This text is written in plain language based on what has been established, and will be reviewed by a lawyer before the pilot starts. Changes may still follow. Anything not yet established is marked below.
Privacy policy (draft)
Last updated: 13 September 2026
Below you can read which data BEP processes, why, where it is stored and which services help with it. We only write down what has been established.
Who we are
BEP is the AI business platform for small businesses, available at getbep.com.
the legal entity behind BEP, its address, Chamber of Commerce number and the contact address for privacy questions.
When you request access
The request form asks for your email address and, if you like, what type of business you run. We only use this to contact you about the pilot. You will not be added to a newsletter.
Your request is stored in our database in Frankfurt (EU). The BEP team receives a notification that a request has come in; that notification contains none of your details.
how long we keep a request.
When you use BEP
Within BEP we process the data your business puts in or brings in through a connection: for example emails via Gmail, customers, orders and products via Shopify, and tasks, invoices and receipts. Data is kept separate per company.
BEP staff do not look at your business data unless your business switches on support access. That access is temporary, visible to your business and recorded.
the division of roles for the data of your customers and contacts (controller and processor) and the data processing agreement.
Where your data is stored
- The app runs on Vercel servers in Frankfurt (EU).
- The database is hosted by Supabase in Frankfurt (EU).
Services involved
- Anthropic, for the AI features. According to Anthropic's commercial terms (Commercial Terms, section B), Anthropic does not train on the data we send. Anthropic is based outside the EU; that transfer is covered by Standard Contractual Clauses (Data Processing Addendum, section I.1). After the agreement ends, Anthropic deletes customer data within 30 days (DPA, section H.1).
- OpenAI, only if your business connects its own OpenAI key. OpenAI's terms then apply; according to OpenAI, API data is not used for training unless you choose to share it.
- Google, for the Gmail connection if you switch it on, and for searching for businesses with the Lead-hunter (searches by type of business and area).
- Shopify, for the shop connection if you switch it on.
- Vercel Speed Insights, which measures how fast pages load. According to Vercel this is anonymous and not tied to a visitor or IP address.
Anthropic's list of subprocessors and the regions where Google and Shopify process the data.
What we do not do
- We do not use your data for advertising.
- We do not set tracking or advertising cookies.
Cookies
BEP only uses cookies that are needed for the site and the app to work:
- a session cookie, only when you log in; after at most 8 hours you log in again;
- lang: remembers your language choice on the website, for one year;
- bep_organization_id: remembers which organisation the subdomain you visit belongs to;
- shopify_oauth_state: short-lived, only while connecting Shopify.
Your rights
Under the GDPR you may access your data, have it corrected or deleted, object, restrict processing and take your data with you. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
the address where you can submit these requests.
Changes
This is a draft. When the text changes, we update the date at the top.