Privacy

Alpha · last updated 7 November 2026

Beamling is a hosted answer engine with bring-your-own-key credentials. This notice explains what personal data the service processes, why, for how long, and how to exercise your rights (Articles 13 and 14 GDPR).

Controller

The controller is Davide Modolo. Write to privacy@beamling.app for any privacy question or request. No data protection officer has been appointed.

What we process, why, and on what basis

• Account data from Google: stable account identifier, verified email address, and any name or profile picture Google returns. Used to create and secure your account, and to email you essential service notices such as a notice that the service is closing. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Beamling sends no newsletters or marketing email.
• Acceptance record: the version of these documents you accepted and when. Used to prove acceptance. Legal basis: legal obligation and legitimate interests (Art. 6(1)(c) and (f)).
• Session data: a random session token in an HttpOnly cookie. Only its SHA-256 hash is stored on the server, with its creation and expiry time. Used to keep you signed in and to revoke access. Legal basis: contract and security.
• Content: conversations, messages and retrieved sources, encrypted at rest with a key specific to your workspace. Used to provide the answer service. Legal basis: contract.
• Credentials: your provider keys, encrypted with a managed key-management service, a keyed fingerprint, the last four characters, plan, budget settings and last validation time. Plaintext keys are never stored or returned to the browser. Legal basis: contract and security.
• Usage: token counts, model, recorded cost and latency per answer, and daily request counts per key. Legal basis: contract.
• Security metadata: your IP address, converted on arrival into a keyed hash, to rate-limit abuse of sign-in and answers. Legal basis: legitimate interests in keeping the service secure (Art. 6(1)(f)).
• Logs: structured request, error and security logs containing the request path, status, timing and a keyed hash of your account identifier. They exclude keys, session tokens, request bodies, questions and answers. Legal basis: legitimate interests in operating and securing the service.
• Product analytics, when enabled: metadata such as mode, search provider, model, token counts, estimated cost, latency and error codes, linked to a keyed hash of your account identifier. Questions, answers, titles, source content, keys, email addresses and IP addresses are never sent. Legal basis: legitimate interests in understanding how the service is used. You can opt out at any time in Settings → Account, which also deletes the analytics already linked to you.

A Google account and email address are required to use Beamling; without them we cannot create an account. Beamling makes no decisions about you based solely on automated processing, including profiling. Beamling is not intended for anyone under 18.

Your keys and provider traffic

When you ask a question, Beamling sends it, with the search query, retrieved snippets and your key, to the providers you chose: OpenRouter or DeepSeek for the model (OpenRouter may route the request to an upstream model provider), and Brave, Tavily, Exa or DeepSeek for search. These requests run under your own account with those providers, at your instruction, and those providers process the data under their own terms and privacy policies, linked on the data processors page. Some of them process data outside the European Union: DeepSeek, and some hosts OpenRouter can route to, are in China. Choosing such a provider is your decision; check its terms before you use it. Beamling does not send your IP address, email or account identifier to them, does not route your traffic through a shared provider account, and does not sell your data or use it to train models.

Cookies

Beamling uses two essential cookies: a session cookie and a short-lived sign-in transaction cookie. They do not require consent and are not used for analytics or advertising. See the cookie policy.

How long we keep data

• Conversations, with their messages and sources: 60 days after the last question in them, pinned or not. At most 100 per account; beyond that the least recently used, unpinned ones are deleted first.
• Account, credentials, settings and usage: until you delete them or your account.
• Inactive accounts: deleted with all their data after 24 months without a sign-in or session use.
• Accounts that never accept the terms: deleted after 7 days.
• Sessions: expire after 30 days without use and at most 90 days after sign-in, then are deleted.
• Hashed IP addresses and rate-limit counters: up to one hour.
• Logs: up to 30 days.
• Database backups and recovery history: up to 1 days. Content and keys in backups are encrypted.
• Analytics: until you opt out or delete your account.
• If the service closes: everything, on the closing date announced by email and in the interface at least 14 days in advance.

Deleting your account in Settings immediately and permanently deletes the account, sessions, settings, conversations, messages, sources, credentials, usage records and workspace encryption key, and starts deletion of the analytics linked to you. Deleted data then disappears from logs and backups as they expire.

Recipients and international transfers

The data processors page lists the processors that run Beamling for us and the providers you choose with your own keys, with where they process data. Hosting runs in Belgium and the database in Frankfurt, Germany. Some providers are based in, or process data in, the United States or other countries outside the European Economic Area. These transfers rely on the EU-US Data Privacy Framework for certified providers, or on the European Commission's standard contractual clauses (Art. 45 and 46 GDPR). Write to privacy@beamling.app for a copy of the relevant safeguards.

Your rights

You have the right to access your data, to rectify it, to have it erased, to restrict its processing, to data portability, and to object to processing based on legitimate interests (Articles 15 to 21 GDPR). You can exercise several of these yourself in Settings: download all your data as a JSON file, opt out of analytics, sign out everywhere and delete your account. For anything else, write to privacy@beamling.app; we answer within one month. You can also complain to the Garante per la protezione dei dati personali (garanteprivacy.it) or to the supervisory authority where you live or work.

Changes

When this notice changes materially, Beamling shows the new version and asks you to accept it before you continue. The date at the top of the page shows the current version.