Privacy Policy

1. Data controller

The controller of the personal data collected through beemmvision.com and the Beemm Vision application is BEEMM, a SAS (société par actions simplifiée) under French law with a share capital of €1,000, registered with the Évry Trade and Companies Register (RCS) under number 989 030 879, whose registered office is at 34 route de Saclay, 91430 Vauhallan, France.

For any question relating to this policy or to exercise your rights: [email protected].

2. Data collected

• Account data: email address, display name, profile picture where provided, public handle where you activate a public profile, Firebase user identifier.
• Billing data: surname, first name, address, VAT number, transaction history. Card details are processed directly by Stripe and are never stored by us.
• Usage data: projects, boards, workflows, prompts, uploaded files, generated content, execution history and credit consumption.
• Chrome extension captures (when you use the official Beemm Vision browser extension): a static content script runs on ordinary http://*/* and https://*/* pages (excluding the Beemm app, localhost, Google Cloud / Firebase consoles and the Chrome Web Store) to observe locally whether visible images are eligible for a Prompt control (DOM geometry, MutationObserver / IntersectionObserver, pointer position). No image pixels, image URLs or page content leave your device on hover. After an explicit action (Prompt, context menu or crop) and confirmation to analyse, the selected image or screen region is sent to our analysis service. A short-lived temporary copy may be stored on our servers solely to run the vision analysis, then deleted. A local history of up to the last 20 analyses may remain on your device until you clear it. Credit ledger and security logs remain as described below.
• Technical data: IP address, session identifier, browser type, operating system, pages visited, error reports.
• Analytics data: your interactions with the service, associated with your account. Your email address and display name are attached to that data, so it is not anonymous: we can link an analytics event back to you, and so can our analytics processor.
• Masked session recordings: where you consent to analytics cookies, we may record a masked replay of your screen and interactions through PostHog. Input fields are masked, as are the areas of the interface we have explicitly marked for masking — which include the prompt fields. Masking relies on that explicit marking: a newly added screen is not masked until it is marked, and images displayed on screen are not masked. The bodies of network requests are not recorded. Recording is primarily triggered when an error occurs.
• Communications: the content of the emails you send us for support purposes.

3. Processing purposes

• Providing the service: account creation, access to the Studio, Scale and App features, and the official browser extension.
• Executing your requests on the AI models and storing the resulting content, including reverse-prompting analyses launched from the browser extension.
• Billing, subscription management and credit accounting.
• Security of the service: fraud detection, abuse prevention, enforcement of the Terms of Service.
• Moderation of content reported as illegal, and handling of notices.
• Audience measurement, product improvement and error debugging, including masked session replay, where you have consented to analytics cookies. This measurement is associated with your account and is therefore not anonymous.
• Transactional communications: confirmations, quota alerts, invoices, notices of changes to the contract.

We do not carry out any automated decision-making producing legal effects concerning you, within the meaning of article 22 of the GDPR.

4. Legal bases

• Performance of the contract (art. 6.1.b) — account creation, access to the service, execution of requests, billing, support.
• Legal obligation (art. 6.1.c) — retention of invoices and accounting records, handling of notices of illegal content, responses to requests from authorities.
• Legitimate interest (art. 6.1.f) — security of the service, prevention of abuse and fraud, improvement of the product. Our interest is balanced against your rights; you may object at any time.
• Consent (art. 6.1.a) — non-essential analytics cookies, session replay and any optional marketing communications. You may withdraw your consent at any time.

5. Prompts, uploaded files and generated content

The prompts you write, the files you upload, the images you capture through the official browser extension and the content you generate may contain personal data — for instance where you upload or capture a photograph of a person, or describe an identifiable individual. That content is transmitted to the provider of the model used for the request (for extension analysis, a vision language model routed through our gateways), for the sole purpose of executing your request.

The Terms of Service prohibit you from submitting special categories of data within the meaning of article 9 of the GDPR, and from using the service to identify or authenticate a person. Where you submit content depicting a person, you warrant that you have obtained that person's authorisation.

Our staff do not read your prompts as a matter of course. Authorised staff, bound by confidentiality, may access them on a limited basis where an incident, an error report or a suspected breach of the Terms of Service requires it.

6. Retention periods

7. Recipients and processors

We do not sell your data and do not share it for advertising purposes. We use the following processors:

The three gateways above are the entities that technically receive your content before it reaches the model itself. Which editor receives it then depends on the model you select at the time of generation.

The complete list of models made available, with the gateway used and the company editing each model, is published on the page Models and providers. That page carries the date on which it was last checked against the production model registry.

We may also transmit data to the competent authorities where the law requires it, in particular in response to a notice of illegal content.

8. Transfers outside the European Union

Your account, your files and your generated content are stored in the European Union, in France. The application logic that processes them, however, runs in the United States: every request passes through our Cloud Functions before reaching a model. Executing a generation then transfers the content concerned to the gateway — in the United States for FAL and OpenRouter — and to the editor of the model you select, which may be established in any third country. Several of the language models offered are edited by companies established in China (DeepSeek, Alibaba, Moonshot AI, Z.ai, MiniMax); selecting one of them means transferring your prompt there. The Models and providers page lets you check, before choosing a model, which company will receive your content.

Those transfers are governed by the Standard Contractual Clauses adopted by the European Commission, supplemented by technical and organisational measures (encryption in transit, minimisation of the data transmitted, pseudonymisation where possible). Where the recipient is certified under the EU–US Data Privacy Framework, that framework applies in addition.

You may obtain a copy of the guarantees in place by writing to [email protected].

9. Training of artificial intelligence models

Beemm does not train any model on your content and does not transfer your content to any third party for that purpose.

Your prompts and your files are, however, transmitted to the provider of the model you select, so that your request can be executed. The way each provider uses the content it receives is governed by that provider's own terms, over which we have no control. We select our gateways and configure our integrations so as to request, wherever the provider offers the option, that content transmitted not be used for training purposes. We cannot warrant that every provider abstains from doing so.

Where this point is decisive for you, contact us before using a given model: [email protected].

10. Your rights

Under the GDPR you have the following rights:

• Access — obtain confirmation that your data is processed and receive a copy of it.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request the deletion of your data; you may close your account at any time from your settings.
• Portability — retrieve your data in a structured, commonly used and machine-readable format. Generated files can be downloaded from the interface, workflows exported in a portable format and batch results downloaded as an archive; for a complete copy of your account, write to us and we provide it free of charge within one month.
• Objection — object to processing based on our legitimate interest.
• Restriction — request that a contested processing be frozen.
• Withdrawal of consent at any time, for the processing that depends on it.
• Post-mortem directives — define instructions on the fate of your data after your death.

Requests are to be addressed to [email protected]. We reply within one month, a period that may be extended by two months where the request is complex. If you consider that your rights are not respected, you may lodge a complaint with the CNIL.

11. Minors

The service is intended for persons aged eighteen (18) or over, under the conditions of article 3 of the Terms of Service. We do not knowingly collect data relating to a person aged under fifteen (15). Where such collection is brought to our attention, the account is closed and the data deleted.

12. Cookies

Our use of cookies and trackers is detailed in the Cookie Policy.

13. Security and data breaches

We implement appropriate technical and organisational measures: encryption in transit (TLS 1.3), encryption at rest, access control based on roles, isolation of environments, protection against automated abuse, and logging of administrative access.

In the event of a personal data breach, we notify the CNIL within 72 hours of becoming aware of it, in accordance with article 33 of the GDPR, and we inform the persons concerned without undue delay where the breach is likely to result in a high risk to their rights and freedoms, in accordance with article 34. Where we act as processor on behalf of a professional customer, we notify that customer without undue delay.

14. Changes

This policy may be amended to reflect changes to the service, to our processors or to the applicable law. The version and the date of entry into force are shown at the top of the page, and a substantial change is published there before it takes effect.

15. Contact

Beemm has not designated a data protection officer, not being subject to that obligation. Data protection matters are handled by the company's legal representative.

• Email: [email protected]
• Mail: BEEMM, 34 route de Saclay, 91430 Vauhallan, France — marked “Data protection”.