Privacy Notice

Operator and contact

BEON PASS is operated by BEON LIMITED, United States. Mailing address: 401 Adams Street, Floor 3, Toledo, OH 43604, United States. Email: info@beonlimited.com. Contact us about the service, privacy, billing, security or complaints. Do not send passwords, API keys, payment-card details or recovery codes.

Our roles

BEON generally determines purposes for its account administration, billing, fraud prevention, security and support. For some organization-directed processing we act on the organization’s instructions. The organization may separately determine why your data is used. Contact your organization for its notices; contact us if you are unsure which party handles your request.

Information processed

We process sign-in email and identity, passkey public keys and credential metadata, hashed recovery codes, connection/account identifiers, encrypted provider credentials, permissions, organization membership and invitation details, AI-client identifiers, billing references, payment-method summaries, agreement records, support requests and activity records. Provider requests and results may contain personal data, source code or confidential business information. We receive information from you, organization administrators, connected providers, AI clients and our service vendors. Payment-card information is collected by secure payment components; our ordinary billing flow receives references and limited card summaries.

Purposes and legal bases

We process necessary account and service information to perform our agreement with you; process business-contact, abuse-prevention and security information for legitimate interests subject to applicable balancing and objection rights; retain required records to comply with law; and use consent where it is legally required. An organization’s separate lawful basis governs processing it instructs us to perform. Agreement to Terms is not general consent to unrelated marketing or tracking. We do not use connected-provider content to train our own AI models or sell it for advertising.

Credentials, provider data and activity

Credentials are encrypted before database storage and decrypted server-side when needed for authorized operations. They are not intentionally returned to AI clients. Tool results are returned to your authorized AI client and may contain provider data; the AI service’s own terms and settings govern its further use. We do not broadly mirror provider accounts, but selected activity records can include resource identifiers, actors, authorization mode, requests, configuration changes and bounded source-code changes. Secret redaction reduces exposure but cannot guarantee that arbitrary customer content contains no personal or sensitive information.

Organization visibility and invitations

Authorized organization administrators can see membership and activity within their permissions. If an administrator invites you, we receive your email and invitation details before you sign up. We use them to deliver and manage the invitation and prevent abuse. An organization subscription is paid by the organization, not by an invited member personally.

Recipients and locations

Cloudflare provides hosting and request processing; Supabase provides identity and database services; Stripe handles payments and related fraud/compliance processing; Resend delivers service emails. See Service Providers for details. Customer-selected providers and AI clients also receive authorized requests/results and may act under their own terms rather than as BEON subprocessors. We operate from the United States; processing may occur in the United States and other locations used by vendors. We may disclose information to authorized advisers or authorities where legally necessary, or for a corporate transaction subject to appropriate safeguards.

International safeguards

Before enabling a market or processing arrangement requiring specific transfer safeguards, we must establish an applicable lawful mechanism and any required representative arrangements. Availability of a vendor’s transfer terms alone does not establish coverage for every BEON transfer. Contact us for applicable safeguards and copies where available. We do not claim universal international certification or that all data stays in your country.

Retention and deletion

Credentials are retained while connected and removed locally on disconnection or deletion. Expired temporary OAuth, action-approval and verification payloads are eligible for cleanup after 24 hours. Our standard operational audit target is 365 days; unaccepted expired invitations are eligible for removal after 90 days. Contract/assent evidence is retained while the relationship is active and generally for 3 years after closure; completed privacy/support request records generally for 3 years after closure. A documented legal hold or legal recordkeeping duty can require longer restricted retention. Billing/tax records held by payment providers and infrastructure backups follow their applicable retention obligations and schedules. Deletion does not remove data already held by a provider or AI client. We explain exceptions in response to a verified request.

Your rights and choices

Depending on applicable law, you may request access, correction, deletion, restriction, portability, objection, withdrawal of consent or appeal of a rights decision, and complain to a competent privacy authority. Use Account privacy or email us; no paid subscription is required. We verify requests proportionately and respond within the applicable legal period, explaining lawful exceptions or extensions. Automated export is a summary, not a replacement for a complete access request. We do not make legally significant automated eligibility decisions about people as a stated purpose of this service.

Cookies and local storage

BEON uses necessary authentication, anti-forgery, verification and preference storage. Payment components may use security/fraud-related technologies described by their provider. BEON has not added advertising pixels or behavioral advertising analytics in this release. Any future non-exempt tracking requiring consent must remain disabled until valid consent is obtained. Browser settings can block storage but may prevent sign-in or payment.

Young users and changes

BEON PASS is not intended for children under 13 or anyone below the higher local minimum age described in our Terms. Eligible users who are under 18 or below local legal adulthood need parent or guardian agreement as described there. A Terms acceptance records an eligibility declaration; it is not independent age verification or verified parental consent. We do not offer a parental-consent exception for users below the applicable minimum age. Contact info@beonlimited.com if you believe an ineligible child has an account or has provided personal information, or if you are a parent or guardian seeking help. We will investigate, restrict ineligible use and delete information as required by applicable law. We verify authority proportionately before disclosing account information. We publish updated notices with version dates and notify users of material changes where required.

Updated October 6, 2026. Version 2026-10-13.1.