Privacy policy
Last updated 8 October 2026
Pellun is run by Boaweb AI, Vipemollevagen, Lund, Sweden ("we"). This page says what we keep about you, why, who else handles it, and how to get it back or deleted. Questions go to info@boawebai.com.
What we keep
- Your account: email address, your name, a hashed password (never the password itself), your Google account ID if you sign in with Google, and your two-step sign-in keys, encrypted.
- What you make: chats and replies, agent steps and their results (searches, pages read, code run), memories, personas, skills and settings.
- Keys and connections: API keys for your own model providers and tool server credentials, encrypted. Pages only ever show the last four characters.
- Usage: for each hosted model request, the model, the tokens used and the cost, so plans can count included usage.
- Billing: your Stripe customer ID and your plan's status. Card details go to Stripe and never reach us.
- Technical records: sign-in sessions, IP addresses in server logs and rate limits, and error reports.
Why we use it
- To run the service you signed up for: store your work, send your messages to the model you picked, bill your plan. (GDPR: performance of a contract.)
- To keep it secure and working: rate limits, abuse prevention and fixing errors. (Legitimate interests.)
- To keep invoices and tax records. (Legal obligation.)
We do not sell your data, we do not show ads, and we do not train models on your chats. We only email you about your account: confirmations, password resets, invites and billing.
Who else handles it
These companies process data for us, each only for the job listed.
| Company | What for | What they get |
|---|---|---|
| Fly.io | runs the app servers | everything passing through the app, and server logs |
| Neon | database and its backups | everything listed under "What we keep" |
| OpenRouter, and the model provider serving the model you pick | hosted model replies, and the text embeddings that make memory searchable | your messages, the chat so far, and the memories, skills and persona included in a request |
| Brave | web search in Agent mode | the search query |
| E2B | the sandbox where agents run code | the code and the data passed to it |
| Stripe | payments and invoices | your email, payment details and plan |
| Resend | sending email | your email address and the message |
| "Continue with Google", only if you use it | the sign-in request | |
| Sentry | error reports | technical details of an error, such as the page address; never message text or keys |
Some services are chosen by you, and they handle data under their own terms, not ours: model providers you add with your own API key, tool servers (MCP) you connect, and the websites an agent reads for you, which see a request from our servers.
Several of these companies are in the United States. Transfers rely on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses.
How long we keep it
- Your account and what you make: until you delete them, or your account.
- Sign-ups never confirmed: deleted after 7 days, with their workspace.
- Private chats: deleted within the hour.
- The step-by-step record of agent runs: 7 days. The replies themselves stay with the chat.
- Usage records: with the workspace, for billing.
- Invoices: at Stripe, as long as tax law requires.
- Database backups and server logs: they roll off within 30 days.
Cookies
Two, both needed for the service to work: one keeps you signed in, one protects forms against forged requests. No analytics or advertising cookies, so there is no cookie banner.
Your rights
You can download everything in your account as a file from Settings, Your data, and delete your account from the same page. Deleting is immediate: your chats, memories, keys and connections go at once, and any workspace nobody else belongs to goes with it, its subscription cancelled. Backups roll off as above.
You can also ask us to correct or restrict your data, or object to how we use it, by writing to info@boawebai.com. We answer within a month. You can complain to your data protection authority.
Children
Pellun is not for anyone under 16.
Changes
If this policy changes in a way that matters, we email account holders before it takes effect. The date at the top always shows the current version.