Privacy Policy
This Privacy Policy explains how DT LEVEL 7 TECHNOLOGY LIMITED ("LEVEL7", "we") collects, uses and protects personal data when you use Bob — CmdOS by LEVEL7 (the "Service"). We collect the minimum needed to run your AI employees and to operate our business.
1. Who we are
DT LEVEL 7 TECHNOLOGY LIMITED, a company incorporated in Cyprus (reg. no. [Cyprus company reg. no. — to be inserted]; registered office [Registered office, Cyprus — to be inserted]), is responsible for your personal data as described here.
Privacy contact: privacy@thelevel7.ai. General contact: dani@thelevel7.ai.
2. Our roles (controller / processor)
We act as a data controller for account, authentication, billing and product-analytics data — we decide why and how it is processed.
We act as a data processor for the Content your Agents handle on your behalf (for example, the personal data of your own contacts contained in messages and files). For that Content you are the controller and our Data Processing Addendum governs our processing.
3. Data we collect
| Category | Examples |
|---|---|
| Account & identity | Name, email, password hash, workspace details, role |
| Agent content | Chat messages, brain/knowledge files, memory, schedules and instructions you or your Agents create |
| Connected-tool data | Data accessed via Integrations/Channels within the scopes you grant, plus encrypted third-party credentials you store |
| Billing | Plan, usage/token counters, Stripe customer and subscription identifiers (we do not store full card numbers) |
| Usage & logs | Audit logs, feature usage, device and connection metadata, IP address, approximate location |
| Support & feedback | Messages you send us and feedback you submit |
4. Why we use it & legal bases (GDPR Art. 6)
- To provide and operate the Service and your Agents — performance of our contract with you.
- To meter usage, take payment and prevent abuse — contract and our legitimate interests.
- To secure the platform, debug and improve it — our legitimate interests, balanced against your rights.
- To send service and, where permitted, marketing communications — legitimate interests or your consent, which you can withdraw at any time.
- To meet legal, tax and accounting obligations — compliance with a legal obligation.
5. AI processing
To generate Output, your Content is sent to the large-language-model provider powering your Agent, which processes it to return a response under contractual data-protection terms.
EU/EEA and UK users: content is processed via Anthropic only; the MiniMax (China) model is disabled for EU/EEA/UK workspaces. For users outside the EU/EEA/UK, an Agent may use MiniMax, which involves a transfer to China subject to appropriate safeguards; you can see which model an Agent uses in-app.
We also use OpenAI to power the text-embedding model behind Agent memory and semantic search, and xAI (Grok) for image generation, supplementary language-model processing, and voice-message transcription. See our Sub-processors page for the full current list.
We do not sell your data and do not use your private business Content to train third-party foundation models beyond generating responses for you.
6. Sub-processors
We use vetted sub-processors to provide the Service, each under data-protection terms. The current list — with purpose, location and transfer mechanism — is maintained at https://getbob.thelevel7.ai/legal/subprocessors. We will give notice of changes so you can object where you have the right to.
7. International transfers
We host primarily in the EU (AWS, Frankfurt / eu-central-1). Where data is transferred outside the EEA/UK (for example to providers in the US, or MiniMax in China for non-EU users), we rely on adequacy decisions or Standard Contractual Clauses with supplementary safeguards.
8. Retention
We keep personal data only as long as needed for the purposes above. Trial and account data are retained for up to 30 days after closure to allow reactivation, then deleted or anonymised. Deleting an Agent removes its brain files and message history. Backups are rotated and deleted within 30 days. We may retain limited records longer where law requires (e.g. tax/accounting).
9. Security
We protect data with encryption in transit, encryption of stored third-party credentials using AES-256-GCM, workspace isolation, access controls and audit logging. No system is perfectly secure, but we work to protect your data and to notify you of breaches as required by law.
10. Your rights
Subject to applicable law, you can access, correct, export, delete or restrict your personal data, object to certain processing, and withdraw consent. You can do much of this in-app, or by contacting us.
EU/EEA/UK: you have GDPR/UK GDPR rights and may complain to a supervisory authority — in Cyprus, the Office of the Commissioner for Personal Data Protection; in the UK, the ICO. California/US: under the CCPA/CPRA you may request to know, delete and correct your information and opt out of "sale"/"sharing" — we do not sell your personal information. We will not discriminate against you for exercising your rights.
11. Channels & third parties
When data flows through WhatsApp, Telegram, email or other Channels, those providers also process it under their own privacy policies, which are outside our control.
12. Cookies
We use a small number of cookies, including the essential session cookie "cmdos_session". Non-essential cookies are used only with your consent. See our Cookie Policy (https://getbob.thelevel7.ai/cookies).
13. Children
The Service is not intended for children under 16 (or under 18 for paid plans). We do not knowingly collect data from children; if you believe a child has provided us data, contact us and we will delete it.
14. Changes & contact
We will post updates here and update the date and version above; material changes will be communicated in-app or by email. Questions or requests: privacy@thelevel7.ai.