Privacy policy

Beamy AI is a software service operated by The Global Company ("we", "us", "our"). Beamy AI analyses how artificial intelligence engines describe and recommend brands, and helps businesses improve how they are represented in those systems.

This Privacy Policy applies to the beamy-ai.com website, the app.beamy-ai.com application, and every related service we provide (together, the "Service").

For the purposes of the EU and UK General Data Protection Regulation, The Global Company is the controller of the personal information described in this policy, except where we act as a processor on behalf of a business customer, which is explained in section 12.

We are based in Australia and we serve customers internationally. This policy is written to meet the requirements of the Australian Privacy Act 1988 and the Australian Privacy Principles, the EU and UK GDPR, and United States state privacy laws including the California Consumer Privacy Act as amended by the CPRA. Where those laws differ, we apply the standard most protective of you, and the region-specific sections at the end of this policy set out additional rights that apply to you depending on where you live.

Registered address: [PLACEHOLDER - registered address]. ABN: [PLACEHOLDER - ABN]. Privacy contact: privacy@beamy-ai.com.

This summary is provided for convenience. It does not replace the full policy below.

• We collect the information you give us when you create an account, the information you give us about the brands you want to analyse, and technical information about how you use the Service.
• We run your brand name and prompts through third-party AI engines and store what those engines say in reply.
• We use cookies and similar technologies. Non-essential ones only run if you consent.
• We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
• You can access, correct, export and delete your information at any time from within your account.
• We keep your information only as long as we need it, and anonymous scan results are deleted after 30 days.

3.1 Information you give us

Account information. When you create an account we collect your email address and a password. Passwords are never stored in readable form; they are hashed by our authentication provider and we cannot see them. You may optionally add your full name, an avatar image, your country and your timezone.

Brand and workspace information. When you use the Service you provide information about the brands you want to analyse. This includes brand names, website addresses, descriptions, industry, country, the names and websites of competitors you choose to track, and the prompts you want tested. This information is usually commercial rather than personal, but where a brand is a sole trader operating under a personal name, or where a prompt contains a person's name, that information is treated as personal information under this policy.

Workspace membership information. If you invite someone to a workspace, we collect the email address you supply in order to send that invitation and to manage their access.

Payment information. If you subscribe to a paid plan, payment is processed by Stripe. We do not receive, store or have access to your full card number, CVC or bank details. We receive and store a customer identifier, a subscription identifier, the plan you are on, your billing period, your subscription status and the dates of your billing period.

Communications. If you contact us, we keep a record of that correspondence.

Newsletter subscription. If you opt in to our newsletter, we store your email address, the source of the subscription, the campaign parameters associated with it, the date you confirmed, and the date you unsubscribed if applicable.

3.2 Information we collect automatically

Usage and device information. When you visit the Service we automatically record page paths, referring URLs, campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content), advertising click identifiers (gclid, fbclid), device type, browser, operating system, and country derived from your IP address.

Identifiers. We generate a random anonymous identifier and store it in your browser's local storage so we can understand how visitors move through the Service before they create an account. If you later create an account, that anonymous identifier is linked to your account so we can understand which channel brought you to us. This is called attribution, and we record both your first interaction with us and your most recent one.

Abuse-prevention information. Our free scan is expensive for us to run and is a target for automated abuse. To protect it, we process your IP address and a device fingerprint derived from your browser's characteristics. We do not store your IP address or your raw device fingerprint. Both are converted into salted, irreversible cryptographic hashes before storage. We cannot reverse those hashes to recover your IP address, and we do not attempt to. We also use Cloudflare Turnstile to distinguish humans from automated scripts. We log every rate-limiting decision, including whether a request was allowed or blocked and the reason.

Product analytics. We record events describing how you use the Service, such as starting a scan, completing a scan, viewing pricing, and opting in to the newsletter. These events are recorded as first-party records tied to your anonymous identifier or your account.

3.3 Information we generate about you

Scan results. When you run a scan, we send your prompts to third-party AI engines and store the answers they return. These answers are generated by third parties and may mention your brand, your competitors, other businesses, or individuals. We store the full text of those answers, together with our analysis of them: whether your brand was mentioned, in what position, with what sentiment, which competitors were named, and which sources were cited.

Beam Score and recommendations. We calculate a score and generate written analysis and recommendations from your scan results.

Cost and usage records. We record every call we make to a third-party AI provider on your behalf, including the model used, the number of tokens consumed, the cost, the latency and whether it succeeded. We use these records to operate the Service, control our costs and enforce plan limits.

3.4 Information we do not want

Beamy AI is a business tool and is not designed to process sensitive information. Please do not enter into the Service any information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health information, sexual orientation, criminal history, government identifiers such as tax file numbers or social security numbers, or payment card details.

If you enter such information, you do so on your own initiative and you are responsible for having a lawful basis to do so. We will delete sensitive information we become aware of, and we may suspend an account that repeatedly submits it.

3.5 Children

The Service is not directed at children and is not intended for anyone under 18. We do not knowingly collect personal information from children. If we learn that we have collected information from a person under 18, we will delete it. If you believe a child has provided us with personal information, contact us and we will act promptly.

Where the GDPR applies, we must have a legal basis for each purpose. The table below sets out both.

Where we rely on legitimate interests, we have assessed those interests against your rights and freedoms and concluded that our processing is proportionate and would be reasonably expected by you. You may object to processing based on legitimate interests, as described in section 9.

Where we rely on consent, you may withdraw it at any time. Withdrawing consent does not affect processing that already took place.

You should understand clearly how this Service works, because AI is central to it.

We send your prompts to third-party AI engines. These currently include OpenAI, Google, Anthropic and Perplexity. We query them through their official commercial application programming interfaces. We enable their web search capabilities so that the answers reflect current information rather than only the model's training data.

We use AI to analyse the results. We use large language models to extract structured information from those answers and to write the narrative analysis and recommendations you receive.

These outputs may be wrong. AI systems produce inaccurate, incomplete, outdated and occasionally fabricated statements. The answers we capture are the statements of third-party AI systems and not our statements. Our score, analysis and recommendations are opinions generated by software. They are not professional advice of any kind, and you should exercise your own judgement before acting on them.

We do not make automated decisions with legal or similarly significant effects about you. Our scoring evaluates a brand's visibility in AI systems. It does not determine your access to credit, employment, insurance, housing or any other significant benefit, and it produces no legal effect concerning you.

We do not use your data to train foundation models. We do not train, fine-tune or otherwise develop AI models using your content, and we use AI providers under commercial terms that exclude our data from their model training.

We do not sell your personal information. We do not share it for cross-context behavioural advertising. We do not disclose it to data brokers.

We share information with the following categories of recipient, each of which is contractually bound to protect it and to use it only on our instructions:

Infrastructure and hosting. Supabase provides our database, authentication and storage. Lovable provides our application hosting. Cloudflare provides bot protection through Turnstile.

AI providers. OpenAI, Google, Anthropic and Perplexity receive the prompts we send on your behalf. Those prompts typically contain your brand name and your competitors' names. They do not contain your email address, your account details or your payment information.

Payments. Stripe processes subscription payments and holds your payment credentials directly.

Email delivery. Our email provider sends transactional messages such as verification and password resets, and our newsletter where you have subscribed.

Professional advisers. Our lawyers, accountants, insurers and auditors, where they need the information to advise us.

Authorities. We will disclose information where we are legally required to, including in response to a valid court order, subpoena, warrant or lawful request from a regulator or law enforcement agency. Where we are permitted to do so, we will notify you before disclosing. We will resist requests that we believe to be overbroad or unlawful.

In a corporate transaction. If we are involved in a merger, acquisition, financing, reorganisation or sale of assets, your information may be transferred as part of that transaction. We will require the recipient to honour the commitments in this policy, and we will notify you if your information becomes subject to a materially different policy.

Other users of your workspace. If you share a workspace, the other members of that workspace can see the brands, prompts, scans and results within it, in accordance with the role you gave them.

We are based in Australia. Our service providers operate in Australia, the United States, the European Union and elsewhere. This means your personal information will be transferred to, stored in and processed in countries outside your own, including countries that may not provide the same level of legal protection as your home country.

Where we transfer personal information out of the European Economic Area or the United Kingdom, we rely on one of the following safeguards:

• Transfer to a country recognised by the European Commission or the UK government as providing an adequate level of protection.
• Standard Contractual Clauses approved by the European Commission, or the UK International Data Transfer Addendum, incorporated into our agreements with the recipient.
• Where necessary, supplementary technical and organisational measures such as encryption in transit and at rest.

Where we disclose personal information outside Australia, we take steps reasonable in the circumstances to ensure the recipient does not breach the Australian Privacy Principles, as required by Australian Privacy Principle 8.

You may ask us for details of the safeguards applying to a particular transfer.

We keep personal information only as long as we need it for the purposes described in this policy, or as long as the law requires.

Where we no longer need information but cannot delete it immediately, for example in backups, we isolate it and stop actively processing it until deletion occurs.

We may retain information for longer where necessary to establish, exercise or defend legal claims, to comply with a legal obligation, or where you have an unresolved dispute with us.

Subject to the law that applies to you, you have the following rights. Section 13 sets out additional rights specific to your region.

Access. You can obtain a copy of the personal information we hold about you. You can do this yourself at any time using the "Export my data" function in your account settings, which produces a complete machine-readable file.

Correction. You can correct inaccurate or incomplete information. Most information can be edited directly in your account.

Deletion. You can delete your account and all associated data using the "Delete my account" function in your account settings. This is irreversible.

Portability. You can receive your information in a structured, commonly used, machine-readable format. The export function provides this.

Objection. You can object to processing based on our legitimate interests. You can object to direct marketing at any time and we will stop.

Restriction. You can ask us to limit how we use your information while a dispute about its accuracy or our use of it is resolved.

Withdrawal of consent. Where we rely on consent, you can withdraw it at any time, including by changing your cookie preferences or unsubscribing from our newsletter.

Complaint. You can complain to your data protection authority. In Australia this is the Office of the Australian Information Commissioner. In the European Union it is the supervisory authority of your member state. In the United Kingdom it is the Information Commissioner's Office. We would prefer that you raise the matter with us first so we can put it right.

How to exercise your rights. The fastest route is your account settings, where access, export and deletion are self-service. For anything else, contact us using the details in section 15.

We will respond within 30 days. Where a request is complex we may extend this by a further 60 days and will tell you if we do. We do not charge a fee unless a request is manifestly unfounded or excessive, in which case we will tell you the cost before proceeding. We will not discriminate against you for exercising your rights.

We may need to verify your identity before acting on a request. We will ask only for the minimum information needed to do so, and we will not use it for any other purpose.

We take the security of your information seriously and we apply measures appropriate to the risk.

• All data is encrypted in transit using TLS, and encrypted at rest.
• Passwords are hashed and salted by our authentication provider. Nobody at our organisation can view your password.
• Access to production data is restricted to those who need it, and is protected by strong authentication.
• Database access is governed by row-level security policies enforced at the database itself, so a user can only ever read the records they are entitled to read.
• IP addresses and device fingerprints are hashed with a secret salt before storage and are never written in raw form.
• API credentials for third-party providers are held in a dedicated secrets store and are never exposed to your browser.
• We log administrative and security-relevant events.

No system is perfectly secure. We cannot guarantee absolute security, and you provide information to us at your own risk. You are responsible for keeping your password confidential and for the activity on your account. Tell us immediately if you believe your account has been compromised.

Breach notification. If a data breach occurs that is likely to result in serious harm to you, we will notify you and the relevant regulator as required by law, including the Notifiable Data Breaches scheme under the Australian Privacy Act and Articles 33 and 34 of the GDPR.

We use cookies, local storage and similar technologies. Our full Cookie Policy describes each one, what it does and how long it lasts.

In short: strictly necessary technologies always operate, because the Service cannot function without them. Everything else runs only if you consent. You can change your choices at any time through the cookie preferences link in the footer of our website.

Where you use Beamy AI to analyse brands and you are acting on behalf of a business, and where the information you enter includes personal information of your own customers, contacts or staff, we act as a processor and you act as the controller.

In that role we will process that information only on your documented instructions, keep it confidential, apply appropriate security measures, assist you with data subject requests and breach notification, engage sub-processors only under equivalent obligations, and delete or return the information when our agreement ends.

Our Data Processing Addendum sets out these obligations in full and forms part of our agreement with you.

13.1 Australia

We are bound by the Australian Privacy Principles under the Privacy Act 1988 (Cth).

You may deal with us anonymously or under a pseudonym where it is lawful and practicable. In practice this is possible for the free scan, which requires no account, but not for a paid subscription, since we need to identify you to provide the Service and to bill you.

We do not use or disclose personal information for direct marketing without your consent, and every marketing message includes a simple way to opt out.

We do not adopt, use or disclose government-related identifiers.

If you are dissatisfied with how we have handled your personal information, contact us first. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

13.2 European Economic Area and United Kingdom

The rights in section 9 apply in full. Our legal bases are set out in section 4. Transfer safeguards are described in section 7.

We have not appointed a Data Protection Officer, as we are not required to. Privacy enquiries are handled directly by us.

If you are in the EEA or the UK and wish to raise a concern, contact us first. You also have the right to complain to your national supervisory authority.

13.3 United States

California. Under the California Consumer Privacy Act as amended by the California Privacy Rights Act, you have the right to know what personal information we collect and how we use it, the right to delete it, the right to correct it, the right to opt out of sale or sharing, and the right to limit the use of sensitive personal information.

We do not sell personal information and we do not share it for cross-context behavioural advertising. We have not done so in the preceding 12 months. We do not knowingly sell or share the personal information of consumers under 16.

We collect the following categories of personal information as defined by the CCPA: identifiers such as your email address and online identifiers; commercial information such as your subscription record; internet or network activity such as your usage of the Service; geolocation data limited to the country derived from your IP address; and inferences drawn from your usage. The sources, purposes and recipients for each are described in sections 3, 4 and 6.

We do not collect sensitive personal information as defined by the CCPA, and we ask that you do not provide it.

We will not discriminate against you for exercising your privacy rights. You may use an authorised agent to make a request on your behalf, and we will require proof of that authorisation.

Other states. If you live in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana or another state with a comprehensive privacy law, you have substantially similar rights, including the right to appeal a refusal of a request. To appeal, reply to our decision and we will review it and respond with a written explanation.

Global Privacy Control. We honour opt-out preference signals, including Global Privacy Control, transmitted by your browser.

We may update this policy as our Service and the law evolve. When we do, we will change the version number and effective date at the top.

If a change materially affects your rights or how we use your information, we will give you prominent notice, which may include emailing you and displaying a notice in the Service, before the change takes effect. Where the law requires your consent to a change, we will ask for it.

We keep previous versions and will provide one on request.

If you have any question about this policy, want to exercise a right, or wish to make a complaint, contact us and we will respond within 30 days.

The Global Company
Operator of Beamy AI
Registered address: [PLACEHOLDER - registered address]
ABN: [PLACEHOLDER - ABN]
Email: privacy@beamy-ai.com

This policy describes how we handle personal information. It does not form part of any contract of employment and does not create rights beyond those the law provides.

The Service links to third-party websites and services that we do not control. This policy does not apply to them, and we are not responsible for their practices. Read their policies before providing information to them.

Nothing in this policy limits any right you have that cannot be limited by agreement under the law that applies to you.