Privacy policy

Last updated: 2 September 2026

This policy covers the personal data BeeSensible is responsible for: the data of website visitors, customers and users of our services. We follow the GDPR.

It does not cover the text you or your organisation process through the Application. Your organisation is responsible for that, with us as the processor; that is set out in the Data Processing Agreement (DPA).

#Article 1: Who are we?

BeeSensible is a service of Venturo Media B.V., Spijksedijk 1a, 6917 AD Spijk, the Netherlands. Chamber of Commerce 72127198, VAT NL858996492B01. For privacy questions, email trust@beesensible.eu.

#Article 2: What data do we process, and why?

What we collect depends on how you reach us. Below, for each situation, we set out what data we process, for what purpose, on what legal basis and how long we keep it.

#2.1 You visit our website

Data: technical data such as your IP address (anonymised), browser, operating system and the pages you view.

Purpose: keeping the website working and secure, and measuring visits. We measure visits without cookies.

Legal basis: legitimate interest.

Retention: technical logs for up to 30 days.

#2.2 You create an account (free or paid)

Data: your name, email address, language and time zone, the details of the account you sign in with (Google, Microsoft, Microsoft Entra ID or your organisation's identity provider), and technical details about your installation of the extension and the desktop app (version, last seen, whether the installation is managed by your organisation).

Purpose: creating and managing your account, giving you access and supporting you.

Legal basis: performance of the agreement.

Retention: as long as your account exists. If you delete it, your data is deleted within 30 days.

You sign in through our own login environment. You can use Google, Microsoft or Microsoft Entra ID, a sign-in link we email to you, or your organisation's identity provider. You can also sign in with a username and password; if you set your own password, we keep only a hash of it.

#2.3 Your organisation takes out a paid subscription

Data: company name, address, Chamber of Commerce number, the contact's name and email, and payment details (the payment details are held by our payment provider).

Purpose: managing the subscription, invoicing and keeping our accounts.

Legal basis: performance of the agreement and a legal obligation (our statutory record-keeping obligation under Dutch tax law).

Retention: invoice and payment data for 7 years, as the law requires. Account data for the contract term plus 7 years.

#2.4 You contact us or send feedback

Data: your name, email address and message.

Purpose: answering your question, helping you and improving the product. Your message arrives in our mailbox at Proton. If you use the contact form on the website, we also receive a notification with those details in our internal Slack channel.

Legal basis: performance of the agreement, your consent, or legitimate interest.

Retention: up to 2 years after the last contact, unless the law requires longer.

#2.5 You start a trial or sign up for updates

Data: your email address and your first name.

Purpose: getting you started with BeeSensible and keeping you up to date. If you start a trial, we put your email address on our list for product emails; if your organisation moves to a paid subscription or you delete your account, we take you off that list.

Legal basis: your consent. You can unsubscribe through the link in each email.

Retention: as long as you are subscribed.

#2.6 The Application processes text (with us as processor)

While you type in a supported web application, or in a supported desktop application if your organisation uses the desktop app, BeeSensible analyses the text for sensitive data. Where that happens depends on the mode set for your organisation:

• In our EU cloud. This is the default. The text goes to our own servers in the EU, is processed there in working memory and is discarded right away. We do not store it.
• On your own device (local). If that has been set up for your organisation, detection runs entirely on your device, through the desktop app, and the text does not leave your machine.

In both cases we never pass your text to a third-party AI service, and we never use it to train models.

What we do keep is a set of figures about the detection: the type of sensitive data, the level, the app or website, the detection engine used, the time, what you did with it (mask, replace, remove or nothing) and whether the message was sent anyway afterwards. Full prompts, emails or chats are not included, and neither is a user ID: the database has no column for it. If your organisation has switched on department insights, the server adds the user's department to the figures; the user's identity is not stored, and departments are shown only above a minimum group size. We keep these figures for up to 24 months, then delete them.

To avoid counting the same detection twice within an hour, those figures include a technical key. How that key is produced depends on the mode:

• Local: your device generates a random reference unrelated to the detected value. Only that random reference is sent. The value itself, and any cryptographic hash of it, never leaves your device.
• Cloud: because we already receive the text for detection, our servers compute the key as a cryptographic hash (SHA-256) of the type and the detected value. We store that hash alongside the detection figures, with the same retention period of up to 24 months. We do not store the value itself. For short, predictable values such as a national identification number, a hash like this can in theory be reversed, so we treat it as personal data rather than as anonymous data. If your organisation would rather avoid this altogether, local mode makes that possible.

When you anonymise a PDF, we process the document temporarily and keep only the number of items removed.

This processing has one purpose: spotting sensitive data in time and offering you a suggestion. We do not use it to monitor performance or assess people.

#2.7 Overview of AI tools (only if your organisation turns this on)

If your organisation enables the AI Governance module, the extension works out, on your own device, whether a page you visit is an AI tool. It does so from the page title, the meta description and whether a chat field is present; those signals stay on your device.

Data: the domain of the visited page plus a signal that it looks like an AI tool, totalled per organisation per day; the number of prompts sent per day for each tool and use-case category; and for every notice BeeSensible shows on an AI tool, the fact that it was shown and what happened next (alternative opened, or continued anyway). No user ID, no URL path, no page content and no stored prompt content. How often you personally use AI tools is summarised on your own device into a single category per month, such as "weekly"; the underlying daily data stays on your device.

In cloud mode, to sort a conversation into a use-case category such as "summarising", the first prompt goes to our own servers in the EU, where it is classified and immediately discarded; only the category is counted. In local mode the desktop app does that sorting on your own device.

Purpose: giving your organisation a picture of which AI tools are in use, so it can set policy on them. Not tracking individual employees.

Retention: for as long as the licence runs.

#Article 3: Which services do we use?

We use a small number of third-party services to run BeeSensible, each under a data processing agreement. We do not sell your data.

In the detection path:

In local mode no third-party service is involved in detection at all. The processing happens entirely on the device.

Supporting services:

Keycloak, the service you sign in through, runs in our own environment at Scaleway and is not a third party.

Three things go to Slack. First, internal alerts about how our service is running; these contain only counts and technical status. Second, a notification when a new organisation is created, with its name, email domain, number of seats and plan. Third, the messages you send us through our contact form, with the details you fill in there. The extension and the desktop app send nothing to Slack themselves, and no data about our customers' users ever goes there.

#Article 4: Does your data go outside the EU?

We process your data within the EU as much as we can. Detection and storage run in the EU.

A few services are based outside it. Paddle is in the United Kingdom and Proton is in Switzerland; both have an adequacy decision from the European Commission. Cloudflare (CDN and analytics), Google and Microsoft (sign-in) and Slack (feedback) are in the US; that transfer relies on the EU-US Data Privacy Framework or on the standard contractual clauses. GitHub only hosts our software images and processes no personal data.

#Article 5: How do we secure your data?

Traffic between your device and our servers, and between our servers and the detection environment, is encrypted with TLS. Our stored data is encrypted. Traffic between our own components runs inside an isolated cluster that cannot be reached from the internet; one internal connection, between our API and the service that redacts PDFs, has no additional encryption yet. That is on our list of improvements.

Only people who need access for their work get it, through role-based access control. Our hosting partners Scaleway and Hetzner hold ISO 27001 certification; BeeSensible itself does not. We carry out periodic security reviews.

Logs contain technical details of each request: the IP address, the method, the path including any parameters, the status and the duration. They contain no message content or typed text.

#Article 6: What are your rights?

You have the right to access, correct and delete your data, to restrict or object to its processing, to data portability, and to withdraw any consent you have given.

This does not apply to the text you type: we do not keep it, so there is no stored version to access or delete.

Send a request to trust@beesensible.eu. We respond within a month and may ask you to confirm your identity. If you are not satisfied, you can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

#Article 7: Automated decisions

BeeSensible makes no automated decisions that affect you. You get a highlight with a suggestion; you decide what to do.

#Article 8: Cookies

We use only functional cookies needed to run the site, plus the security cookies set by Cloudflare, our CDN. Our visitor statistics use no cookies and do not track you. We do not use tracking or marketing cookies, so there is no consent banner.

#Article 9: For organisations deploying BeeSensible

BeeSensible is not built to monitor employees. A product DPIA is available on request at trust@beesensible.eu; your own DPIA remains your responsibility.

#Article 10: Changes

We may update this policy. The date at the top shows when we last did. We will let you know about material changes.