PRIVACY

1. Who We Are

BeMe Limited (“BeMe”, “we”, “us”) is a company registered in the Isle of Man, company number 138220C.

We comply with:
UK GDPR
EU GDPR
Isle of Man Data Protection Act 2018 and the Data Protection (Application of GDPR) Order 2018
California Consumer Privacy Act (CCPA), as amended by the CPRA, applied as the baseline for all U.S. users

Where multiple laws apply, we follow the strictest standard.

Contact: support@justbeme.ai

2. Scope of this Policy

This Privacy Policy applies to:
All visitors and users of BeMe websites, apps, and services (the “Service”)
All U.S. users, to whom we grant CPRA-level rights
Users worldwide
Data we process as Controller (your account and service data)
Data we process as Processor (data relating to your customers or contacts)

This Policy does not cover third-party services outside our control.

3. What We Collect

3.1 Account Data (Controller)

Name, email, authentication credentials
Subscription tier, renewal date, and billing status
Payment card details are handled exclusively by Stripe, Apple, or Google. BeMe never receives or stores payment information.

3.2 Service Data (Controller)

Messages, chats, and files you input
AI configuration, settings, and memory
Scheduling preferences, connected integrations
Diagnostics, logs, and usage data
Call audio, recordings, transcripts, and call metadata required for Service delivery

3.3 Customer/Contact Data (Processor)

When you use BeMe to manage your customers, we process under your instructions:
Names, phone numbers, email addresses
Booking information, job history
Notes or communication logs
Any data you choose to store in BeMe about your customers

You remain the Controller for this data. BeMe acts solely as your Processor.

3.4 Technical & Device Data

Device model, operating system, app version
Browser type and version
IP address and location metadata
Crash logs and performance metrics

3.5 Support Communications

Emails and conversations with support
Problem descriptions and attachments
Diagnostic logs with your permission

3.6 Cookies & Analytics

Necessary cookies for authentication and session security
Functional cookies for settings and performance
Analytics cookies to improve the Service

We do not use cross-site advertising trackers.

3.7 Voice & Media Processing

If you use BeMe for calls or voice interactions, we process:
Audio for speech-to-text
Text for text-to-speech
Call recordings
Transcripts
Metadata about call performance

We do not use audio for biometric identification.
We do not sell or share audio.
We do not provide audio or transcripts to external AI training systems.

Call recordings and transcripts are stored securely and accessed only when necessary to provide the Service, troubleshoot issues, or respond to support requests.

We may use aggregated, anonymized system performance metrics, excluding call content, to improve Service reliability and diagnostics.

4. Lawful Bases for Processing

We process data under:
Contractual necessity to deliver the Service
Legitimate interests in improving reliability, preventing abuse, and securing the Service
Legal obligations
Consent where legally required, such as marketing communications

5. Our “On/Off” Retention Model

BeMe retains your data only while your account is active.

When your subscription ends:
Your account terminates at the end of the billing period
Your Service data, including audio and transcripts, is deleted
Minimal security logs may be retained for up to 90 days
Legal and financial records, such as invoices, are retained for up to 6 years as required by UK tax regulations and accounting standards
Backups purge automatically between 30 and 90 days
Aggregated or anonymised analytics may be kept indefinitely

You may export your data at any time before cancellation.

6. Controller vs Processor

BeMe as Controller

We act as Controller for:
Your account data
Service data including settings, logs, and preferences
Technical and analytics data

BeMe as Processor

We act as Processor for:
Your customers’ or contacts’ data
Only on your instructions
Under our Data Processing Addendum available at www.justbeme.ai/dpa

We never use your customers’ data for our own purposes.

7. International Transfers

7.1 Region-Based Storage

BeMe provisions data storage in the geographic region associated with your account location.
When you create an account, your data is stored on AWS servers in your region and remains there.

We do not transfer your data outside your region except:
Where required to provide support or diagnostics
To sub-processors delivering specific service functions
To comply with legal obligations

All cross-border transfers use appropriate safeguards.

7.2 Transfer Safeguards

Where cross-border transfers occur, we rely on:
Adequacy decisions
Standard Contractual Clauses
UK Addendum
Additional safeguards and risk assessments

8. Suppliers & Sub-Processors

We use trusted third-party providers to deliver the Service.
A full list of current vendors can be provided upon request in writing.

All sub-processors operate under data protection agreements compliant with GDPR and UK GDPR standards.

Our sub-processors fall into these categories:
Cloud hosting and storage
Telephony, SMS and messaging
AI processing, speech-to-text and text-to-speech
Email delivery
Payment processing (Stripe, Apple and Google)

We reserve the right to change vendors at any time.

9. Security

Current Controls

Encryption in transit using TLS 1.2 or higher
Secrets managed securely
Authentication via one-time passwords
Webhook signature validation
Logging and audit trails

We continuously enhance our security measures to protect your data.

Out of Scope

PCI DSS, as we do not process card data
HIPAA
Physical security, as the Service is fully cloud-hosted

10. Your Rights

Under GDPR, UK GDPR, and Isle of Man law, users have the right to:

Be informed about how we use their personal data, which is the purpose of this Policy
Access their personal data and receive a copy of it
Have inaccurate or incomplete personal data corrected
Have their personal data erased
Restrict how we use their personal data
Receive their personal data in a structured, commonly used and machine-readable format, and have it transmitted to another organisation (data portability)
Object to processing based on our legitimate interests, and object to direct marketing at any time
Withdraw consent at any time where we rely on consent. This does not affect processing carried out before consent was withdrawn
Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects

Some of these rights are subject to conditions and exemptions. If we cannot fully meet a request, we will explain why.

10.1 U.S. Users

We grant all U.S. users the rights provided by the CCPA, as amended by the CPRA:

The right to know what personal information we collect, use and disclose, including the categories of personal information, the categories of sources, our purposes, the categories of third parties we disclose it to, and the specific pieces of personal information we hold about you
The right to delete personal information we have collected from you, subject to certain exceptions
The right to correct inaccurate personal information
The right to opt out of the sale or sharing of personal information
The right not to receive discriminatory treatment for exercising any of these rights

We do not sell or share personal information, as those terms are defined in the CCPA, and we have not done so in the past 12 months. We do not sell or share the personal information of consumers under 16. We treat Global Privacy Control (GPC) browser signals as a valid request to opt out of sale or sharing.

We use sensitive personal information, such as account log-in credentials and the contents of the calls and messages you ask BeMe to handle, only to provide the Service and for the other purposes permitted by section 7027(m) of the CCPA regulations. We do not use it to infer characteristics about you, so the right to limit the use of sensitive personal information does not apply.

10.2 How to Exercise Your Rights

Email support@justbeme.ai with “Privacy request” in the subject line, ideally from the email address linked to your account. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.

We will verify your identity before acting on a request, usually by confirming details that match your account. You may use an authorised agent to make a request on your behalf. We may ask the agent for signed permission from you and may ask you to verify your identity directly.

We will respond within one month of receiving your request. Where a request is complex, or we receive a number of requests, we may extend this by up to two further months and will tell you why. For U.S. users, we will confirm receipt within 10 business days and respond within 45 days, which we may extend once by up to a further 45 days with notice.

If we decline a request, you may appeal by replying to our decision. We will respond to your appeal within 45 days.

10.3 Customers and Contacts of BeMe Users

If you contacted a business that uses BeMe, we process your data on that business’s behalf, as described in section 6. Please send your request to that business. If you contact us, we will pass your request to them and help them respond.

10.4 Complaints

If you have concerns about how we handle your personal data, please contact us first so we can try to resolve them.

You also have the right to complain to a data protection authority, including:
The Isle of Man Information Commissioner (inforights.im)
The UK Information Commissioner’s Office (ico.org.uk)
The data protection authority in the EU or EEA country where you live or work
For U.S. users, the California Privacy Protection Agency (cppa.ca.gov) or your state Attorney General

11. Automated Decision-Making

BeMe uses AI to carry out the tasks you set it, such as answering calls, replying to messages and managing bookings on your behalf. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

12. Information You Must Provide

To create an account and use the Service, you must provide your name, email address and login details. We need these to perform our contract with you, and we cannot provide the Service without them.
Connecting calendars, inboxes and messaging channels is optional, but some features will not work without them.

13. Additional Information for U.S. Users

In the past 12 months, we have collected the following categories of personal information, as described in section 3:

Identifiers, such as name, email address, phone number, IP address and device identifiers
Customer records and commercial information, such as subscription tier, renewal date and billing status. Payment card details are handled only by Stripe, Apple or Google
Internet and network activity, such as usage data, logs and diagnostics
Approximate location derived from IP address
Audio and electronic information, such as call audio, recordings and transcripts
Professional information, such as the business information you add to your profile
Sensitive personal information, namely account log-in credentials and the contents of communications you ask BeMe to handle

We collect personal information from you, from your devices, from the services you choose to connect, and from people who contact you through BeMe.

We use it for the purposes described in sections 3 and 4, and we disclose it for business purposes only to the categories of sub-processors listed in section 8 and to services you choose to connect. We keep it for the periods described in section 5.

14. Children

BeMe is intended for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

15. Changes to this Policy

We may update this Policy from time to time. We will update the “Last Updated” date at the top of this page and, where changes are material, we will tell you in advance by email or in the app.

16. Contact Us

BeMe Limited
Isle of Man
Company Number: 138220C
Email: support@justbeme.ai

For privacy requests, please include “Privacy request” in the subject line.