Privacy Policy

Account data. When you sign up we collect your email address and password (stored as a hash, never in plain text), or your Google account identifier if you sign in with Google.

Business data.To build a site we fetch publicly available information about a business — for example its Instagram profile, Google Maps listing, or existing website: business name, address, opening hours, photos, menus, reviews, and contact details. Usually you point us at these sources yourself. Sometimes we prepare a private, unlisted preview for a business from its public profiles before being asked, so the owner can see what their site could look like; see “Previews we build proactively” below.

Review authors.Public customer reviews shown on a site are displayed anonymously — without the reviewer’s name or photo. Review text is the only thing we reuse.

Billing data. Payments are processed by Stripe. We never see or store your full card number. We keep records of your plan, invoices, and credit balance. Stripe collects your billing address and (optionally) VAT number to calculate tax — see Stripe’s privacy policy.

Interest forms.Some pages (for example our “for agencies” page) let you register interest in a feature we haven’t built yet. If you leave your email there, we store it solely to measure demand and, at most, to tell you once if that feature launches. We never use these addresses for marketing, and we record your IP address only as an anonymised hash to prevent abuse.

Visitor statistics (cookieless). For published sites we count page views, clicks, and QR-code scans using our own analytics built into the page. Per visit we record only: the event, the country (from the network, not GPS), the device type (phone/desktop), and the website the visitor came from. We do notstore the visitor’s IP address and we do not set any analytics cookies.

Product analytics on beopages.com.On our own website and dashboard (never on the sites we host for customers) we use PostHog, an analytics service, to understand how the product is used — pages viewed and buttons clicked. It runs on EU servers with no session recordings. By default it is cookieless and stores nothing in your browser. If you press “Allow” on our consent banner, we store a random anonymous identifier in your browser so we can recognise it on a return visit; press “Decline” and nothing is ever stored. You can clear the identifier at any time by deleting the site data in your browser. See PostHog’s privacy policy.

Advertising measurement (only if you allow it).We advertise Beopages on Facebook, Instagram, Google and TikTok. If you tick “Advertising measurement” on our consent banner, we load the Meta Pixel, the Google Ads tag and the TikTok Pixel on beopages.com so those platforms can tell us which of their ads led to a signup, a site being built, or a payment. They set cookies in your browser and receive the pages you viewed and which of those three steps you reached. We do notsend them your email address, name or any other identifying detail (no “advanced matching” / “enhanced conversions”). If you do not tick that box, these tags are never loaded at all — not in a limited mode, not silently: the scripts do not run. You can change your mind any time via “Cookie settings” in the footer, which also deletes the cookies they set. See Meta’s privacy policy, Google’s and TikTok’s. These tags never run on the websites we host for customers.

Error reports. When something in the product breaks, technical details of the error are sent to Sentry so we can fix it. These reports are configured not to include personal data.

Enquiry form data. Websites we host include a contact form. Messages submitted by your visitors (name, contact details, message text) are delivered to you and stored so you can read them in your dashboard. For this data the site owner is the data controller and we act as their processor, under the data processing terms in our Terms of Service. For these form submissions — and for the “request my site” form on beopages.com — we also record the sender’s IP address and browser identifier, used only to block spam and abuse and erased after 90 days.

Domain registration. If your plan includes a free domain and you claim one, we register it through our registrar (Openprovider) using generic contact details plus your account email.

As part of reaching out to local businesses, we sometimes build a website preview for a business before its owner asks us to, using only information the business has already made public (its Google Maps listing, Instagram profile, or website). These previews are private and unlisted — they are reachable only through a personal link we send to the business owner, and they are never indexed by search engines or published.

We rely on our legitimate interest in offering our service to businesses (GDPR Art. 6(1)(f)) for this. If you are a business owner and want a preview of your business removed, reply to our email or write to hello@beopages.com — we delete the preview and all fetched data, and we will not rebuild one for your business. Declining the preview from the link we send does the same. If nobody claims a preview, it is deleted automatically after 90 days of inactivity on our side.

• To create, host, and let you edit your website.
• To process subscriptions and coin purchases, and send invoices.
• To send service emails: site-ready notifications, billing receipts, payment-failure warnings, and important account notices.
• To answer support requests.
• To detect abuse and keep the service secure.
• To improve the product using aggregated usage statistics.

We do not sell personal data, and we do not use your business content to advertise to third parties.

We use large-language-model providers (currently Anthropic Claude via Amazon Bedrock in the EU, and Google Gemini via Google Cloud) to generate and edit website content from the business data described above. The data sent to these providers is the public business information, the photos on your site, and the instructions you type in the editor — never your password or payment details. These providers process data on our behalf and do not use it to train their models under our agreements.

Our database and file storage run on Supabase in the European Union. Our hosting runs on Amazon Web Services (Ireland region) and Cloudflare. Email is sent and received via Amazon SES (Ireland region), with Resend as a backup provider. Error tracking runs on Sentry. Product analytics runs on PostHog (EU servers). Public profile data is fetched with the help of Apify (EU). Domains are registered through Openprovider. Where a provider processes data outside the EU/EEA, transfers are covered by the EU Standard Contractual Clauses or an adequacy decision.

• Account and site data: for as long as your account is active. If your subscription ends, your site goes offline and is permanently deleted after 30 days unless you come back.
• Unpublished drafts you create yourself are deleted 30 days after creation if you never publish them.
• Preview sites we build proactively (see section 2) are deleted automatically after 90 days of inactivity if nobody claims them — or immediately on request.
• If you delete your account, your sites, content, and personal data are deleted immediately; invoices and payment records are kept for 6 years as required by Irish tax law. To prevent abuse of the free site included with each account (delete, re-register, repeat), we also keep a minimal record that your email address was used for an account before, together with signup/deletion dates. This record is never used for marketing and is not shared with anyone; we rely on our legitimate interest in preventing abuse (Art. 6(1)(f)).
• Visitor enquiries live with the site they were sent to and are deleted with it. The IP address and browser identifier we record with each enquiry for spam protection are erased automatically after 90 days; the enquiry itself (name, contact, message) stays available to the site owner.
• Enquiries left on beopages.com itself (for example the “request my site” form) are deleted 24 months after they were handled.
• If a business tells us not to contact it again, we keep the minimum needed to honour that (business name and the contact route used) permanently — deleting it would make us forget the objection.
• Error logs are retained for up to 12 months.

Under the GDPR you can ask us to access, correct, export, restrict, or delete your personal data, and you can object to certain processing. You can delete your account (and everything in it) yourself from the dashboard settings, or email hello@beopages.com for anything else — we respond within 30 days. You also have the right to lodge a complaint with the Irish Data Protection Commission (dataprotection.ie).

Strictly necessary. The cookies that keep you signed in, remember your language, and store your answer to the consent banner. These are always on — without them the site cannot work.

Usage analytics (PostHog, EU). Runs without cookies by default and stores nothing in your browser. If you allow it, we store one anonymous identifier so we can recognise your browser on a return visit. Nothing is shared with advertisers.

Advertising measurement (off by default). Only if you tick it: the Meta Pixel (_fbp), the Google Ads tag (_gcl_*, _ga) and the TikTok Pixel (_ttp) so we can see which ad brought you here. Untick it in “Cookie settings” and we delete those cookies and stop sending events.

The customer sites we host set no cookies of our own. Our visitor statistics work without cookies and without storing IP addresses, the enquiry form uses an invisible anti-spam field rather than a tracking service, and no advertising tag of ours ever loads there. Fonts are served from our own servers, and the embedded Google Map loads only after the visitor taps “Show map” — until then the page makes no request to Google. If the visitor does open the map, Google’s privacy policy applies to that frame.

For account, hosting, billing and support we rely on performance of our contract with you. For security, abuse prevention, cookieless statistics and the previews we build from public business profiles we rely on our legitimate interests (GDPR Art. 6(1)(f)). For persistent analytics storage and for advertising measurement we rely on your consent(Art. 6(1)(a)), which you give or refuse on the banner and can withdraw at any time via “Cookie settings”. Tax and accounting records are kept to comply with a legal obligation.

If we make material changes to this policy we will notify you by email or a notice in the dashboard before they take effect. The “last updated” date at the top always reflects the current version.