Privacy policy

1. Who we are

Beam SAS ("Beam", "we", "us") is a French société par actions simplifiée with its registered office at 106 avenue de Versailles, 75016 Paris, France, registered with the Paris Trade and Companies Register under number 953 048 345. We are the controller of the personal data this policy describes.

For any question about your personal data, or to exercise your rights, write to legal@beamxp.com. You can also write to privacy@beamxp.com.

2. Our two roles

We are the controller of the data we collect for our own purposes: visits to this website, sales and support conversations, accounts and sign-in, billing, service emails, and the operation and security of the service. This policy covers that data.

When an organisation uses Beam, what its people put into their workspace (conversations, files, knowledge, recordings, agents, workflows, and data from connected apps) is processed on that organisation's behalf. The organisation, usually your employer, is the controller of that content and we are its processor, under the data processing addendum. Questions and requests about that content are best sent to the organisation; if they reach us, we pass them on.

3. What we collect, why, and on what basis

For each activity: the data involved, what we use it for, the legal basis under the GDPR, and how long we keep it.

Visiting this website

Data

What your browser sends with each request: IP address, date and time, the page requested, the referring page, and browser and device type.

Purpose

Delivering pages, keeping the service secure, and limiting abuse, such as too many requests from one address.

Legal basis

Our legitimate interest in running a secure website (Article 6(1)(f)).

Retention

Seven days at most, then deleted. Logs needed as evidence of an abuse or fraud are kept until the incident is resolved.

Contacting us or asking for a demo

Data

Your work email, and whatever else you choose to give: name, company, team size, what you want to automate, deployment needs, and your messages.

Purpose

Answering you, arranging a demo, and following up on your request. Your address does not enter a marketing sequence.

Legal basis

Your consent, given in the form, which you can withdraw at any time (Article 6(1)(a)), and steps you ask us to take before a contract (Article 6(1)(b)).

Retention

Three years from your last contact with us, then deleted. If you become a customer, as for account and contract data below.

Downloading the AI adoption playbook

Data

Your first name, last name and work email, and whether you ticked the box for marketing emails, with the date and the wording you agreed to.

Purpose

Giving you the playbook and knowing who reads it. If you ticked the box, sending you product news and occasional emails about AI adoption. Without the box, your address does not enter a marketing sequence.

Legal basis

Our legitimate interest in knowing who reads what we publish (Article 6(1)(f)). For marketing emails, your consent, which you can withdraw at any time (Article 6(1)(a)): every marketing email carries an unsubscribe link, or you can write to privacy@beamxp.com.

Retention

Three years from your last contact with us, then deleted. If you withdraw your consent, we stop sending marketing emails straight away and keep only the record of your consent and its withdrawal, as proof.

Your account

Data

Name, email address, profile picture where your Google or Microsoft account supplies one, the workspaces you belong to and your role in each, how you sign in (email code, Google or Microsoft), two-step verification settings, and your signed-in devices and sessions.

Purpose

Creating and securing your account, signing you in, and letting workspace admins manage who has access.

Legal basis

Performance of the contract with you or your organisation (Article 6(1)(b)), and our legitimate interest in keeping accounts secure (Article 6(1)(f)).

Retention

While you have an account. Once you have left every workspace, or if you ask us to delete your account, we delete it within 30 days, unless the law requires us to keep part of it.

Billing

Data

Name and email of the billing contact, company name, billing address and, where given, VAT number; the seats bought, invoices and payment status. Card and bank details are entered on the pages of our payment provider, Stripe, and stay with it: we never receive full card numbers.

Purpose

Billing the subscription, collecting payment and keeping accounting records.

Legal basis

Performance of the contract (Article 6(1)(b)) and our accounting and tax obligations (Article 6(1)(c)).

Retention

Accounting records for ten years, as French law requires; other contract records for five years after the contract ends.

Service emails

Data

Your email address and what the message is about.

Purpose

Invitations, sign-in codes, the notifications and approval requests you or your workspace set up, billing messages, and occasional onboarding tips and activity summaries for workspace admins.

Legal basis

Performance of the contract (Article 6(1)(b)). For onboarding tips and summaries, our legitimate interest in helping customers use the product (Article 6(1)(f)); ask us and we stop.

Retention

As long as the account the message relates to.

Support

Data

What you tell us when you write to support or sales and, if you ask us to look at a problem in your workspace, what we need to see to solve it.

Purpose

Answering and resolving your request.

Legal basis

Performance of the contract (Article 6(1)(b)) and our legitimate interest in answering the people we work with (Article 6(1)(f)).

Retention

For the customer relationship and five years after it ends, the period in which claims can be brought under French law.

How the service is used

Data

Events and counts about use of the service (for example, that a workspace was created, an agent was used or an app was connected, with the model or app name) and usage measures such as requests and tokens per model. These records never contain the content of messages or files.

Purpose

Applying usage limits, invoicing extra usage, showing admins their workspace's analytics, and learning which parts of the product are used so we can improve them.

Legal basis

Performance of the contract (Article 6(1)(b)) and our legitimate interest in running and improving the service (Article 6(1)(f)).

Retention

Deleted with the workspace.

Errors and security

Data

Technical details of errors (where they occurred, browser and device type, time), which carry diagnostic data, not workspace content; records of sign-ins and sessions; and each workspace's audit log of administrative actions.

Purpose

Finding and fixing failures, and detecting and investigating misuse of the service.

Legal basis

Our legitimate interest in a reliable and secure service (Article 6(1)(f)).

Retention

Error reports: 90 days, then deleted by our error-tracking provider (Sentry). Audit entries: as long as the workspace's retention settings keep them.

4. Who receives your data

• Our staff, only as far as their work requires it.
• Service providers that process data for us under contract: hosting (Amazon Web Services, in France), sign-in (Clerk), payments (Stripe), email delivery (Resend and Twilio SendGrid) and, where configured, error reporting (Sentry). The sub-processors page lists every provider that can process data in the service, what each does, and where it is established.
• Model providers, which receive what is needed to answer a request made in a workspace. That processing is on your organisation's behalf, under the data processing addendum.
• Public authorities, where the law requires us to disclose data.
• A buyer or successor, if all or part of our business is sold or merged, under a duty of confidentiality.

We do not sell personal data, and we do not share it with advertisers.

5. Cookies

This website and the app use only the cookies they need to work. We use no analytics, advertising or social media cookies and load no tracking scripts, so we do not ask for cookie consent.

The app also keeps interface preferences, such as a collapsed sidebar or pinned items, in your browser's local storage. You can delete cookies and local storage in your browser at any time; without the sign-in cookies, you cannot sign in.

6. International transfers

We host the service and its data in France, within the European Union. Some of our service providers are established in the United States (see the sub-processors page), so personal data can be transferred there.

Each such transfer relies on an adequacy decision of the European Commission, including the EU-U.S. Data Privacy Framework where the recipient is certified under it, or on the standard contractual clauses adopted by the European Commission, with additional measures where needed. You can ask us for a copy of these safeguards.

7. How we protect it

Data is encrypted in transit with TLS and encrypted at rest by our hosting provider, and stored credentials get an extra layer of application-level encryption. Each workspace's data is kept apart from every other's, access inside a workspace follows roles and sharing, and administrative actions are recorded in an audit log. The security page and annex 2 of the data processing addendum describe these measures in detail.

If a breach of your personal data is likely to put your rights and freedoms at high risk, we tell you without undue delay.

8. Your rights

Under the GDPR and French law, you have the right to:

• access your personal data and receive a copy (Article 15);
• have it corrected if it is inaccurate or incomplete (Article 16);
• have it erased, unless we must keep it, for example to meet a legal obligation (Article 17);
• restrict its processing (Article 18);
• receive the data you gave us in a structured, machine-readable format, or have it sent to another controller (Article 20);
• object to processing based on our legitimate interests, and at any time to messages about our product (Article 21);
• withdraw your consent at any time, without affecting processing carried out before (Article 7(3));
• give instructions on what happens to your data after your death (Article 85 of the French Data Protection Act);
• lodge a complaint with a supervisory authority.

Write to legal@beamxp.com to exercise them. We answer within one month, which the GDPR allows us to extend by two further months for complex or numerous requests, and we may ask you to confirm your identity. If your request concerns content in a workspace, we pass it on to the organisation that controls it and help it answer.

In France, the supervisory authority is the Commission nationale de l'informatique et des libertés (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr. You can also complain to the authority where you live or work.

9. Automated decisions

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

Inside a workspace, your organisation may run agents and workflows that act on data automatically. Those uses are decided by your organisation, as controller.

10. AI models and your data

Beam never trains models on your data, and we do not use the content of workspaces to build our own product. Requests go to the model provider the workspace chooses, under that provider's API terms, which for the major providers exclude training on API traffic.

Admins choose which models their workspace can use, and can supply their own provider keys; the sub-processors page explains what each provider receives.

11. Children

Our services are for organisations and are not directed at children.

12. Changes to this policy

When we change this policy, we update its version and date above and keep earlier versions available on request. If a change materially affects how we use your data, we tell workspace admins by email before it takes effect.

This policy is published in French and English. If the two versions differ, the French version prevails.

13. Version history