Privacy Policy

Data Collection

We collect limited information necessary to operate Bowtie One. This may include account information (such as email address), application usage data, project activity, user preferences, and basic device or browser information.

When you use Bowtie One, project data such as bowtie diagrams, risk analysis information, and related inputs may be stored locally in your browser or in cloud storage if you choose to save projects to your account.

If you connect an AI assistant to Bowtie One (for example Claude, ChatGPT, Grok or Cursor), we also keep a record of that connection: the assistant's name and website, what you allowed it to do (read only, or read and edit), and when it was connected and last used. The sign-in tokens and access keys that let it reach your account are stored only in a form that cannot be turned back into the token or key.

We may also collect technical information such as feature usage logs, performance metrics, and error reports to help diagnose problems and improve the reliability of the platform. We aim to collect only the information required to provide and improve our services.

Data Usage

Information we collect is used to:

• provide and operate the Bowtie One services
• enable account authentication and access to your workspace
• store and manage your projects
• improve application performance and reliability
• diagnose bugs and technical issues
• provide user support

We do not sell or rent personal information to third parties.

Data Sharing

We share limited information with service providers that help us run the platform:

• Vercel, for hosting the application (United States)
• Supabase, for the database and sign-in (Ireland, EU)
• Stripe, for payments
• Resend, for account and billing emails
• Vercel Web Analytics, for privacy-friendly page analytics

These providers process information only to perform their services and are required to protect it. When you connect an AI assistant, the content it reads goes to the provider you chose, as described under "AI assistants".

Some of these providers process information outside the UK, including in the United States. Where they do, they are bound by contractual safeguards such as the UK International Data Transfer Addendum.

AI assistants

You can choose to connect an AI assistant to your Bowtie One account. You decide which assistant, and you approve each connection yourself. Once connected, the assistant can read the bowtie projects your account can open and, if you allowed it, create and change them. It cannot delete projects, share them, invite people, or change your account or billing.

When your assistant reads a project, the content it reads (names, descriptions, threats, consequences, barriers and the risk review) is sent to the company that provides that assistant. That company handles it under its own terms and privacy policy, and under your agreement with it, not under this policy. Bowtie One does not send your projects to any AI provider on its own initiative, and does not use your projects to train AI models.

You can see and disconnect your connected assistants at any time on your account page. Disconnecting stops the assistant reaching your account at once.

Data Security

We implement reasonable technical and organisational measures designed to protect information from unauthorised access, disclosure, alteration, or destruction. While we strive to safeguard user data, no internet-based service can guarantee absolute security.

How long we keep information

• Your projects are kept until you delete them or your account.
• Earlier versions of a project are kept with it so you can restore work, including changes made by an AI assistant: up to 100 per project, and beyond the latest 20, versions more than 30 days old are removed.
• AI assistant connections: sign-in tokens last at most an hour and are refreshed while the connection is in use. A connection unused for 90 days expires. Records of disconnected connections are deleted 90 days after disconnection.
• Security log: a record of sign-ins, connections and changes (what happened, when, by which account, and the IP address it came from; never the content of your projects) is kept for 12 months and then deleted.
• When you delete your account, your projects, connections and access keys are deleted with it. Security log entries are kept until their 12 months are up.

User Rights

You may request to access, update, or delete your personal information. In many cases, you can manage this information directly through your account settings.

If you would like to request deletion of your account or associated data, you may contact us and we will process your request in accordance with applicable privacy laws.

Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our services or legal requirements. When updates are made, the revised policy will be posted on this page with the updated effective date.

We encourage you to review this policy periodically.

Contact

If you have questions about this Privacy Policy or how your data is handled, contact us at support@bowtie.one.