Last updated November 1, 2026
Privacy policy
Verybear LLC ("Verybear," "we," "us") is a Delaware limited liability company. This policy explains how we handle data when your organization uses Verybear.
The short version
- Verybear sits between your AI tools and the model providers you choose. We route requests; we don't read them by default.
- We do not store prompt or response content unless an admin on your team turns on content retention.
- We do store routing decisions and usage metadata: which flow matched, which model ran, token counts, cost, and timestamps.
- Your prompts and responses pass through to your chosen model provider under that provider's own terms.
- You can ask for a copy of your data or ask us to delete it. See Your privacy rights.
1. Who we are
Verybear is a routing layer for AI tools. Your team keeps using the AI tools and model providers it already uses. Verybear sits in the middle, decides which model and effort level should handle each request based on your organization's flows, playbooks, budgets, and policy, and sends the request on to the provider you've chosen. We are the data controller for the account and configuration data described below, and a data processor for anything that passes through our routing layer on your behalf.
2. Scope of this policy
This policy covers data processed through verybear.com, the Verybear console, and the Verybear API and SDKs (together, the "Service"). It applies to account holders, organization admins, and individual users who send requests through the Service. It does not cover the practices of model providers, sign-in providers, or other third-party tools your organization connects; those are governed by their own privacy policies.
3. Information we collect
We collect four kinds of information.
Account data
Name, work email address, organization, role, and authentication details. If you sign in through Google, GitHub, or Microsoft, we receive the basic profile information described in section 7.
Organization configuration
The flows, playbooks, budgets, and policy your admins set up: routing rules, spend limits, model preferences, desk and tool identifiers, and similar settings. Your organization owns this configuration; we process it to run the Service.
Usage and telemetry
For every request we route, we record the routing decision (which flow matched, which model and effort level were used), token counts, cost, latency, timestamps, and the tool or desk identifier the request came from. This is what powers your spend and adoption dashboards. It does not include the words of the prompt or the response.
Request content
By default, Verybear does not store the content of prompts or model responses. We are built to route requests, not to read or retain them. Content is held in memory only as long as it takes to make a routing decision and forward the request, then discarded. If an organization admin turns on optional content retention for debugging or evaluation, prompts and responses for that organization are stored until the admin turns it off or the configured retention period expires, whichever comes first.
4. How we use information
We use the information above to:
- Operate the Service, including routing requests and enforcing your organization's policy and budgets.
- Show usage, spend, and adoption data to your admins and finance team.
- Provide customer support and respond to requests you send us.
- Send account, billing, and service notices.
- Detect, investigate, and prevent fraud, abuse, and security incidents.
- Meet legal and tax obligations.
We do not sell personal information, and we do not use customer content to train models. See our Terms of Service for how flow and policy configuration may inform aggregated, de-identified product improvements.
5. Sub-processors
We use a small number of sub-processors to run the Service. These generally fall into the following categories:
- Cloud hosting and infrastructure, to run and store the Service.
- Email delivery, to send account, billing, and service notices.
- Payment processing, to handle subscription billing.
- Product analytics, to understand how the Service is used and improve it.
Each sub-processor is bound by a written agreement that limits its use of data to providing services to us. A current list of sub-processors is available on request to [email protected].
6. Model providers
When Verybear routes a request, the request content is sent to the model provider your organization has configured for that flow, whether that is a provider account your organization owns or one Verybear manages on your behalf. Model providers act as independent data controllers or processors for the content they receive, under their own terms and privacy policies. Verybear does not control how a model provider handles content once it reaches them, and we encourage your admins to review each configured provider's terms before enabling it.
7. Sign-in providers
You can sign in to Verybear using Google, GitHub, or Microsoft. When you do, the provider shares your name, email address, and a unique account identifier with us so we can create or match your Verybear account. We do not receive your password for these providers, and we do not post to these accounts on your behalf.
9. Security
We encrypt data in transit using TLS and encrypt data at rest. Access to production systems and customer data is limited to employees who need it to do their jobs, and is logged. We are working toward SOC 2 Type II certification; we can share our current security posture and roadmap under a non-disclosure agreement on request.
10. Data retention
We keep account data and organization configuration for as long as your account is active, and for a limited period after closure to allow export and to meet legal obligations. Usage and telemetry records are kept for the period needed to provide historical reporting, typically no more than 24 months, unless your plan specifies a different period. Optional stored content is kept only as long as your admin has configured, and is deleted on request.
11. International data transfers
Verybear is based in the United States, and we may process data in the United States and other countries where our sub-processors operate. Where we transfer personal data out of the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses or an equivalent lawful transfer mechanism.
12. Your privacy rights
Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data, and to object to or restrict certain processing. This includes rights under the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). You can exercise these rights by contacting [email protected]. Admins can export or delete their organization's usage history directly from the console on supported plans. We will not discriminate against you for exercising these rights.
13. Children's privacy
Verybear is a business product. It is not directed at, and we do not knowingly collect personal information from, anyone under 16 years old. If you believe a child has provided us personal information, contact us and we will delete it.
14. Changes to this policy
We may update this policy as our Service or legal obligations change. If we make a material change, we'll notify account admins by email or through the console before it takes effect. The "Last updated" date at the top of this page always reflects the current version.
15. Contact us
Questions about this policy or how we handle data can be sent to [email protected]. Verybear LLC is a Delaware limited liability company.