Who we are
Gunnie.ai is a product of Gunnie, in the Netherlands (Chamber of Commerce 74961438). This statement covers the Gunnie.ai service: this site, the control panel and connector at app.gunnie.ai, and the routines that run on our server. The gunnie.nl website has its own privacy statement.
Questions about privacy go to support@gunnie.ai.
Our two roles
For the data in the systems your organisation connects, such as tickets, code, products and designs, Gunnie is a processor: we handle it only to answer your members’ requests and to run the routines your admins switch on, on your organisation’s instructions. Your organisation stays the controller of that data.
For your members’ accounts, the call log and running and invoicing the service, Gunnie is the controller.
What we process
Gunnie.ai is a gate, not a copy. When someone asks a question, it fetches the answer live from the system that owns the data and passes it to their AI assistant; the question and the answer are not stored. For a code review or a build, code is checked out on our server for the time it takes and deleted afterwards.
What we do keep:
- Members: name, work email address, organisation, role, and login sessions.
- The call log: who called which tool, when, the outcome, how long it took and which assistant was used. Never the question, the arguments or the answer.
- Questions asked of Gunnie.ai’s own help (gunnie_help): the question text, the organisation and when, not who asked and never the answer, so we can see what our docs leave unanswered.
- Connections: their settings and allow-lists, and access tokens, members’ sign-ins at outside servers and registry keys for private Composer packages, stored encrypted.
- Routines: the result of each run, changes waiting for approval and the decisions on them, and per run its cost, its token counts and the ticket keys it named.
- The SKUs that catalog health found or its open tickets name.
- Messages you send us for support.
- Our web server’s access logs, on our own server in Germany: per request the IP address, the address requested with its query, the request headers such as browser and referrer (never cookies or login headers), the status, timing and connection details.
- Visits to this site’s pages, counted with Cloudflare Web Analytics: the page, the referring site, the browser, the country and how fast the page loaded. It sets no cookies, stores nothing in your browser and does not follow you across sites; we see only totals. The control panel at app.gunnie.ai is not counted.
Personal data in your systems
Tickets, commits and orders can hold names, email addresses, phone numbers and IP addresses. On new connections to your tickets, code hosts and shop, Gunnie.ai masks these for every role but admin, until an admin lets a role see them. Files that hold secrets, such as .env files and keys, are never read.
Why we process it
To provide the service your organisation signed up for: logging members in, checking each call against their role, answering requests, running routines and showing their results. To keep the service secure and to find abuse, which is our legitimate interest. And to invoice, which the law requires us to keep records of.
Gunnie.ai does not train AI models, and nothing that passes through it is used to train one. Under Anthropic’s commercial terms, Claude is not trained on your data either. We do not sell data, and this site sets no tracking cookies.
How long we keep it
The call log, routine results and decided approvals are deleted after 30 days, or after the period your admin chose (7 to 365 days). Token counts and ticket keys per run follow the same period. Counts of what each run did are kept to show your history; they hold no ticket text, code or arguments. Costs per run are kept with the invoices, as long as Dutch tax law requires.
A member’s account is kept while they are a member. Sign-ins at outside servers are deleted when the member signs out or is switched off. Findings of a review someone starts from their assistant are stored encrypted, for that person only, and deleted after the organisation’s retention period (30 days unless an admin chose otherwise). Questions asked of Gunnie.ai’s own help are deleted after 30 days, or sooner if the organisation keeps its records shorter. Web server access logs are kept for up to 30 days. The security overview lists every kind of data and what happens to it.
Who helps us run it
These providers handle a limited part of the service on our behalf, under a processing agreement with us:
- Hetzner (Germany and Finland): the servers Gunnie.ai runs on: the service, its database and its backups in Germany, and the server where Bob installs and tests your code in Finland.
- Cloudflare: DNS and the network in front of gunnie.ai and app.gunnie.ai: encrypted connections and protection against attacks. Requests to Gunnie.ai pass through it. On gunnie.ai it also counts visits to the site’s pages with Cloudflare Web Analytics, without cookies.
- Stytch (United States): sign-in: your work email address and your login sessions.
- Anthropic (United States): Claude, for code reviews, routines and Bob; where configured, through Gunnie’s own Microsoft Azure, AWS or Google Cloud account in EU regions.
- Slack: replies and routine reports, only for organisations that connect Slack.
Data outside the EU
Our servers run in European data centres. Some of the providers above are based in the United States. Where data leaves the EU, it is protected by the safeguards the GDPR allows, such as the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses. On request, an organisation’s AI runs in EU regions.
Security
Roles and allow-lists limit what every member and routine can reach, every change waits for approval, tokens are encrypted and every organisation is kept apart in the database. The security overview explains how.
Your rights
You can ask to see, correct or delete your personal data, to limit or object to its use, and to receive it in a format you can take elsewhere. Email support@gunnie.ai; we answer within a month. For data in your organisation’s own systems, your organisation decides, so we pass such a request on to your admins.
If you think we handle your data wrongly, tell us first. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
Data processing agreement
A data processing agreement is available. Ask support@gunnie.ai.
Changes
We update this statement when the service changes. It was last changed on 11 November 2026.