1. Who is responsible for the data
Beyonder SI (“Beyonder”, “we”, “us”) is the controller of the personal data described in this Policy.
- Email for personal data enquiries: info@beyonder.si.
- Websites: https://beyonder.si/ with all of its pages, and other Beyonder websites and services that expressly refer to this Policy, including the Beyonder platform at app.beyonder.si.
Requests concerning access, rectification or deletion of data and withdrawal of consent may be sent to the email above.
2. Scope of the Policy
This Policy covers visits to the website, emails we exchange with you, use of the Beyonder platform, subscriptions and payments, support, and data we collected earlier through the early-access questionnaire.
It applies to individuals, including representatives of customers and partners. Information about a company is also treated as personal data where it makes it possible to identify a particular individual.
When customers use Beyonder to run their own apps, the data their apps hold about their staff, clients and other people is processed on the customer’s instructions. The customer decides the purposes of that processing and is responsible for informing those people. Our role and obligations for that data are set out in the Terms of Service and, where agreed, a separate data processing agreement. This Policy does not replace the customer’s own privacy notice and does not allow us to use the customer’s app data for our own purposes.
We process personal data in line with applicable data protection law, including the EU General Data Protection Regulation (GDPR) where it applies. This Policy does not limit the rights you have under that law.
3. Data we use
Early-access applications: your email address; your answers to the questionnaire (what you want to build, your role, team size, the apps you want to start with, the tools you use today, your website if you add it, whether a short call is fine and how you heard about us); the description you typed on the website and the template you picked, if any; the page you came from, the referring website and campaign (UTM) parameters; your time zone and browser language; and how long the questionnaire took.
Account and platform use: your email address and name, your workspace and team members, the descriptions and change requests you send, files you upload, and the content of the apps you run on Beyonder.
Subscriptions and payments: your plan, billing contact, invoices and payment status. Card payments are handled by Stripe; we do not receive or store full card numbers or security codes.
Communications: emails and messages you send us, files you attach, and support history.
Technical information: IP address, request time, requested page, browser and device type, technical errors and security logs, to the extent actually processed by the website, the platform and their infrastructure. The website loads fonts from Google Fonts, so your IP address is sent to Google when the fonts are requested.
Consents and withdrawals: what you agreed to, when and how, and information needed to honour a withdrawal or an unsubscribe request.
Please do not send us identity documents, national identification numbers, medical information, passwords, access keys or full payment card details unless that is required for a separately agreed task. By providing another person’s personal data, you confirm that you have a lawful basis for sharing it with us.
4. Sources of data
We receive data directly from you, from your organisation or an authorised representative, from the providers listed in section 9 (for example, payment status from Stripe), and through operation of the website and platform infrastructure.
We do not use purchased contact lists or contact lists collected without an appropriate legal basis.
5. Purposes and legal bases
| Purpose | Data used | Legal basis |
|---|---|---|
| Review an early-access application and invite you | Email, questionnaire answers, description, source page and campaign parameters | Steps taken at your request before providing the service; legitimate interest in deciding the order of invitations |
| Provide the platform, build and run your apps | Account data, descriptions, uploaded files, app content | Contract |
| Take payments and keep billing records | Plan, billing contact, invoices, payment status | Contract; legal obligations on accounting and tax |
| Answer questions and provide support | Contact details and the content of your message | Contract or steps at your request; legitimate interest in answering business enquiries |
| Keep the website and platform secure and working | Minimal technical logs | Legitimate interest in preventing abuse and protecting the service |
| Understand which pages and campaigns bring applications | Source page and campaign parameters submitted with an application | Legitimate interest in measuring the effectiveness of the website |
| Send news about Beyonder | Email and consent record | Separate voluntary consent |
| Keep mandatory records and protect our rights | Necessary contract, billing and log records | Legal obligations; legitimate interest in establishing or defending claims |
We do not combine all purposes into unconditional permission for any use. If a new purpose requires new consent, we ask for it before that processing begins. Visiting the website and remaining silent do not count as consent to marketing.
6. Voluntary provision and your choices
You can browse the website without giving us any personal data. To apply for early access we need your email address; the other questionnaire answers help us prioritise invitations. To use the platform we need the data required to run your account and your subscription.
Declining news emails does not stop you from applying, getting access or using a paid plan. Consents for different optional purposes are requested separately; boxes are never pre-ticked.
You may withdraw consent by writing to the email in section 1 or using the unsubscribe link in a message. Withdrawal does not affect processing carried out before it. If certain information must be kept by law or on another permitted basis, we will tell you what is kept and why.
7. Emails
We email you about your application, your access, your account and your subscription. These service emails are sent through Resend from a beyonder.si address. Applying for early access does not subscribe you to marketing. We send news only with your separate consent, and you can stop it at any time.
Requests to stop communications are honoured however they reach us, including by email to the address in section 1.
8. Automated assessment and AI
When you submit the early-access questionnaire, your answers are scored by fixed rules, without a language model, to decide the order in which we send invitations. The score is not a decision that produces legal effects for you; a member of our team can review it, and you can ask us to do so using the email in section 1.
On the platform, the descriptions and change requests you send, and the app content needed to fulfil them, are processed by AI models hosted on Microsoft Azure to build and change your apps. We do not use your descriptions, files or app content to train general-purpose models without a separate legal basis and your explicit agreement.
9. Recipients, storage and international transfers
Access to personal data is granted to our staff and contractors only to the extent necessary to review applications, provide and support the service, and operate infrastructure, accounting and security. Arrangements with them include confidentiality, protection and use of data only for agreed purposes.
We use the following providers:
- Convex: database for early-access applications and platform data;
- Resend: delivery of our emails;
- Stripe: payment processing and subscription billing;
- Microsoft Azure: hosting of the website and the platform, and the AI models the platform uses;
- Google: Google Fonts, font delivery on the website;
- Google: Google Analytics 4, to measure how the website is used (see sections 10 and 17);
- Meta Platforms: Meta Pixel and Conversions API, to measure the results of our advertising (see sections 10 and 17).
Some of these providers process data outside your country, including in the United States. Where the law requires it, we rely on an appropriate transfer mechanism, such as an adequacy decision or the European Commission’s standard contractual clauses, or another legally permitted basis. Connection of a new provider is reflected in a new version of this section.
Personal data may be disclosed to public authorities, courts and other persons where required by law or necessary to protect the rights and legitimate interests of Beyonder or third parties.
We do not sell personal data for money and do not share contact details with third parties for their own marketing. Advertising measurement with Meta (section 10) can count as “sharing” or a “sale” under some US state laws, so we offer the choice described in section 17.
10. Cookies and browser storage
The beyonder.si website uses the Meta Pixel to measure our advertising. It sets first-party cookies (_fbp, and _fbc when you arrive from a Meta ad) and sends Meta your page views, the fact that you sent a description or submitted the early-access questionnaire, and technical data such as your IP address and browser. When you submit the questionnaire, we also send Meta, through its Conversions API, your email address (hashed with SHA-256), IP address, browser details and the cookie identifiers. We never send the description you typed, your answers, your company name or your website. We keep the cookie identifiers, IP address and browser details with your application to match ad results. Use the choice in section 17 to limit this. The website stores your language and theme choice in your browser’s local storage so the website remembers them on your next visit. Questionnaire answers stay in the page until you submit them.
The website also uses Google Analytics 4 to understand how it is used. It sets first-party cookies (_ga and _ga_*) and sends Google your page views, the fact that you sent a description (only its length) or submitted the early-access questionnaire, and technical data such as your IP address, browser and approximate location. We never send Google your email address, the description you typed, your answers or your website. We store the Google Analytics client identifier with your application to connect it to these statistics. Google Analytics data is kept for 14 months. If you use the choice in section 17 or your browser sends the Global Privacy Control signal, advertising use of this data is switched off; basic analytics continues.
The platform uses the cookies and browser storage needed to keep you signed in, protect your account and remember your settings.
You can delete locally stored data through your browser settings. Some functions may then not work as expected.
11. Retention and deletion
We keep data no longer than necessary for the purpose it was collected for, subject to mandatory retention periods. Once the purpose has been achieved, the data is deleted or irreversibly anonymised.
- Early-access applications: while early access is running and you have not asked us to remove your application.
- Account and app data: for as long as your account is active, and for a limited period after it ends, as described in the Terms of Service.
- Billing records: for the period required by accounting and tax law.
- Security logs: only as long as needed to protect the service, except records kept for a particular incident.
- Marketing consent: until you withdraw it. A minimal record of the withdrawal is kept so that we can honour it.
Extended retention for a particular dispute or obligation is limited to the relevant data.
12. Security and confidentiality
We protect data in proportion to the risk, including access controls, encrypted transmission, account management, oversight of contractors, updates, backups and incident response. This Policy is not a statement of certification or absolute security.
If an incident occurs, we limit its consequences, determine the data affected and meet applicable duties to notify regulators and affected people.
13. Your rights and how to make a request
Subject to applicable law, you may obtain information about the processing of your data and a copy of it, have it corrected, request restriction or deletion where grounds exist, withdraw consent, object to processing based on legitimate interest and opt out of marketing. Any other rights you have under applicable law also remain available.
Email info@beyonder.si with the subject “Personal data — Beyonder”. Tell us the email address you used with us and what you would like us to do. Do not send a copy of an identity document unless we ask for it. To protect against unauthorised access, we may ask for minimal, proportionate evidence of identity or authority.
We answer requests without undue delay and within the periods set by applicable law. If we cannot fully meet a request because of mandatory retention or the rights of others, we explain why and what options you have.
You may also complain to the data protection authority in your country and apply to a court.
14. Children and external links
Beyonder is intended for business use and is not directed at children. If we receive a child’s data without an appropriate legal basis, contact us so that we can delete it.
Links to third-party websites and services lead to resources governed by their own rules. Read their notices before entering data.
15. Changes to the Policy
The current version is published at https://beyonder.si/privacy with the date of its last update. We tell users about material changes in an appropriate way. A change does not replace fresh consent where it is required and does not apply new purposes retrospectively.
16. How the website works today
As of the date of this version:
- Starting from the website (a description, a template or a plan) or signing in takes you to the Beyonder app at app.beyonder.si.
- Data from earlier early-access applications (email, answers, description, source page, campaign parameters, time zone and browser language) stays in our Convex database under the purposes and retention rules above.
- The beyonder.si website has no sign-in page of its own; you sign in in the app.
- The website uses the Meta Pixel and Meta Conversions API for advertising measurement and Google Analytics 4 for website analytics, and no other advertising or analytics cookies.
Changes to this arrangement are reflected in a new version of the Policy before they take effect.
17. Do Not Sell or Share My Personal Information
If you live in a US state with a privacy law such as California’s CCPA/CPRA, you can tell us not to sell or share your personal information for cross-context behavioural advertising. Doing so switches the Meta Pixel and Conversions API to Meta’s Limited Data Use mode on this browser, and turns off Google’s advertising features (ad personalization, advertising data sharing and Google signals) for Google Analytics. Basic analytics measurement continues.
We honor the Global Privacy Control (GPC) signal automatically. You can also use the button below, which stores your choice in this browser. You can also write to info@beyonder.si.