Privacy Policy

Bright Beam International, Inc. ("Bright Beam", "we") operates Beam.expert, an AI workspace for businesses. This Privacy Policy explains how we handle personal data when you visit beam.expert, create an account, use the web or desktop app, or communicate with us.

Two roles matter throughout this policy:

• For account data, billing, usage, and website visitors, Bright Beam is the controller (or "business" under US state law) and this policy applies directly.
• For personal data your workspace uploads or generates — knowledge documents, prompts, drafts, customer names in evidence files, emails sent through connected apps ("Customer Data") — your organization is the controller and we process it only on its instructions as a processor (or "service provider"). Our Data Processing terms at /legal/data-processing govern that processing. If you are an end customer of one of our customers, contact that organization about its use of your data.

We do not intentionally collect special-category data (health, biometrics, religion, etc.) and ask that you do not upload it unless you have a lawful basis and it is necessary for your use of the Service.

We do not sell personal data, do not "share" it for cross-context behavioral advertising, do not use it for targeted advertising, and do not make automated decisions that produce legal or similarly significant effects about you.

When you use an AI feature, we assemble a request from your prompt or intention, your workspace's AI profile, the agent's instructions, and relevant excerpts retrieved from your knowledge library. That request is sent to an AI model provider through our hosting provider's model gateway to generate a response, an embedding, or an image.

• Model providers process requests only to return a response. We send requests with provider-side storage disabled, under terms that prohibit the provider from using your data to train its models. We do not train foundation models on your data either.
• Knowledge retrieval is tenant-scoped: an agent can only retrieve documents that belong to your workspace (and, where configured, to that agent).
• Agents never execute actions in connected apps on their own. They propose an action with its exact arguments; it runs only after a person in your workspace approves it. Each approval and result is recorded in your audit history.
• AI telemetry records the model, token counts, latency, and a hashed user identifier. It never records prompt or output text.
• AI output can be inaccurate. Beam labels outputs as drafts for review and cites the knowledge excerpts used where you enable citations.

We share personal data only with the following categories of recipients, and only as needed for the purposes above:

• Subprocessors that host and operate the Service on our behalf under written data-protection terms (listed below and kept current at /legal/data-processing).
• Third-party applications you connect — only the data involved in actions you approve.
• Your workspace: teammates you invite can see workspace content according to their role. Workspace owners and admins can see members' names, emails, roles, and activity timestamps.
• Professional advisers (lawyers, accountants, auditors) under confidentiality.
• Authorities or other parties when required by law, legal process, or to protect the rights, safety, or property of Bright Beam, our customers, or the public. We challenge over-broad requests and notify affected customers where legally permitted.
• A successor in a merger, acquisition, or asset sale, subject to this policy and with notice to you.

Our subprocessors fall into the categories below. We name individual vendors, and share their security certifications, on request to legal@beam.expert.

We are based in the United States and our subprocessors process data primarily in the United States. If you are in the European Economic Area, United Kingdom, or Switzerland, your personal data is transferred to the US.

We rely on the European Commission's Standard Contractual Clauses (Module 2 controller-to-processor and Module 3 processor-to-processor, as applicable), the UK International Data Transfer Addendum, and the Swiss FADP addendum, together with supplementary security measures, for these transfers. Where a subprocessor is certified under the EU-US Data Privacy Framework we may also rely on that certification. Copies of our transfer terms are available on request to privacy@beam.expert.

We use encryption in transit (TLS 1.2+) and at rest, hashed passwords, role-based access control, tenant isolation on every query, signed OAuth state and user verification on connected-app authorizations, approval gates on all external actions, least-privilege access for staff, and audit logging. Payment card data never touches our systems. No method of transmission or storage is perfectly secure; if we learn of a breach affecting your data we will notify you as described in the Terms and as required by law. Report vulnerabilities to security@beam.expert.

Beam uses only strictly necessary cookies and local storage; we do not use advertising or third-party analytics cookies, so no cookie banner is required under the ePrivacy Directive.

The desktop app stores the same session cookies in its own isolated profile on your device. You can clear them by signing out.

Everyone can access and update account details in Settings, export workspace data, manage connected apps, and delete their workspace. Depending on where you live you also have legal rights, described below. To exercise them email privacy@beam.expert from the address on your account; we respond within 30 days (45 days for US state requests, extendable once with notice) and never discriminate against you for exercising your rights. We may need to verify your identity first.

European Economic Area, United Kingdom, and Switzerland (GDPR / UK GDPR / FADP): you have the right of access, rectification, erasure, restriction, portability, and objection (including to processing based on legitimate interests), and the right to withdraw consent where processing relies on it. You may lodge a complaint with your local supervisory authority; in the EEA, a list is at edpb.europa.eu, in the UK it is the ICO (ico.org.uk).

California (CCPA/CPRA) and other US states (including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and others with comprehensive privacy laws): you have the right to know what personal information we collect and how it is used and disclosed, to access it in a portable format, to correct it, to delete it, and to opt out of sale, sharing, or targeted advertising. We do not sell or share personal information or use it for targeted advertising, and we do not use sensitive personal information beyond what is necessary to provide the Service, so no opt-out is needed. You may appeal a decision on your request by replying to our response. California residents may designate an authorized agent. In the preceding 12 months we disclosed the categories above to the service providers listed for business purposes only.

Where Bright Beam is a processor for your organization's Customer Data, we will forward your request to that organization and help it respond.

Marketing: we send only transactional and service emails. If we ever introduce marketing email you will be able to opt out in each message.

The Service is for businesses and is not directed to anyone under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact privacy@beam.expert and we will delete it.

We will post any changes here and update the effective date. For material changes we will notify workspace owners by email or in the product at least 30 days in advance. Prior versions are available on request.

Controller: Bright Beam International, Inc., 2219 Main St, Santa Monica, CA 90405, United States. Privacy questions and requests: privacy@beam.expert. Our EU and UK representative details (where required under GDPR Article 27) will be published here once appointed; until then contact privacy@beam.expert.