Privacy notice

Data and why it is used

• Website and inquiry data: name, work email, organization, inquiry type, workload type and message submitted through the contact form, to respond to the inquiry and manage the business relationship.
• Account data: account name and email, authentication credentials (stored as a password hash by the service), verification and session information, and organization/tenant associations, to create accounts, authenticate users and operate the service.
• Service telemetry: traces, spans, errors, performance attributes and related diagnostic information sent by customer systems, to provide observability and troubleshooting. Telemetry may contain personal information if customers include it in attributes, logs or stack traces.
• Security and operational data: events, request/route details, client IP address, user-agent and diagnostic records where generated, to protect, operate and troubleshoot the service.
• Billing data: billing contact and organization details, invoice/order records and payment-related metadata handled by the application. The payment processor and exact payment data handled must be confirmed.
• Support and AI features: prompts and diagnostic context submitted to an enabled AI feature may be processed by the configured Cloudflare Workers AI or Ollama integration. Deployment configuration determines which provider is used; provider-specific retention, location and training terms need to be documented before launch.

Roles and legal bases

For account administration, website inquiries, service security and billing, TrustPort Identity LLC may determine purposes and means and act as a controller; the precise role depends on the processing. For customer-submitted telemetry, a customer may be the controller and Beacon may act as its processor, while Beacon may separately act as controller for limited service operations. These roles must be set out in the customer contract. The applicable lawful basis for each controller activity has not been established in the material reviewed and must be confirmed for the countries in which the service is offered.

Recipients and international processing

Application integrations indicate use of infrastructure/storage services, transactional SMTP email, and optional AI providers (Cloudflare Workers AI or Ollama). Exact legal entity names, subprocessors, data locations, transfer mechanisms and whether Ollama is self-hosted must be confirmed from production configuration. Do not assume all data stays in the UK based only on a product-region label. A current subprocessor list and transfer information should be linked here.

Retention

Product materials advertise plan-based telemetry retention, including seven days for Starter, 30 days for Growth and 90 days for certain Sovereign offerings. The active production plan configuration, deletion behavior, backups, account records, inquiry data, billing records, audit/security logs and AI-provider retention periods were not verified. Confirm and publish a retention schedule covering these categories and deletion from backups.

Your rights and requests

Depending on applicable law and the role of each party, individuals may have rights to access, correct, delete, restrict or object to processing, portability, and to complain to a supervisory authority. If Beacon processes telemetry for your organization, contact that organization first; Beacon will support the controller as required by the customer agreement. For other requests, use the contact page and state that it is a privacy request. The responsible privacy contact and response process need confirmation.

Security and children

Beacon uses authentication, access controls and security/operational monitoring described by the product. This notice does not certify a security standard or guarantee a particular outcome. The service is intended for organizational use; the company must confirm whether it is directed to children and document any applicable protections.

Applicable information

Privacy rules depend on where people are located, what the service does, and the parties’ roles. Relevant frameworks may include the EU General Data Protection Regulation (GDPR), the UK GDPR, and U.S. state privacy laws such as California’s CCPA, as amended, where their scope and thresholds apply. This list is illustrative and does not claim that any particular law applies or that the company is compliant. These links are informational, not legal advice.