Privacy Policy

Beeive is operated by Yaltron Private Limited, registered at Pipalbot, Dillibazar, Kathmandu, Nepal. You can reach us at info@beeive.com.

Beeive is a social media scheduling and publishing tool. This policy explains what data we collect, why we collect it, how we protect it, and the choices you have. It covers the hosted service at beeive.com.

Account data

When you sign up we store your email address, name, and a bcrypt-hashed password (if you use email login). If you sign in with GitHub or Google, we store the account ID returned by that service. We also record your IP address and browser user-agent string at registration to prevent abuse.

Connected social accounts

When you connect a social channel (for example YouTube, TikTok, X, LinkedIn or Facebook) we store the OAuth access token and, where the platform provides one, a refresh token, together with basic profile details such as the account name, username and profile picture. We need the tokens to publish posts and load analytics on your behalf. These tokens are not currently encrypted at rest; they are protected by the measures described in section 5. You can disconnect any channel at any time, which removes our stored tokens.

Content and uploaded media

Posts you create (text, images and videos) are stored in our database and, for media files, in Cloudflare R2 object storage. Media files are kept until you delete them.

Inbox messages and comments

When you use the unified inbox, we receive and store the private messages your customers send to your connected WhatsApp, Instagram, Facebook Messenger, Telegram, Discord, Slack, Bluesky and Mastodon channels, and the replies you send: the message text, the sender's name, profile picture and platform identifier (for WhatsApp, their phone number), and references to photos, videos, voice messages and shared posts. When you use unified comments, we store the comments left on your posts: the comment text, the author's name and picture, and a link to the comment. We use this data only to show you these conversations and to send your replies.

Message text, contact names, pictures and identifiers (such as phone numbers), platform message identifiers, and the text and authors of comments are encrypted at rest with AES-256-GCM before they are stored, using a key kept separately from the database, so a copy of the database or a backup cannot be read on its own. Voice messages are stored in Cloudflare R2 so they keep playing; photos and videos are only copied there when you open them and are removed again after two days. Shared posts and reels are shown from the platform and are never stored.

Client brands and their designs

On plans with client brands, you can save a client's logo, colors, contact details, notes and up to 10 of their past designs. To make new images in the client's style, the past designs are sent once to OpenAI, which returns a written description of their style that we store with the brand. When you ask the AI agent for an image for that client, up to four of the past designs are sent to OpenAI with the request. The designs stay in your media library until you delete them.

Analytics

When you view analytics in Beeive, we fetch engagement data (for example views, likes, comments, shares and follower counts) live from each connected platform using your stored tokens. This data is cached for up to one hour and is not stored permanently in our database.

Billing records

We store subscription status, invoices, payment amounts, refunds and chargebacks, and payment provider references. We never store your full card number, CVV or bank account details. Payments are handled entirely by Dodo Payments, the Merchant of Record, through its secure checkout.

Contact form

If you use the contact form we store your name, email address, company (optional), the topic you chose, subject, message and IP address. For a refund request we also store the order number from your receipt email, the reason you chose, and our answer (approved or declined, when, by which team member, and any note we sent you). To check the request against our refund policy, we look up the Beeive account that uses the same email address and its subscription and payment history.

Technical and log data

We set cookies for authentication (a signed token containing your user ID and account details, valid for 365 days), organization selection, and a random tracking identifier. We use Sentry for error monitoring, which receives your user ID, email and organization ID when an error occurs.

When you visit our website we look up which country you are visiting from, using your IP address, so we can show you information that applies where you are, such as local events. The lookup runs on our own servers against a built-in list of IP ranges: your IP address is not sent to anyone else for this, and neither the address nor the country is stored.

While you write a new post, a copy of it is kept in your browser's local storage so it can be restored if the tab is closed. It stays on your device and is removed once the post is saved or discarded. Posts you save as drafts, including AI posts from the post generator, are stored with your other content until you delete them.

• Account data: to authenticate you and manage your account.
• OAuth tokens: to publish posts and load analytics for your connected channels on your behalf.
• Content and media: to store and schedule your posts for publishing.
• Inbox messages and comments: to show you your customers' messages and comments and send your replies.
• Client brand designs: to make new images in each client's own style when you ask for them.
• Analytics cache: to show you engagement metrics without re-fetching them on every page load.
• Billing records: to process payments and refunds and keep accounting records.
• Contact form data: to respond to your inquiry and to decide on and answer refund requests.
• IP address and user-agent: to prevent abuse and fraud at registration.
• Your country (from your IP address): to show you information that applies where you are, such as local events.
• Error logs (Sentry): to find and fix bugs.

• Connected social platforms (YouTube, TikTok, X, LinkedIn, Facebook, Instagram and others): your post content and media, sent through their APIs when we publish on your behalf, and your replies to messages and comments.
• OpenAI: if you use the AI copilot, the post text and prompts you write are sent to OpenAI's API to generate or improve content. OpenAI's API data usage policy applies. To prepare posts for the right channel, the copilot may also receive details of your connected channels, such as the channel name, username and picture, and settings data loaded from the platform. When you use client brands, the client's past designs are sent to OpenAI to describe their style and to make images in that style. Inbox messages and comments are not sent to OpenAI. OAuth tokens are never sent to OpenAI.
• Cloudflare: uploaded media files, Inbox voice messages and, for two days, the Inbox photos and videos you open are stored in Cloudflare R2.
• Resend: your email address is shared with Resend to deliver transactional emails (activation, password reset, notifications, and our replies to contact messages and refund requests).
• Dodo Payments: your email address, country and organization are shared with it when you start a card checkout. As Merchant of Record, it handles all card data, sales tax, invoices and refunds directly. When you ask us for a refund, we use your order details to find the payment and issue the refund through it.
• Sentry: user ID, email and organization ID are sent with error reports. If you use the AI copilot, your prompts and generated content may also be sent to Sentry for debugging.

We do not sell your personal data to anyone.

We use the following technical and organizational measures to protect your personal and sensitive data, including OAuth tokens and data received from connected platforms such as Google, YouTube and TikTok:

• Encryption in transit: all traffic between your browser, our servers and connected platforms (including the Google, YouTube and TikTok APIs) is encrypted using HTTPS/TLS.
• Password hashing: passwords are stored only as bcrypt hashes. We never store or have access to your plain-text password.
• Encrypted secrets: API keys and OAuth app secrets issued by Beeive are encrypted with AES-256 before they are stored.
• Encrypted messages and comments: Inbox message text, contact names, pictures and identifiers, platform message identifiers, and comment text and authors are encrypted with AES-256-GCM before they are stored. The key is kept outside the database, so a database copy or backup cannot be read without it.
• OAuth token protection: access and refresh tokens for connected channels are stored in our database, which is only reachable by Beeive's application servers and is not publicly accessible. Tokens are used only on our servers to call the platform's API on your behalf, and are never sold or shared with third parties.
• Account isolation: your content, connected channels and analytics belong to your organization and are only accessible to members of that organization.
• Restricted internal access: access to production systems and databases is limited to authorized Yaltron team members who need it to operate and support the service.
• Payment data: card details are handled entirely by our payment provider. We never store card numbers or CVV codes.
• Revocation and deletion: you can disconnect a channel at any time, which removes our stored tokens, and you can delete your account from Settings > Account. You can also revoke Beeive's access directly from each platform, as described in sections 6 and 7.
• Incident response: if we become aware of a security breach affecting your personal data, we will notify affected users without undue delay.

When you sign in with Google or connect a YouTube channel, Beeive accesses the following data from Google, only with your consent:

• Email address and basic profile (userinfo.email, userinfo.profile): to identify the Google account you signed in with or connected.
• YouTube channel details (youtube.readonly): to show the name and picture of your connected channel.
• Video uploads (youtube.upload): to upload videos you create in Beeive to your YouTube channel.
• YouTube Analytics (yt-analytics.readonly): to show your channel and video analytics in your Beeive dashboard.

We use Google user data only to provide these features to you. We do not sell Google user data, do not use it for advertising, do not use it to train AI or machine learning models, and do not share it with third parties except with Google itself when publishing on your behalf, with OpenAI when you choose to use the AI copilot (the channel details needed to prepare your post, as described in section 4), or when required by law. Google user data is protected by the measures described in section 5. Analytics data is cached for at most one hour, and tokens are removed when you disconnect the channel or delete your account.

Beeive's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Beeive uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. You can revoke Beeive's access to your Google account at any time at myaccount.google.com/permissions.

When you connect a TikTok account, Beeive accesses the following data from TikTok, only with your consent:

• Basic profile (user.info.basic): your open ID, avatar and display name, to identify the connected account and show it in Beeive.
• Profile details (user.info.profile): your username, to show which account is connected and to link to your TikTok profile and videos.
• Account statistics (user.info.stats): your follower, following, likes and video counts, to show them in your Beeive analytics.
• Video list (video.list): your videos and their views, likes, comments and shares, to show video analytics and let you link a Beeive post to its TikTok video.
• Direct posting (video.publish): to publish videos and photos you create in Beeive to your TikTok profile, using the privacy and interaction settings you choose before posting.
• Draft uploads (video.upload): to send content to your TikTok inbox as a draft, so you can edit and publish it in the TikTok app.

We use TikTok user data only to provide these features to you. We do not sell TikTok user data, do not use it for advertising, do not use it to train AI or machine learning models, and do not share it with third parties except with TikTok itself when publishing on your behalf, with OpenAI when you choose to use the AI copilot (the channel details needed to prepare your post, as described in section 4), or when required by law. Content is only posted to TikTok when you choose to publish it. TikTok user data is protected by the measures described in section 5. Analytics data is cached for at most one hour, and tokens are removed when you disconnect the account or delete your Beeive account.

Your use of TikTok is also governed by the TikTok Terms of Service and the TikTok Privacy Policy. You can revoke Beeive's access at any time in the TikTok app under Settings and privacy > Security > Manage app permissions, or by disconnecting the account in Beeive.

When you choose “Edit in Canva” and connect your Canva account, Beeive accesses the following, only with your consent:

• Assets (asset:read, asset:write): to upload the image you chose from Beeive into your Canva account, and to check that the upload has finished.
• Designs (design:content:read, design:content:write): to create a design from that image, and to export the finished design when you click “Return to Beeive”.
• Design details (design:meta:read): to identify the design you return from.

We store your Canva access and refresh tokens encrypted, and keep a short-lived reference to each design you open from Beeive so we can save it when you return. The exported design is saved to your Beeive media library like any other upload. We do not read your other Canva designs, uploads or profile, we do not sell Canva user data, do not use it for advertising and do not use it to train AI or machine learning models. Canva user data is protected by the measures described in section 5.

Your use of Canva is also governed by the Canva Terms of Use and the Canva Privacy Policy. You can disconnect Canva at any time on the Media page in Beeive, which removes our stored tokens, and you can also remove Beeive's access from your Canva account settings.

Yaltron is registered in Nepal. Our servers, Cloudflare, our payment provider, OpenAI, Resend and Sentry are located outside Nepal, mainly in the United States and Europe. By using Beeive, your data crosses international borders. We do not currently have Standard Contractual Clauses in place with all sub-processors.

• Active accounts: data is kept for as long as your account exists.
• Disconnected channels: when you disconnect a channel, we remove its stored tokens.
• Deleted accounts: when you delete your account, your personal data (name, email, bio, IP and user-agent) is scrubbed or hashed and your account is soft-deleted. OAuth tokens on connected channels are hashed. Post content, media files, billing records (invoices and payments) and organization names are kept. See our Data Deletion page for full details.
• Billing records: invoices, payment and refund records are kept for tax and accounting compliance.
• Inbox messages: kept for 12 months, then deleted automatically together with their voice messages. Copies of photos and videos you open are deleted after two days. When you disconnect or delete a channel, or delete your account, its messages, contacts and stored media are deleted right away.
• Comments: kept for up to 90 days (less for some platforms), then deleted automatically. When you disconnect or delete a channel, or delete your account, its comments are deleted right away.
• Analytics cache: cached analytics data expires automatically after one hour.

Depending on where you live, you may have the right to:

• Access: request a copy of the personal data we hold about you.
• Correction: ask us to correct inaccurate data.
• Deletion: delete your account from Settings > Account, or email us at info@beeive.com. See our Data Deletion page for what is and is not deleted.
• Export: request an export of your data by emailing us.
• Objection: object to processing based on legitimate interests.
• Restriction: ask us to limit how we process your data.

To use any of these rights, email info@beeive.com. We will respond within 30 days.

Beeive is not intended for anyone under the age of 16. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and notify you by email if we have your email address. Your continued use of Beeive after a change means you accept the updated policy.

Yaltron Private Limited
Pipalbot, Dillibazar, Kathmandu, Nepal
info@beeive.com