Privacy notice
Last updated 8 November 2026. Applies to BAPC saryasa at saryasa.bapc.app.
Bakko Armour LLC (“we”) runs BAPC saryasa. This notice explains what we keep, why, who else handles it, how long we keep it, and how to get a copy or have it deleted. Questions go to support@bapc.app.
What we store
- Your account: email address, optional name, a scrypt hash of your password (never the password itself), two-step sign-in settings, and the accounts you link from BAPC, Google or Microsoft.
- Sessions: when each session started and was last used, the browser and device type, and a shortened network address, so you can see and end your sessions.
- Your organization's work: repositories and their history, merge requests and comments, builds, test results, logs, artifacts, security findings and signed evidence. This belongs to the organization, and its admins control it.
- AI requests: a record of each AI task (who asked, the model, tokens, cost and fingerprints of the prompt and answer). The text of prompts and answers is kept only if an admin turns that on, with secrets removed first, for the number of days the admin chooses (30 by default).
- Billing: the plan, seats and usage. Card details are handled by BAPC Billing and its payment processor, never by saryasa.
- Audit log: who did what and when, for security and for your organization's own review.
AI providers
AI requests go through BAPC AI Gateway, which sends them to the model provider configured for it. A request contains your instruction and the files you chose to include, up to the size your admin allows. Every request is marked so that providers do not use it for training: customer code is not used for training, as requested of providers. AI is off until an admin of your organization sets a monthly AI budget.
Who else handles your data
- BAPC Notifications sends account emails (confirmations, password resets, invitations, sign-in and plan notices).
- BAPC Billing handles subscriptions, receipts and payment.
- BAPC AI Gateway handles AI requests, as above.
- BAPC Observability receives error reports, which never contain passwords, tokens or file contents.
We do not sell personal data and do not use it for advertising.
How long we keep it
- Your account stays until you delete it.
- Sessions end after a period without use and after a fixed lifetime (one hour and twelve hours by default).
- Organization data stays while the organization is open. When an admin closes an organization it is queued for closure and its data is then deleted.
- Stored AI prompt and answer text is deleted after the period the admin chose.
- Audit records are kept for security and legal reasons after other data is deleted, but hold no file contents.
Your rights: export and delete
You can download all the data your account holds as a JSON file from Account → Data and deletion, and delete your account from the same page. Deleting your account removes your sign-in methods, sessions and personal details and takes you out of every organization; what you wrote stays with the organizations it belongs to. Organization admins can export and close their organization. For anything else, including a correction or a question about your rights under the GDPR or the CCPA, write to support@bapc.app.
Security
See Security for how saryasa protects accounts, code and builds. If we learn of a breach affecting your data, we will tell you and the authorities as the law requires.
Changes
When this notice changes in a way that matters, we will say so in the app before the change takes effect.