Privacy Policy

Effective Date: October 14, 2026

noBGP.com (the"Site") is owned and operated by noBGP. noBGP is the data controller and processes your personal data in accordance with applicable privacy laws.For all privacy-related inquiries, contact us at privacy@noBGP.com

1. Overview & Scope

This Privacy Policy explains how we collect, use, share, and protect your personal data when you use our Site and Services. This policy applies to all users of noBGP services and is supplemental to our Terms of Service.

1.1 Regulatory Compliance

We comply with:

General Data Protection Regulation (GDPR) - Regulation (EU) 2016/679 for users in the European Union

UK GDPR as enshrined in the Data Protection Act 2018 for users in the United Kingdom

California Consumer Privacy Act(CCPA) and California Privacy Rights Act (CPRA) for California residents

1.2 Consent

By using our Site and Services,you consent to the data practices described in this Privacy Policy. You may withdraw your consent at any time by contacting privacy@noBGP.com. Withdrawal of consent does not affect the lawfulness of processing conducted prior to withdrawal.

2. Data Collection

We collect only the personal data necessary to provide and improve our Services. We will notify you before collecting any data beyond what is described below.

2.1 Data Collected Automatically

When you visit our Site, we automatically collect:

IP address and general location information (city/region level)

Device and browser information(operating system, browser type, device identifiers)

Usage data (pages viewed, links clicked, time spent on Site)

Cookies and similar tracking technologies (see Section 8)

2.2 Data You Provide

You may provide the following data when using our Services:

Account information (name, email address, phone number)

Communications (when you subscribe to our newsletter or submit contact forms)

Payment information (processed by third-party payment processors; we do not store full payment card details)

Email addresses of other people, when you invite them to your organization or give them access to a device or service

2.3 Data from AI Clients and the noBGP MCP Server

When you connect an AI client (such as Claude or ChatGPT) to noBGP through our MCP server at mcp.nobgp.com, or use the noBGP API, we process the following:

• Sign-in. You sign in on noBGP's own sign-in page, not through the AI service. The AI client receives access and refresh tokens for your noBGP account; it never receives your noBGP password, and we never receive your password for the AI service.
• Tool calls. The requests the AI client sends to noBGP: the tool it calls and its arguments, for example a command to run, a file path, or the contents of a file to write. We use them to carry out the action on your devices and return the result to the AI client.
• Command output and file contents. These pass through our servers on their way between your device and the AI client. Command output is held in memory only while the command session is open, and we do not keep command text, output or file contents after the call ends, with these exceptions: files you choose to store in noBGP storage (see Section 6.1); settings you ask us to keep, such as the command or address of a service you publish; and when the AI client subscribes to events (for example a command run on several devices, or a search), the command and the results it asked for are held in a queue until the subscription ends, at most 24 hours.
• Audit log. A record of each tool call that acts on your devices, networks, services or organization: when it happened, which account and organization made it, the tool or action, the device, network or service it acted on (with its name), whether it succeeded and any error code, and the name and version of the AI client. The audit log does not contain command text, file contents or command output. Your organization's Owners and Admins can read it.
• Server logs. Our servers log each request (time, account ID and email address, tool name, request ID, source IP address and the AI client's name) for security and troubleshooting.
• Product analytics. For each tool call we send an event to our product analytics provider. It contains your noBGP user ID, organization ID, the tool name, whether the call succeeded and any error code, the names of the arguments used (their values only for a fixed list of options, such as whether root was requested), the size of the result, and the AI client's name and version. Some events also contain the IDs of the device, network or service involved and, for commands, the exit code and the sizes of the command, input and output. These events do not contain your email address, your IP address, commands, file paths, file contents or command output.
• Feedback reports. An AI client can use our feedback tool to report a problem with our tools. We store the report text (up to 1,000 characters), the tool it is about, your user and organization IDs, and the ID of the related request. The tool asks the AI client not to include your prompts, file contents, commands or output. If a report contains such content, contact privacy@noBGP.com and we will delete it.

Third-Party AI Providers

When you use an AI service (such as OpenAI ChatGPT or Anthropic Claude) with noBGP, your prompts and the AI service's responses are handled by the provider you select. These providers act as independent data controllers for the data they receive. We recommend reviewing their privacy policies:

OpenAI Privacy Policy: https://openai.com/privacy

Anthropic Privacy Policy: https://www.anthropic.com/privacy

We receive only the requests the AI client sends to noBGP. We do not receive your conversation with the AI service, its history, or files you keep in that service.

2.4 Data from Devices Running the noBGP Agent

When you install the noBGP agent on a device, the device sends us information we need to connect it and show it to you:

• Device details: hostname, a machine identifier, operating system, kernel and version, whether it is a virtual machine or container, hardware model, processor count, memory, disk space, GPU type, boot time, agent version, and the account the agent runs commands as
• Network details: the device's public IP address and an approximate location derived from it (city, region and country, and the internet provider), its local network address and the hardware (MAC) address of its network interface, connection times, and the volume of traffic it sends and receives
• Health samples: processor, memory and load figures, sampled about once a minute
• Services the device announces on its local network, and labels you assign to the device

We use this information to operate the Services, to show your devices to members of your organization, and to measure usage for billing.

3. Use of Data

We use your personal data only for the purposes specified in this Privacy Policy and as disclosed when we collect the data.

3.1 Automatically Collected Data

We use automatically collected data to:

Analyze Site usage patterns and generate aggregate statistics

Improve Site functionality and user experience

Detect and prevent security threats and fraudulent activity

Optimize Site performance and technical infrastructure

3.2 Data You Provide

We use data you provide to:

Create and manage your account

Respond to your inquiries and provide customer support

Send service-related communications (with your consent for marketing communications)

Process payments and maintain transaction records

3.3 AI Client and Device Data

We use the data described in Sections 2.3 and 2.4 to:

• Carry out the actions you or your AI client request on your devices
• Give your organization's Owners and Admins a record of who did what (the audit log)
• Keep the Services secure, investigate abuse, and troubleshoot failures
• Measure which tools are used and how often they fail, so we can improve them. Product analytics identify you by your noBGP user ID, not by name or email address
• Read feedback reports and fix the problems they describe
• Measure traffic, compute and storage for billing

4. Legal Bases for Processing

Under GDPR, we process your personal data based on the following legal grounds:

Consent: You have explicitly agreed to our processing of your data for specific purposes (e.g., marketing communications, connecting an AI client to noBGP)

Contract Performance: Processing is necessary to provide the Services you requested and fulfill our contractual obligations

Legal Obligation: Processing is required to comply with applicable laws and regulations

Legitimate Interests:Processing is necessary for our legitimate business interests, specifically to maintain Site security, prevent fraud, analyze service performance for operational improvements, and develop new features based on usage patterns.These interests do not override your fundamental rights and freedoms.

5. Data Sharing and Disclosure

We do not sell your personal data. We share your data only in the following limited circumstances:

5.1 Internal Access

We disclose your data to noBGP employees and contractors who require access to perform their job functions and provide Services to you. All personnel are bound by confidentiality obligations. noBGP support staff can act on your organization's devices only while the organization's "Allow noBGP support" setting is on. The setting is on by default, and your organization's Owners and Admins can turn it off. Support actions that the audit log records are marked as noBGP support access.

5.2 Service Providers

We share data with third-party service providers who perform services on our behalf:

Cloud hosting and infrastructure providers

Payment processors (who act as independent data controllers)

Analytics and performance monitoring services

Customer support and communication platforms

Our main service providers are Amazon Web Services (hosting, file storage and email), Supabase (database), WorkOS (sign-in), Stripe (payments) and PostHog (product analytics).

Except for payment processors, which act as independent data controllers, these service providers act as data processors and are contractually obligated to protect your data and use it only for specified purposes.

5.3 Legal Requirements

We disclose your data when required by law or to:

Comply with legal obligations,court orders, or valid legal processes

Enforce our Terms of Service and protect our legal rights

Prevent fraud, security threats,or illegal activity

Protect the safety and rights of noBGP, our users, or the public

5.4 Business Transactions

If noBGP is involved in a merger, acquisition, sale of assets, or bankruptcy, your personal data may be transferred to the acquiring entity. We will notify you of any such change in ownership or control of your data.

5.5 Cross-Border Data Transfers

Your data may be transferred to and processed in countries outside your jurisdiction, including the United States. When we transfer data from the EU or UK to other countries, we use Standard Contractual Clauses (SCCs) approved by the European Commission and implement additional safeguards to ensure adequate protection of your data.

6. Data Retention and Security

6.1 Retention Periods

We retain your personal data for the following periods unless a longer retention period is required by law:

Account data: Retained while your account is active and for 24 months after account closure or last activity

Transaction records: Retained for 7 years to comply with financial and tax regulations

Command output and file contents passing through our servers: not retained after the command session or transfer ends

Files you store in noBGP storage: retained until you delete them. A deleted or overwritten file can be recovered for 7 days, then it is permanently deleted. The storage of a removed device or network is deleted about 37 days after the removal, and its last recoverable copies 7 days after that

Device information: retained while the device is registered to your account

Audit log, feedback reports, product analytics and the device information of removed devices: no fixed retention period. We delete them when you ask us to at privacy@noBGP.com, for example when you close your account

Server logs: retained for 14 days

Anonymized analytics data: Retained indefinitely after removal of all personally identifiable information

Marketing communications: Retained until you unsubscribe or request deletion

We will notify you if we need to retain your data longer than these periods for legal compliance or dispute resolution.

6.2 Security Measures

We implement technical and organizational security measures to protect your data, including:

Encryption: Data is encrypted in transit (TLS 1.2+) and at rest (AES-256)

Access Controls: Role-based access controls and multi-factor authentication for internal systems

Monitoring: Continuous security monitoring and intrusion detection systems

Pseudonymization: Personal identifiers are pseudonymized in analytics and logging systems where feasible

Regular Audits: Periodic security assessments and vulnerability testing

Staff Training: Regular security and privacy training for all personnel with data access

While we implement robust security measures, no system is completely secure. We cannot guarantee absolute security of your data transmitted over the Internet.

7. Your Privacy Rights

Your privacy rights vary based on your location. We honor all applicable rights regardless of jurisdiction.

7.1 Rights for EU and UK Users (GDPR)

If you are located in the EU or UK, you have the following rights:

Right to Access: Request a copy of the personal data we hold about you

Right to Rectification: Request correction of inaccurate or incomplete data

Right to Erasure: Request deletion of your personal data (subject to legal retention requirements)

Right to Restrict Processing:Request temporary suspension of data processing

Right to Data Portability:Receive your data in a structured, machine-readable format

Right to Object: Object to processing based on legitimate interests or for direct marketing

Right to Withdraw Consent:Withdraw consent at any time where processing is based on consent

7.2 Rights for California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights:

Right to Know: Request disclosure of personal information we collect, use, disclose, or sell

Right to Delete: Request deletion of your personal information

Right to Correct: Request correction of inaccurate personal information

Right to Opt-Out: Opt out of the sale or sharing of personal information (note: we do not sell personal information)

Right to Limit Sensitive Data:Limit use of sensitive personal information to necessary purposes

Right to Non-Discrimination:Exercise your rights without discriminatory treatment

California-Specific Disclosures

Categories of personal information collected (last 12 months):

Identifiers: Name, email, IP address, device identifiers

Commercial Information: Purchase history, payment information

Internet Activity: Browsing history, Site interactions, clicked links

Geolocation Data: General location (city/region level) of you and of your devices

User-Generated Content: Commands and files sent to your devices through AI clients or the noBGP API, and feedback reports

Device Information: Hostnames, machine identifiers, operating systems, hardware, public and local IP addresses, network hardware (MAC) addresses and usage of devices running the noBGP agent

Inferences: User preferences derived from usage patterns

Sensitive personal information collected:

Account credentials (username,email, passwords - encrypted)

Precise geolocation (only if you enable location services)

Financial account information(for payment processing)

Device access credentials and authentication tokens (encrypted)

Sale/Sharing: We do not sell personal information for monetary consideration. We have not sold personal information in the past 12 months and do not share personal information for cross-context behavioral advertising.

7.3 How to Exercise Your Rights

To exercise any of your privacyrights:

Email: privacy@noBGP.com

Online Form:www.nobgp.com/contact

We will verify your identity using information in our records before processing your request. We respond within 30 days (GDPR) or 45 days (CCPA), extendable by an additional 30-45 days for complex requests. You will receive confirmation of your request and regular updates on its status.

7.4 Authorized Agents (California)

California residents may designate an authorized agent to submit requests on your behalf. The agent must provide written authorization signed by you or a valid power of attorney. We may require you to verify your identity directly with us before processing the request.

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect data about your Site usage and preferences. A cookie is a small text file stored on your device by your browser.

8.1 Types of Cookies We Use

Essential Cookies: Required for Site functionality (account authentication, security features). These cookies do not require consent.

Functional Cookies: Remember your preferences and settings for future visits. Requires opt-in consent under GDPR.

Analytical Cookies: Collect aggregated data about Site usage to improve functionality and user experience.Requires opt-in consent under GDPR.

Third-Party Cookies: Set by external services (analytics providers, performance monitoring tools) to track usage and improve services. Requires opt-in consent under GDPR.

8.2 Managing Cookies

You can manage cookie preferences through our cookie consent banner when you first visit the Site or through your browser settings. Most browsers allow you to refuse cookies or delete existing cookies. Note that disabling cookies may limit Site functionality and degrade your user experience. Disabling essential cookies may prevent you from using certain features of the Site.  Your consent choices are stored using a Consent Management Platform (CMP) that records when and how you gave or withdrew consent.

You can update or withdraw your cookie preferences at any time by clicking‘Update Cookie Consent’ on https://www.nobgp.com/legal/privacy

Under EU and UK law, we obtain your explicit opt-in consent before placing non-essential cookies on your device.

9. Special Protections

9.1 Children's Privacy

Our Services are not directed to children. We do not knowingly market to or solicit data from minors. We do not knowingly collect personal data from children under 13 years of age (United States - COPPA) or under 16 years of age (EU/UK - GDPR). If we learn we have collected data from a child below these age thresholds, we will delete the data immediately. If you believe a child has provided us with personal data, contact us at privacy@noBGP.com

9.2 Do Not Track and Global Privacy Control

We recognize and respond to Global Privacy Control (GPC) signals from California residents. When we detect a GPC signal from your browser, we treat it as a request to opt out of the sale or sharing of your personal information for cross-context behavioral advertising.

We do not currently respond to"Do Not Track" (DNT) browser signals because there is no accepted industry standard for DNT compliance.

10. Additional Information

10.1 Marketing Communications

You can opt out of marketing communications at any time by clicking the unsubscribe link in any marketing email or by contacting privacy@noBGP.com. You will continue to receive transactional and service-related communications necessary for your use of the Services.

10.2 Third-Party Links

Our Site may contain links to third-party websites. We are not responsible for the privacy practices or content of these external sites. We recommend reviewing the privacy policies of any third-party sites you visit.

10.3 Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements.We will update the "Effective Date" at the top of this policy and notify you of material changes by email or prominent notice on our Site at least 30 days before the changes take effect. Your continued use of the Services after changes become effective constitutes acceptance of the updated policy.

10.4 Supervisory Authority and Complaints

If you have concerns about how we handle your personal data, please contact us at privacy@noBGP.com so we can address your concerns. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority:

EU/EEA: Contact your national Data Protection Authority

UK: Information Commissioner's Office (ICO) - www.ico.org.uk

California Privacy Protection Agency (CPPA) – cppa.ca.gov

California: California Attorney General's Office - www.oag.ca.gov

10.5 Contact Information

For all privacy-related questions, requests, or concerns:

Email: privacy@noBGP.com

Contact Form:www.nobgp.com/contact

Data Controller: noBGP