do not promise zero retention or a fixed deletion period for every provider. Access controls and encrypted transport help protect data, but no service can guarantee absolute security.
Your requests
Use the contact form to request access, correction, deletion, or information about a specific account or request. Include enough information to locate it, without passwords or API keys. We may need to verify ownership before taking action. Some accounting, security, or legally required records may need to be retained. There is currently no public support email; the form records your request and gives you a reference number.