---
title: "Privacy Policy"
description: "What personal data Bilby collects and why, the legal bases and the providers involved, how long it is kept, and the rights you have over it."
url: "https://bilby.ai/legal/privacy"
markdown: "https://bilby.ai/legal/privacy.md"
index: "https://bilby.ai/llms.txt"
---

> For agents: Bilby answers questions about what governments do, from documents collected at source and checked by research analysts. To ask Bilby yourself, connect to its MCP server at https://pulse.bilby.ai/mcp (setup: https://docs.bilby.ai/developers/mcp-server). Every page on this site is also markdown: add .md to its address, or send Accept: text/markdown. https://bilby.ai/llms.txt lists them all.

# Privacy Policy

Last updated: 27 May 2026

This Privacy Policy explains how Bilby Limited ("Bilby", "we", "us" or "our"), a company incorporated in Hong Kong, collects, uses, and shares your personal data when you access our website at bilby.ai or use our products and services, including the Pulse platform (collectively, the "Services").

"Personal Data" means any information that identifies or can reasonably be linked, directly or indirectly, to an identifiable individual.

## 1. What personal data we collect

### Information you provide directly

When you contact us, submit an inquiry, or register for an account, we may collect:

- your name, email address, and other contact details;
- company name, job title, and other professional information; and
- any other information you choose to provide.

### Information collected automatically

When you access or use the Site or our platforms, we and our service providers automatically collect:

- **Device and browser data**: device type, operating system, browser type and version, language settings, and hardware identifiers.
- **Usage and analytics data**: pages viewed, links clicked, referring sites, date and time of visit, and session interaction data — including, where applicable, full session replay recordings of your interactions with the Pulse platform.
- **IP address and approximate location**: derived from your IP address.
- **Cookies and similar technologies**: see the [Cookie Notice section](https://bilby.ai/legal/privacy#cookies-and-tracking-technologies) below.

### Information from third-parties

We may receive information about you from partners, affiliates, or other users of our Services where relevant to your use of those Services.

## 2. How we use your personal data

We use the personal data we collect for the following purposes:

- to operate, maintain, and improve the Site and our Services;
- to respond to your inquiries and provide customer support;
- to authenticate your identity and manage your account;
- to conduct analytics and user research to improve our products;
- to send you service-related communications;
- to send you marketing communications, where you have given consent or where we have a legitimate interest in doing so;
- to detect, investigate, and prevent fraud, abuse, and security incidents;
- to comply with our legal obligations; and
- for other purposes with your consent.

## 3. Legal bases for processing (GDPR)

If you are located in the European Economic Area ("EEA") or the United Kingdom, our processing of your personal data is based on the following legal grounds under the General Data Protection Regulation ("GDPR") and equivalent UK legislation:

| Purpose | Legal basis |
| --- | --- |
| Providing the Services and managing your account | Performance of a contract |
| Analytics, product improvement, fraud prevention, security | Legitimate interests |
| Marketing communications (where not required by contract) | Consent |
| Compliance with legal obligations | Legal obligation |

You may object to processing based on legitimate interests at any time by contacting us at [legal@bilby.ai](mailto:legal@bilby.ai). Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

## 4. Cookies and tracking technologies

### Cookie Notice

We use cookies and similar tracking technologies on the Site and our platforms. A cookie is a small text file placed on your device when you visit our Site. Cookies help us recognize returning users, understand how the Site is used, and improve your experience.

We use the following categories of cookies:

- **Strictly necessary cookies**: required for the Site to function and cannot be switched off. These include session and authentication cookies.
- **Analytics and performance cookies**: used to understand how visitors interact with the Site. We use PostHog for this purpose (see below).
- **Functional cookies**: used to remember your preferences and settings.

### PostHog

We use PostHog, a product analytics platform, to collect usage data and session replays on both the Site and the Pulse platform. PostHog uses cookies and other tracking technologies to record how users interact with our Services. This may include full replay recordings of your sessions. PostHog processes this data on our behalf as a data processor. You can review PostHog's privacy practices at [PostHog](https://posthog.com/privacy).

### Managing cookies

You can control cookies through your browser settings. Most browsers allow you to block or delete cookies. Note that disabling certain cookies may affect the functionality of the Site. Where required by applicable law (including for users in the EEA and UK), we will request your consent before placing non-essential cookies.

## 5. Our service providers and sub-processors

We share personal data with the following categories of service providers who process data on our behalf:

| Provider | Purpose | Location |
| --- | --- | --- |
| Clerk | User authentication and identity management | United States |
| Neon | Database hosting and management | Singapore |
| PostHog | Product analytics and session replay | United States / EU |
| Vercel | Website and platform hosting and infrastructure | United States / Singapore |

Each of these providers is subject to contractual obligations governing the security and confidentiality of your personal data. Where these providers are located outside Hong Kong or the EEA, we implement appropriate safeguards for international transfers (see [section 7](https://bilby.ai/legal/privacy#international-transfers) below).

We may also share your personal data with:

- **affiliated companies**: Bilby Group Holdings and other entities within the Bilby group;
- **professional advisors**: lawyers, auditors, and insurers as necessary;
- **law enforcement or regulators**: where required by law or valid legal process; and
- **acquirors**: in connection with a merger, acquisition, or sale of assets, subject to appropriate confidentiality protections.

We do not sell your personal data.

## 6. Data retention

We retain your personal data for as long as necessary to fulfil the purposes described in this Policy, to maintain your account, or as required by applicable law. Analytics and session data is retained in accordance with the default retention settings of our service providers unless we configure shorter periods. When personal data is no longer required, we delete or anonymize it.

## 7. International transfers

Our Services are primarily hosted and operated from Hong Kong. Personal data we collect may be transferred to and processed in other countries, including the United States, where our service providers operate.

If you are located in the EEA or the UK, and we transfer your personal data to a country not recognized by the European Commission as providing adequate protection, we will implement appropriate safeguards, which may include Standard Contractual Clauses ("SCCs") approved by the European Commission or the UK Information Commissioner's Office ("ICO"), or other lawful transfer mechanisms.

## 8. Security

We implement appropriate administrative, technical, and physical security measures to protect your personal data from unauthorized access, loss, or misuse. However, no method of transmission over the internet is entirely secure, and we cannot guarantee absolute security.

## 9. Your rights

Depending on your jurisdiction, you may have the following rights in relation to your personal data:

- **Access**: the right to request a copy of the personal data we hold about you.
- **Correction**: the right to request correction of inaccurate or incomplete data.
- **Deletion**: the right to request deletion of your personal data in certain circumstances.
- **Restriction**: the right to request that we restrict processing of your personal data.
- **Objection**: the right to object to processing based on legitimate interests or for direct marketing.
- **Portability**: the right to receive your personal data in a structured, machine-readable format.
- **Withdrawal of consent**: where processing is based on consent, the right to withdraw it at any time.

### GDPR / UK GDPR rights

If you are located in the EEA or the UK, the above rights are available to you under the GDPR and UK GDPR respectively. You also have the right to lodge a complaint with your local supervisory authority — in the EEA, this is the data protection authority in your country of residence; in the UK, this is the Information Commissioner's Office (ico.org.uk).

### Hong Kong PDPO rights

If you are located in Hong Kong, you have the right under the Personal Data (Privacy) Ordinance (Cap. 486) to request access to and correction of your personal data held by us.

### Exercising your rights

To exercise any of the above rights, please contact us at [legal@bilby.ai](mailto:legal@bilby.ai). We will respond within the timeframe required by applicable law (generally within one month for GDPR requests). We do not charge a fee for reasonable requests.

## 10. Children

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

## 11. Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will provide notice by posting a prominent notice on the Site or by email where we hold your contact details.

## 12. Contact and data controller

The data controller for personal data collected through the Site and Services is:

Bilby Limited, Unit 2A, 17/F, Glenealy Tower, No. 1 Glenealy, Central, Hong Kong

Email: [legal@bilby.ai](mailto:legal@bilby.ai)

For GDPR purposes, if you are located in the EEA or UK and have questions about our processing of your personal data, please contact us at the address above.