Privacy Policy

Last updated: September 15, 2026

Welcome to beeboLink. This Privacy Policy explains what information we collect, how we use it, and what rights you have over your data. We've written it in plain language — no legal jargon where we can help it.

Quick Summary

  • We collect your name, email, and password (or Google ID) when you sign up
  • We collect recipient names and emails only when you upload them to a campaign
  • We do not sell your data or use it for advertising
  • Paid subscriptions are processed by our payment provider, who handles all billing and payment data — we never see your card details
  • You can request access, correction, or deletion of your data at any time

1. Who We Are

beeboLink is an identity pre-validation link generation service that allows businesses to send unique, token-based links to recipients for identity verification — without requiring recipients to fill out a form.

2. What Information We Collect

When you create an account, we collect:

  • Name (first and last)
  • Email address
  • Password — stored as a one-way bcrypt hash. This means your actual password is never stored anywhere, and no one — including us — can read it.
  • Google account ID and profile information — if you choose to sign in with Google OAuth instead of email/password.

We also store session data (a server-side session cookie) to keep you logged in across browser visits. We also use your browser's local storage to remember your display preferences (such as list or card view), which stays on your device and is not sent to our servers.

When a customer uploads a recipient list, we store:

  • Recipient name
  • Recipient email address
  • A unique, randomly generated verification token tied to that recipient
  • Link activity data: whether the link has been clicked, the first click timestamp, the most recent click timestamp, and a total click count

We do not collect any other information about recipients. We never interact with recipients directly.

2.3 Payment and Billing Data

beeboLink uses a third-party payment provider as our Merchant of Record for all paid subscriptions. When you purchase a paid plan, our payment provider collects and processes your payment information — including credit card details, billing address, and transaction history — directly and under their own privacy policy. We do not receive or store your full card details. We only receive confirmation of your subscription status from our payment provider.

2.4 Usage and Technical Data

We may collect standard technical information to keep the service running, such as error logs and server diagnostics. We do not use third-party analytics tools or advertising trackers.

3. How We Use Your Information

We use the information we collect to:

  • Operate the service — create your account, generate campaigns, verify tokens, and display link activity to you
  • Authenticate your identity — via email/password login or Google OAuth
  • Send transactional emails — email verification on sign-up, and password reset emails when requested. We use a third-party email delivery provider to send these.
  • Manage your subscription — we receive subscription status updates from our payment provider to determine which plan features you have access to
  • Provide customer support — respond to your questions or issues
  • Ensure security — detect and prevent abuse, unauthorized access, or fraud

We do not sell your data to anyone. We do not use your data for advertising purposes.

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data on the following legal bases:

  • Contract performance — processing your name, email, and account data is necessary to provide the service you signed up for. This also covers the processing of your Google profile information when you choose to sign in with Google OAuth, as it is necessary to create and authenticate your account.
  • Legitimate interests — we process security and session data to protect the service and our users from fraud and unauthorized access
  • Legal obligation — we may retain certain data where required by applicable law

5. How We Share Your Information

We do not sell your data. We share your information only with third-party service providers who help us operate beeboLink, such as cloud hosting providers, email delivery services, and payment processors. These providers are only given access to the information necessary to perform their specific function, and are not permitted to use it for any other purpose.

Payment processing: Paid subscriptions are processed by our payment provider, who acts as the Merchant of Record for all transactions. As an independent data controller, our payment provider determines how your billing and payment information is used under their own privacy policy. We do not receive or store your card details.

We do not share your data with any other third parties.

6. Cookies and Local Storage

beeboLink uses a session cookie to keep you logged in after you authenticate. This cookie is stored in your browser and is required for the service to function.

We also use your browser's local storage to remember your display preferences (such as whether you prefer list or card view for campaigns). This data stays on your device and is not transmitted to our servers.

We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

7. Recipient Data and Customer Responsibility

beeboLink is a tool used by businesses (our customers) to manage their own recipient lists. We act as a data processor on behalf of our customers — meaning we store and process recipient data only as directed by the customer who uploaded it.

If you are a recipient and have questions about why your name and email were added to a beeboLink campaign, or wish to have your information removed, you should contact the business or organization that sent you the link. We will also honor direct requests from recipients — see the Your Rights section below.

beeboLink is not responsible for the lawfulness of the recipient data uploaded by customers, or for any consequences arising from a customer's failure to comply with applicable privacy or anti-spam laws in connection with their use of the service.

8. Data Retention

Active accounts

Account data, campaign data, and recipient data are retained for as long as your account is active. "Active" means you have a paid subscription, or you have logged in or had campaign link activity within the past 120 days.

Inactive free accounts

Free plan accounts that have had no activity — defined as no logins, no campaign creation, and no recipient link clicks — for 120 consecutive days are considered inactive and may become eligible for deletion.

  • Where reasonably possible, we will attempt to notify the registered email address before an inactive account is deleted.
  • If the account remains inactive after that notice, the account and its associated data — including campaigns and recipient lists — may be permanently deleted. Logging in restores active status and prevents deletion.

We are working toward fully automating this notice-and-deletion process. Until that automation is in place, review and cleanup of inactive accounts may be performed manually, and actual timing may vary from the periods described above.

Paid accounts (active subscription)

Accounts with an active paid subscription are not subject to inactivity-based deletion, regardless of activity level.

Paid accounts (after cancellation)

When a paid subscription is cancelled, your account is downgraded to the free plan at the end of the current billing cycle. From that point, the standard free plan inactivity policy described above applies.

Other retention periods

  • Email verification tokens expire after 24 hours
  • Password reset tokens expire after 1 hour
  • Session data is retained until you log out or the session expires (default 7 days)
  • Payment and billing data is retained by our payment provider according to their own data retention policies, which we do not control

Account deletion requests

You may request deletion of your account and all associated data at any time by contacting us. We will process the request within a reasonable timeframe. Residual data may remain in backups for up to 60 days after deletion.

9. Security

We take reasonable steps to protect your information:

  • Passwords are hashed with bcrypt — they are never stored in readable form
  • Sessions are stored server-side in our database, not as client-side tokens
  • All traffic is served over HTTPS
  • Our backend API is served behind a third-party security proxy

Infrastructure security

beeboLink's infrastructure is hosted on cloud providers that maintain SOC 2 Type II certification. All data is encrypted at rest, and all database connections are encrypted in transit using TLS.

Limitations and shared responsibility

No system is perfectly secure. beeboLink relies on third-party infrastructure and service providers. We are not responsible for security incidents, data loss, or service interruptions caused by failures at the infrastructure level that are outside of our control. beeboLink makes no guarantee of continuous availability or zero data loss.

If you believe your account has been compromised, please contact us immediately.

In the event we become aware of a security breach that is likely to affect your personal data, we will notify affected users as required by applicable law. For information on our liability limitations in connection with security incidents, please refer to our Terms of Service.

9A. Service Discontinuation

beeboLink is an independently operated service. While we intend to keep it running for the foreseeable future, we cannot guarantee that the service will continue indefinitely.

If we decide to shut down beeboLink, we will:

  1. Notify all registered account holders by email at least 30 days before the service is terminated
  2. Keep all data export features fully functional throughout the notice period, so you can download your campaign data and recipient lists before the service closes
  3. Close the service and begin deletion of all account, campaign, and recipient data once the notice period ends
  4. Permanently destroy any residual data remaining in backup systems within 60 days of the service closure date

Refunds upon discontinuation

If you are on a paid plan at the time of discontinuation, we will issue a pro-rated refund for any unused portion of your current billing cycle. Refunds will be processed through the original payment method via our payment provider.

We will make a reasonable effort to provide the full notice period, but in the event of circumstances outside our control — such as the failure of a critical third-party service provider — it may not always be possible to do so.

10. Your Rights

Depending on where you are located, you may have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Delete your data ("right to be forgotten")
  • Export your data in a portable format
  • Restrict how we process your data
  • Object to processing based on legitimate interests
  • Withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, contact us. We will respond within a reasonable timeframe (typically within 30 days).

If you are a recipient whose data was uploaded by a customer, you may also contact us to request removal of your name, email, and token data from our system.

For payment-related data held by our payment provider, please contact them directly via the billing portal or the contact information provided at the time of purchase.

11. Children's Privacy

beeboLink is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with their information, please contact us and we will delete it.

12. International Data Transfers

Our infrastructure providers are based primarily in the United States. If you are accessing beeboLink from outside the US, your data may be transferred to and processed in those countries. By using beeboLink, you acknowledge this. Where required by applicable law (such as GDPR), appropriate safeguards are in place for such transfers.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we'll update the "Last updated" date at the top of this page. For significant changes, we'll make a reasonable effort to notify you (e.g., via email or an in-app notice).

14. Contact Us

If you have any questions about this Privacy Policy, please contact us.

← Back to home