Privacy Policy

Last updated: 7 October 2026

BugBunny.ai is provided by Sequester AG, Baarerstrasse 10, 6300 Zug, Switzerland. This notice explains how information is handled in connection with the Services.

Our Role

Sequester AG is the controller for personal data used to manage accounts, billing, customer relationships, and our own business administration. Where we determine the purposes and means of permitted processing for our own model development and improvement, we also act as controller for that processing and must establish the applicable lawful basis. Customers determine the authorised targets and content supplied for scans and inference requests. Where we process personal data on a customer's behalf, the applicable data processing agreement and customer instructions govern that processing. This notice does not replace a required data processing agreement or authorise repurposing data contrary to it.

Information We Collect

Account and administrative data, such as contact details, profile information, subscription and billing records, and support correspondence.
Scan content, such as target addresses, configurations, uploaded files and source code, authentication information supplied for a scan, target responses, messages, comments, actions, findings, results, proofs of concept, and reports.
Inference content, including prompts, uploaded context, inputs, and model responses.
Technical and usage information, such as execution traces, logs, tool interactions, feedback, usage metadata, and performance or error information.
Annotations and aggregated, transformed, synthetic, or other data derived from the above for permitted purposes.

Only submit information needed for the authorised scan or inference request. Where feasible, use test accounts and minimise unrelated personal data in uploaded files, prompts, traffic captures, and target content.

How We Use Information

To run requested scans, including orchestration, sandbox execution, validation, and reporting, and to make results available for review.
To process inference requests and return model responses.
To administer accounts and billing, provide support, and communicate about the Services.
To troubleshoot errors, prevent abuse, monitor reliability and security, and improve service operation.
Where permitted under the conditions below, to research, develop, train, fine-tune, evaluate, benchmark, test, validate, and improve our current and future AI models, agents, detection methods, software, products, and Services.

For permitted model-development and improvement purposes, we may retain, copy, analyse, label, transform, combine, and otherwise process the data categories above, ourselves or through service providers acting on our behalf under the applicable confidentiality and data-protection obligations. Section 8 of the Terms of Service describes the contractual permission. That permission and this notice do not by themselves establish a lawful basis for processing personal data or replace required notices, consent, or other authorisations. Where we act as processor, the controller's documented instructions and applicable data processing agreement govern. We must establish the applicable lawful basis and fulfil the relevant transparency and data-protection requirements before processing personal data for our own training or improvement purposes. Publishing this notice does not retroactively expand our rights to previously collected data, including through new derivatives.

Additional contractual restrictions on the use of customer content, including restrictions on model training or service improvement, may be agreed in writing and take precedence over general descriptions of use. Existing binding restrictions remain effective. A request alone does not activate a technical opt-out or amend a contract; statutory rights remain unaffected. We must verify that the agreed restrictions are implemented across the relevant processing routes and all providers involved before activating the affected service. Verification does not limit the agreed obligations.

Service Providers and Integrations

The Services use infrastructure and APIs, including cloud compute, database and storage services, AI model providers, payment services, email, and optional collaboration integrations. Processing depends on the service configuration and enabled features. Contact us for the provider, processing-location, and transfer information applicable to your service; this notice does not establish a Swiss-only hosting commitment or a complete subprocessor list.

Any required subprocessor authorisations and arrangements for international transfers must be addressed under the applicable agreement and data protection law. GitHub pull requests, commits, and other external postings or integrations require customer instructions or feature enablement within the authorised scope. Stricter written restrictions prevail, including a prohibition on pull requests or external publication.

Data Retention

Audit artifacts, including messages, actions, and findings, are retained so customers can resume scans and review results. Retention of scan and inference content and any permitted model-development datasets depends on the data category, the permitted purpose, service needs, the applicable agreement, and legitimate security or legal preservation requirements. Personal data is retained only for as long as necessary for the applicable lawful purpose or required by law. The model-development permission does not provide an unlimited personal-data retention period. Customer-specific retention periods, export arrangements, and deletion procedures must be specified in the applicable agreement.

You can request access to, export of, or deletion of your data using the contact details below. Requests are handled according to the applicable agreement and law. Limited information may need to be preserved for legal obligations, security investigations, or legal claims. Backup retention and expiry must be considered separately from deletion in active systems; an active-system deletion does not by itself confirm immediate removal from every backup.

Confidentiality and Incidents

Confidentiality obligations for customer content and scan results are governed by the Terms of Service and any applicable customer agreement. Incident notification obligations, including notification to affected customers, are governed by the applicable agreement and data protection law. Customer-specific security measures and notification procedures should be documented in that agreement.

Your Rights

Depending on applicable law and the circumstances, you may have rights to information and access, correction, deletion, restriction, portability, objection, or withdrawal of consent where processing relies on consent. You may also complain to the competent data protection authority. Where we process data on a customer's behalf, your request may need to be handled by that customer as controller.

Contact

For privacy questions or requests, contact Sequester AG, Baarerstrasse 10, 6300 Zug, Switzerland, or support@bugbunny.ai.

Our Role

Information We Collect

Account and administrative data, such as contact details, profile information, subscription and billing records, and support correspondence.

Scan content, such as target addresses, configurations, uploaded files and source code, authentication information supplied for a scan, target responses, messages, comments, actions, findings, results, proofs of concept, and reports.

Inference content, including prompts, uploaded context, inputs, and model responses.

Technical and usage information, such as execution traces, logs, tool interactions, feedback, usage metadata, and performance or error information.

Annotations and aggregated, transformed, synthetic, or other data derived from the above for permitted purposes.

How We Use Information

To run requested scans, including orchestration, sandbox execution, validation, and reporting, and to make results available for review.

To process inference requests and return model responses.

To administer accounts and billing, provide support, and communicate about the Services.

To troubleshoot errors, prevent abuse, monitor reliability and security, and improve service operation.

Where permitted under the conditions below, to research, develop, train, fine-tune, evaluate, benchmark, test, validate, and improve our current and future AI models, agents, detection methods, software, products, and Services.

Service Providers and Integrations

Data Retention

Confidentiality and Incidents

Your Rights