Privacy
Plain language. No dark patterns. No tracking.
Last updated: 2026-07-25. Operator: RADLAB LLC (Wyoming, USA).
This policy describes how bourdon.ai, the marketing site for the Bourdon project, handles your data. If something is unclear, contact [email protected].
This policy covers this marketing site only. The Bourdon software itself (Python / npm packages) runs on your machine, stores nothing on Bourdon-hosted infrastructure, and is governed by its license and security policy, not this page.
What we collect
We collect only the data necessary to serve this site. There is no account system, no signup, no comment system, and no analytics JavaScript on bourdon.ai.
| What | Why | How long | Who sees it |
|---|---|---|---|
| Standard HTTP request data, such as the requested URL, response status, timestamp, IP address, user-agent string, and country derived from the IP address | Serving and securing the site, routing requests, and diagnosing failures | Under Cloudflare’s service settings and policies. RADLAB LLC does not copy raw request logs into a separate analytics store. | Cloudflare and authorized RADLAB LLC administrators when necessary |
Email you send to addresses on this site (privacy@, licensing@, etc.) | Responding to your message | Until the conversation is resolved plus any retention period required by law | Whoever you wrote to and our email provider, Google Workspace |
What we do not collect
Outside the optional Ask-Bourdon assistant that you choose to open (described below), bourdon.ai does not:
- Set account, advertising, or analytics cookies
- Run client-side analytics JavaScript (Google Analytics, Plausible, Fathom, Mixpanel, etc.)
- Embed third-party scripts, pixels, or trackers for advertising or analytics
- Build advertising profiles from your behavior
- Sell, rent, or trade your data
- Track you across other sites
- Use fingerprinting or session replay
The pages use statically generated HTML, CSS, first-party JavaScript, and self-hosted Geist webfonts. The only third-party browser script the site loads is Cloudflare Turnstile, and only after you choose to open the assistant. View the source if you want to verify.
How we use server logs
Cloudflare processes standard HTTP request data when its edge network serves bourdon.ai. This release disables application observability, source-map upload, dependency instrumentation, and Wrangler usage reporting, and it includes no analytics JavaScript. RADLAB LLC does not export raw request logs into a separate analytics store or use them to build per-visitor profiles. Cloudflare may still produce operational, security, or aggregate service data under its settings and policies.
The lawful basis under GDPR Art. 6(1)(f) is legitimate interest in operating and improving the site; the data minimization, retention, and access-control safeguards described above are how we balance that interest against your privacy.
The Ask-Bourdon assistant
bourdon.ai offers an optional in-page assistant (“Ask Bourdon”) that answers questions about the project. It is strictly opt-in: Turnstile does not load until you open the assistant, and Anthropic receives nothing until you choose to send a question.
When you open and use the assistant:
- Cloudflare Turnstile processes browser, device, and network signals to distinguish legitimate requests from automated abuse. We use that result only for abuse prevention.
- The text of your questions (and the conversation so far) is sent to a Bourdon-operated Cloudflare Worker, which forwards it to Anthropic to generate a reply using the Claude API. Anthropic states that commercial API inputs and outputs are not used to train its models by default, except when a customer opts in or submits material through a feedback channel.
- There is no account or transcript database on RADLAB infrastructure. The browser copy is gone when you close the tab. Anthropic states that standard commercial API inputs and outputs are deleted within 30 days, subject to different agreements and limited policy-enforcement or legal exceptions.
Treat it like any third-party chat box: do not paste secrets, credentials, or sensitive personal data into it. It exists to answer questions about Bourdon, nothing more.
Third parties
We share data with third parties only as necessary to operate the site:
| Third party | What they receive | Why |
|---|---|---|
| Cloudflare | Standard HTTP request data and, when you open the assistant, Turnstile browser, device, and network signals | Hosting, edge security, and the optional assistant’s anti-abuse check |
| Anthropic | Questions you send to the Ask-Bourdon assistant and a bounded amount of conversation context | Generating replies through the Claude API under Anthropic’s commercial terms |
| Google Workspace | Any email you send to addresses on this site, and our replies | Email delivery |
We do not share your data with advertisers. We do not sell your data. If we ever add a new third party that touches your data, we will update this policy before that data sharing begins.
Your rights
Under GDPR (if you are in the EU/UK), CCPA (California), and similar regulations, you have the right to:
- Access, ask what data, if any, we hold that identifies you
- Correction, ask us to fix inaccurate data
- Deletion, ask us to delete data tied to you
- Objection, object to processing under legitimate interest
- Portability, receive a copy of data you provided in a usable format
- Complaint, lodge a complaint with your local data protection authority (e.g., ICO in the UK, your DPA in the EU, the California Attorney General)
Practically, since this site stores no per-visitor identifier, the most we typically hold tied to you is whatever email you have sent us. Email [email protected] to exercise any of the above; we aim to respond within 30 days.
Children
bourdon.ai is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has sent us data, email [email protected] and we will delete it.
Changes to this policy
We will update this page when our data practices change, and the “Last updated” date at the top will reflect the latest revision. Material changes (new data categories, new third parties, new purposes) will be summarized in a changelog at the bottom of this page. We will not apply weaker rules retroactively.
Contact
Privacy questions, data requests, or anything else covered by this policy: [email protected].
Operator: RADLAB LLC, a Wyoming limited liability company. This policy is governed by the laws of the State of Wyoming, United States. Where mandatory local law gives you stronger rights (for example, GDPR in the EU/UK), those rights apply in addition.