Privacy Policy

B00 is operated by B00 Inc., a Delaware corporation (“B00”, “we”, “us”). This policy explains what we collect, why, who we share it with, and the control you have. It applies to B00.io and the B00 application, including its AI features, integrations, and API/MCP access.

1. What we collect

• Account data — email address, display name, handle, optional profile image and bio, and the sign-in method you use (email or a federated provider such as Google).
• Project content — everything you put into a project: CAD and document files, revisions, plans and ideas, descriptions, comments, annotations, team messages, timelines, and activity records.
• Collaboration data — workspace and project membership, invitations you send, and the email addresses you invite.
• Integration data — when you connect a third-party service (GitHub, Google Drive, Dropbox, Slack, or similar), the access tokens needed to keep the connection working (stored encrypted) and the files or metadata you choose to import or sync.
• AI interactions — the prompts and ideas you send to B00 and the project context needed to answer them, plus usage counts against your daily limits.
• Usage data — first-party page views (path, referrer, coarse device information, a rotating session identifier) and consent-dependent milestones such as signup, onboarding, project creation, and feature use. Milestones contain no project contents, prompts, filenames, or account identifiers. Outside regions requiring prior consent this runs by default; where consent is required it only runs after you accept. See the Cookie Notice.
• Support and reports — messages you send us, past waitlist and access requests, and content reports you file.

We do not knowingly collect data from children under 13, and B00 is not for them.

2. Why we use it

• To provide the Service: store your projects, sync them across devices, and show them to the people you share with.
• To operate accounts, authentication, invitations, and notifications.
• To run AI features when you use them.
• To keep integrations you connected working — for example syncing a GitHub repository you linked.
• To keep the Service secure, prevent abuse, and enforce limits and quotas.
• To understand aggregate product usage and improve B00. A limited, individually authorised team can view registered account status separately from anonymous traffic metrics, and request AI summaries of aggregate numbers only. These summaries never receive private project content or individual activity.
• To comply with law and respond to valid legal process.

Where the GDPR or UK GDPR applies, our legal bases are performance of a contract (providing the Service), legitimate interests (security, abuse prevention, product improvement), consent (analytics where required, marketing email), and legal obligation.

3. AI features

B00 is powered by third-party AI providers reached through our AI gateway. When you ask B00 something — or start a project from an idea — we send your prompt, recent conversation, and the project context needed to answer: for example file names, extracted bill-of-materials text, or geometry summaries. Providers process this to return an answer and, under our terms with them, do not use it to train their models. Do not paste material into B00 that you are not permitted to disclose to a processor. AI answers can be wrong; verify anything you rely on.

4. What is public and what stays internal

Private projects are visible only to their members. When you publish a project, we show a curated public view: title, summary, tags, cover, the approved revision, owner handle, and public comments. Team chat, reviews, revision requests, invitations, member emails, and internal history are never included in the public view. Unlisted links are accessible to anyone holding the link and can be revoked at any time.

5. API and MCP access

If you authorise an external AI client or tool through B00's API/MCP interface, that client can read and act on projects you are a member of, within the permissions shown on the authorisation screen. Authorisation uses standard OAuth with your explicit approval, and you can revoke a connected client at any time. Activity by authorised clients is attributed to your account.

6. Who we share with

We do not sell personal information and we do not share it for cross-context behavioural advertising. We share data with service providers who process it on our behalf — hosting, database and storage, email delivery, and AI providers — listed on our Sub-processors page. We also share with people you collaborate with, with connectors and clients you explicitly authorise, and where required by law or to protect rights and safety. If the business is acquired, data may transfer as part of that transaction; this policy continues to apply until replaced.

7. International transfers

We operate from the United States and our providers process data there and on global edge networks. Where transfers from the EEA, UK, or Switzerland require a safeguard, we rely on the European Commission's Standard Contractual Clauses through our provider agreements.

8. Retention

• Account and project data — kept while your account is active.
• Deleted projects — removed from the product immediately and purged within 30 days.
• Deleted accounts — projects, files, chats, and profile removed within 30 days; backups age out on their normal cycle.
• Integration tokens — deleted when you disconnect the integration or delete your account.
• Page views — automatically pruned after 90 days.
• B00 conversations — kept until you delete them or delete your account.
• Records we must keep for legal, tax, or abuse-prevention reasons — kept as long as required.

9. Your rights and how to use them

Depending on where you live, you may have rights to access, correct, delete, port, or restrict processing of your personal data, to object to processing based on legitimate interests, and not to be discriminated against for exercising them.

• Access and export — Settings → Account → “Export my data” downloads a machine-readable archive of your account, projects, comments, and B00 conversations.
• Correction — edit your profile and project details in-product at any time.
• Deletion — Settings → Account → “Delete my account” removes your account and the content you own.
• Connections — Settings → Integrations to disconnect third-party services and revoke authorised clients.
• Email preferences — Settings → Notifications, or the unsubscribe link in any notification email.
• Everything else — email hello@b00.io. We respond within the period the applicable law requires. You may use an authorised agent, and you may appeal a decision by replying to it.

10. California residents

Under the CCPA/CPRA, the categories above map to identifiers, internet activity, professional information, and user-generated content. We collect them for the business purposes in section 2, from you and from your device. We do not sell personal information and we do not share it for cross-context behavioural advertising. We do not use sensitive personal information for inferring characteristics. Exercise your rights with the tools in section 9.

11. Security

Encryption in transit, encrypted storage, private file buckets with short-lived signed links, encrypted storage of integration tokens, and access controls scoped to project membership. Details on our Security page, including how to report a vulnerability. No service can promise perfect security.

12. Changes

We will update this page when our practices change and revise the date above. If a change is material we will notify account holders in-product or by email.

13. Contact

B00 Inc. · a Delaware corporation
hello@b00.io