Privacy policy
Last updated 22 October 2026
Who we are
BunBunCloud and this website are operated by ALLEZOU SAS, a French company (Société par actions simplifiée (SAS), RCS Paris 832 194 807) whose registered office is at 40 Rue Damrémont, 75018 Paris, France ("we", "us"). This policy explains how we handle personal data under the EU General Data Protection Regulation (GDPR), the UK GDPR, the Swiss Federal Act on Data Protection (FADP) and Japan's Act on the Protection of Personal Information (APPI). For any question or request about your personal data, write to privacy@bunbuncloud.com.
BunBunCloud is a service for businesses. It is offered worldwide, including in the European Union, the rest of the European Economic Area, the United Kingdom and Switzerland ("Europe").
Our representative in the United Kingdom
We are established in the European Union, in France. As we are not established in the United Kingdom, we appoint a representative there you may also contact about your personal data: being appointed. Until then, write to privacy@bunbuncloud.com.
Our role
We are the controller of the personal data of this website, of the accounts of the people who use BunBunCloud, of billing and of the messages you send us: we decide why and how it is used. For the data in a customer's workspace (the configuration of the cloud resources they connect), the customer is the controller and we are their processor: we process it only on their instructions, under our Data Processing Addendum.
Information we collect
- Website: when you send the contact or assessment form, your name, work e-mail, company, approximate number of AWS accounts, your role and interest (when you give them), your message and the page you sent it from; when you ask for the security pack or the sample report, your name, work e-mail, company and company size, and the language of the page. Our servers also record technical logs (IP address, time, page requested) for security.
- Accounts in the app: name, e-mail address, password (stored only as a one-way hash), the profile photo you add (optional; you can remove it at any time), role, chosen language, sign-in times, the IP address and browser of each signed-in session, the e-mails you agreed to receive, and a record of the actions taken in a workspace.
- Signing in with Google, GitHub or LinkedIn: if you choose to, we receive from that provider your account identifier, your name, your verified e-mail address and the address of your profile picture, and nothing else. If you have no photo in BunBunCloud yet, we copy that picture once as your profile photo; you can replace or remove it in Account settings, and once removed it is not copied again. We do not receive your password for that account, and we do not keep the provider's access token or your contacts. Your use of that account is governed by the provider's own privacy policy. You can unlink it at any time (Account settings, Sign-in methods).
- Workspace data: the configuration of the cloud resources you connect (names, tags, identifiers and settings, which can include the names of IAM users), their health and estimated costs, and the settings of the integrations you add. Integration credentials are stored encrypted. BunBunCloud is designed not to read secret values, message contents, logs or records.
- Billing: card payments are handled by our payment provider, Stripe; we do not receive or store card numbers. We keep your plan, invoices, billing contact, billing country and, for businesses in Europe, the VAT number we check before invoicing.
- Support: the messages you send us (from the website, from Contact support in the app, or by e-mail), the files you attach to them (such as screenshots), and our replies. Attachments are seen only by you and our team, and are deleted with the message.
- Job applications: when you apply to a position on our careers page, your name, e-mail address, the country you live in, whether you need visa sponsorship, your CV and, for positions outside France, the current and desired salary you choose to give. Only our team sees them; we use them only to assess your application and to contact you about it.
You give us most of this directly. Your account data is needed to use BunBunCloud; the photo, the provider sign-in and marketing e-mails are optional.
Why we use it, and on what legal basis
We use personal data only for the purposes below. Where the GDPR, UK GDPR or FADP apply, each purpose has the legal basis shown.
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and running your account and workspace, and sending the e-mails the Service needs (address confirmation, password resets, invitations, the digests you subscribe to) | Account and workspace data | Performance of our contract with you or your organisation (Art. 6(1)(b)) |
| Billing, invoices and tax records | Billing data, VAT number | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Answering requests and support | Contact and support messages, attachments | Steps you asked for before a contract (Art. 6(1)(b)); our legitimate interest in answering you (Art. 6(1)(f)) |
| Assessing your job application and contacting you about it | Application data and CV | Steps you asked for before a contract (Art. 6(1)(b)); our legitimate interest in recruiting (Art. 6(1)(f)) |
| Keeping the Service secure; preventing fraud and abuse | IP address, browser, sign-in times, activity records, logs | Legitimate interests in protecting the Service and its users (Art. 6(1)(f)) |
| Copying your provider profile picture as your photo | Profile picture | Legitimate interest in showing who is who in your workspace (Art. 6(1)(f)); you can remove it, and it is then not copied again |
| Product updates and marketing e-mails | E-mail address, name | Your consent (Art. 6(1)(a)), which you can withdraw at any time in Account settings or with the link in each e-mail |
| Complying with the law and answering lawful requests | As required | Legal obligation (Art. 6(1)(c)) |
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you, and we do not sell personal data or use it for advertising.
Where your data is kept
BunBunCloud runs in two data regions on Amazon Web Services. You choose one when you register your business:
- Europe (Frankfurt, Germany): the accounts, workspace data, billing records and support messages of workspaces in this region are stored and processed in the European Union.
- Asia-Pacific (Singapore): for the other workspaces.
This website is served from the region nearest you: Frankfurt for visitors in Europe, Singapore elsewhere. What you send through its forms (contact, assessment, sample report, security pack, job applications) is stored and processed in the region that served the page. Our team may access the Service from outside the European Union to operate and support it, only as needed, over encrypted connections, and every administrative action is recorded.
Workspace data
We process the data in your workspace on your behalf, only to provide the Service to you, under our Data Processing Addendum; you decide which accounts and tools are connected. An administrator can export it and delete the workspace at any time (Settings, Workspace), which deletes its data. When you run BunBunCloud yourself on Scale, all data it collects stays in your environment: we do not receive it, and the product sends us no telemetry.
Who we share it with
We do not sell personal data. We entrust it, under contract and our supervision, to the service providers that help us run BunBunCloud, listed with what they do and where on our sub-processors page:
- Amazon Web Services, which hosts the Service and this website in Frankfurt (Europe region, and the website for visitors in Europe) and Singapore (Asia-Pacific region, and the website for other visitors);
- Stripe, which processes payments;
- an e-mail delivery provider, which sends the Service's e-mails from the region of your workspace.
When you sign in with Google, GitHub or LinkedIn, that provider learns that you signed in to BunBunCloud, under its own privacy policy.
The tools you connect to your workspace (for example Slack or Jira) receive the information you choose to send them, at your direction. Otherwise, we disclose personal data only where the law requires it.
International transfers
As a French company, we apply the GDPR to all the personal data we handle, wherever it is stored. Workspaces in the Europe region, and what visitors in Europe send through this website, stay in the European Union. Data of the Asia-Pacific region, and what other visitors send through this website, is stored in Singapore, and some providers are in the United States: these transfers to countries without an adequacy decision rely on the European Commission's Standard Contractual Clauses (with the UK Addendum and the Swiss adjustments where they apply), or on the EU–US Data Privacy Framework where the recipient is certified. You can ask us for a copy of these safeguards. For people in Japan, these safeguards also meet the APPI.
Sale or transfer of our business
If our business is sold, merged or reorganised, the personal data we hold may be transferred to the acquiring entity as part of the business, and remains subject to this policy.
How long we keep it
| Data | Kept |
|---|---|
| Contact, assessment, security pack and support messages, with their attachments and our replies | 24 months after our last exchange |
| Job applications and CVs | 24 months after our last update to the application, unless you ask us to delete them sooner |
| Accounts | For as long as they exist; deleted with the account or its workspace |
| Signed-in sessions (IP address and browser) | 30 days after the session ends |
| Copies of the e-mails we send | 24 months |
| Activity records (who did what in a workspace, and what our administrators did) | 24 months |
| Workspace data | Until the workspace is deleted, then permanently deleted within 30 days |
| A copy of your data you asked for | 7 days, then the file is deleted |
| Payment and tax records | Seven years, as tax law requires, then deleted |
How we protect it
Connections are encrypted (HTTPS); passwords are stored only as salted one-way hashes; integration credentials are encrypted at rest; each workspace's data is kept separate from the others; BunBunCloud reads your cloud accounts through read-only roles; and access to our systems is restricted to the people who need it, with their actions recorded.
To help with a request or to keep the Service secure, our support staff may view a workspace as one of its users: read-only, for at most an hour at a time, seeing only what that user sees. They cannot change anything while doing so, and each view is recorded in our internal logs.
Cookies
We use no analytics, advertising or tracking cookies, and nothing on this website or in the app is loaded from other companies, so we do not ask for your consent. The app uses only these cookies, all strictly necessary for the service you ask for:
| Cookie | Purpose | Kept for |
|---|---|---|
ci_session | Keeps you signed in to the app. | 14 days, or until you sign out |
bbc_region | Remembers your data region (Europe or Asia-Pacific), so the website's Sign in link opens the right one. | 1 year |
ci_oauth | Protects a sign-in with Google, GitHub or LinkedIn while it is in progress. | 10 minutes |
ci_pending | Holds a new account's sign-in with Google, GitHub or LinkedIn until you name your business. | 30 minutes |
Your preferences are kept in your browser's storage, not in cookies, and never sent to us: in the app your theme, language, team or all-teams view, folded sidebar and hidden setup checklist; on this website the currency shown on the pricing page.
Your rights
You may ask us for access to the personal data we hold about you, to correct it, to delete it, to restrict its use, to receive it in a portable format, and to object to its use based on our legitimate interests; where we rely on your consent, you can withdraw it at any time. Under the APPI you may also ask us to disclose, correct, or stop using or delete it. Write to privacy@bunbuncloud.com, or by post to ALLEZOU SAS, 40 Rue Damrémont, 75018 Paris, France. We answer within one month (extendable by two more for complex requests, in which case we tell you why), free of charge, and may ask you to confirm your identity. For data in a customer's workspace, write to that organisation: we help them answer.
You can also get a copy of the personal data your account holds yourself, in the app under Account settings, Privacy and data. We e-mail it to you as a link that works for 7 days, and only while you are signed in; after that, the file is deleted.
You also have the right to lodge a complaint with a data protection authority: our lead authority is the French Commission nationale de l'informatique et des libertés (CNIL, 3 place de Fontenoy, 75007 Paris, cnil.fr); you may also complain in the EU or EEA country where you live or work or where you think your rights were infringed; in the United Kingdom, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner; in Japan, the Personal Information Protection Commission. We would appreciate the chance to address your concern first.
Data breaches
If a personal data breach occurs, we notify the CNIL (and the competent authority elsewhere where the law requires it) without undue delay and, where the GDPR or UK GDPR require it, within 72 hours, as well as the Personal Information Protection Commission under the APPI; we tell the people affected when the breach is likely to put their rights at high risk. For workspace data, we notify the customer without undue delay so they can meet their own obligations.
E-mails
We send the e-mails needed to run the Service, and keep a copy of each (its recipient, content and outcome) for 24 months, so we can answer questions about it. We send product updates and marketing e-mails only to people who agreed to receive them, and each contains a way to unsubscribe.
Children
BunBunCloud is a service for businesses and is not directed at children.
Changes
We may update this policy. We post the new version on this page with its date, and tell customers of material changes by e-mail. These policies are written in English; translations are provided for convenience, and the English version prevails.