Privacy policy

Version draft-2026-11-07

Draft. This policy describes Bitlapa as it will be when it opens to everyone, and some of what it says is still being built. It is a placeholder that hasn't been checked by a lawyer yet. It will be, and may change, before anyone outside is let in. Text in grey brackets is still to be decided.

Who is responsible

Bitlapa is run by Vorster Consulting, which is responsible for what this policy describes. [Contact for data protection, and a representative in the EU or UK if one is needed].

In short

We keep what it takes to run your account and your projects, and nothing for advertising.
What you write to the chat, and what it reads, goes to Anthropic, or to the Anthropic account behind the key it uses.
Keys you add are encrypted, and this isn't zero-knowledge. Whoever fully controls the server could in the end reach them.
As the people who run it, we can reach the database. We don't look at your projects, except in the cases below.
No tracking and no analytics. The only cookie is the one that keeps you signed in.

What we keep

Your account: your email address, your name, your password as a scrypt hash that can't be turned back into the password, your settings, and your sessions, each of which ends 30 days after it was last used.
Your projects: their documents, every version of them, their pictures, who is in them and with which role, and a log of who did what.
Your chats, with what each answer cost, and a record of what the AI cost per person, which stays even when a chat is deleted.
Invites: the email address of someone invited to a project, even if they have no account, until they join or the invite is withdrawn.
Emails we send, and what became of them, for 7 days.
Counts of requests, to stop anyone flooding the service. They are kept by network, under a hash, for a short time, and don't hold your address.
The web server's logs, which hold IP addresses, for [how many days].
Backups, for [how long].

A deleted project can be restored by its payer for 14 days, and is then deleted. [What happens to it in backups after that].

The AI, and Anthropic

The chat runs on Anthropic's models, through Anthropic's API. When you use it, your messages and everything the chat reads to answer them, documents and the pictures in them included, are sent to Anthropic. That happens only when someone chats, and only with what is in that project.

On plan credit, it goes to Bitlapa's account at Anthropic, under [Anthropic's commercial terms, and how long they keep API data].
On a key someone added, yours or a project's, it goes to the Anthropic account behind that key, and that account's own data settings apply, not ours. The chat tells you before your first message on a key that isn't yours, and again if the key changes.
Whoever holds a key could, for a few minutes, test whether a text they guessed was recently sent with it. It is a small thing, and the reason the chat says whose account your messages go to.

Your chats are only yours. Nobody else in a project can read them. The person who pays for a project sees how much each person's chats cost, and never what was said.

Anthropic keys you add

If you add an Anthropic key, for yourself or for a project:

It is encrypted with a master key that is kept outside the database and the backups, and outside the app itself. Only a small separate service can open it, and only for the person or project it belongs to.
Bitlapa can never show it to anyone again, you included.
This isn't zero-knowledge. Bitlapa has to use a project's key while the person who added it is away, so the server has to be able to open it without them. Whoever fully controls the server could therefore reach the keys in the end. That includes us, and anyone who can change what runs there. Opening keys in bulk sets off an alarm, but someone careful enough might not be noticed, and that can't be made impossible.
So use a key from a separate Anthropic workspace, with a monthly spend limit set at Anthropic. Then the worst case has a number on it. If you need more than that, don't add a key.
The app sees a key for a moment when you save it.
A removed key is deleted at once, and listed as removed so that it can't come back from a backup.

What we can see

As the people who run Bitlapa, we can reach the database, and with it everything in your projects and chats. That can't be avoided by whoever runs a service like this. What we promise is that we don't look, except:

when someone reports abuse, and then only at what was reported;
when the law requires it of us;
when something is broken and can't be repaired any other way, and then as little as it takes.

Each of those is logged. Our own console finds an account only by its exact address, shows totals rather than content, and can't open a project.

Who else sees what

People in a project see your name, what you change, and where you are working, while you are there.
A project's owners also see your email address, and you are told so before you join.
Nobody can use Bitlapa to find out whether an address has an account. Inviting someone looks the same either way, and so does every public screen.

Cookies

Bitlapa sets one cookie, which keeps you signed in. It can't be read by the pages' scripts, isn't sent to other sites, and ends when you sign out or after 30 days without use. There are no tracking or advertising cookies, no analytics, and nothing on these pages from anywhere else, fonts included. That is why there is no cookie banner.

Who we use

These companies handle data for us, and only to provide Bitlapa:

Who	For what
[The host]	The servers Bitlapa and its database run on, in [where].
Anthropic	The AI in the chat, as described above.
Amazon Web Services	The key management service that holds the master key for stored Anthropic keys. It never sees your keys or your content.
[The email provider]	Sending emails: links to confirm an address or set a password, invites and notices.
[The payment provider]	Taking payments and handling tax, once paid plans are on sale. It holds your card details, and we never do.
Cloudflare	Only if the check against automated sign-ups is switched on, which happens when registering is under attack.

Your choices

Download your data: everything you have, from your settings.
Correct it: change your name and address in your settings.
Delete your account, from your settings. [What stays, for how long, and why, such as what the AI cost].
[Your rights under the law that applies, and where to complain].

Contact

About your data, write to gvis@vorster-consulting.com. To report abuse, write to gvis@vorster-consulting.com.

When this policy changes in a way that matters, the version above changes, and you are asked to accept the new one the next time you sign in.