Privacy Policy
Last updated: October 30, 2026
1. Who we are and what this policy covers
Beevvy is operated by Flor de Oro, sole proprietorship of Serge Freije, Riesenfeldstraße 14, 80809 München, Germany ("Beevvy", "we", "us"). We are the controller for the personal data described in this policy, except where section 9 explains that a business uses follower data for its own loyalty program. The complete legal notice is in our Impressum.
This policy covers:
- the Beevvy mobile apps (iOS and Android) and smartwatch apps
- the website beevvy.com and the web app app.beevvy.com
- the Beevvy MCP connector at mcp.beevvy.com, used from ChatGPT, Claude and other AI assistants (section 8)
- integrations you choose to connect, such as Shopify, Google Calendar, Microsoft Outlook Calendar and Notion
We have not appointed a data protection officer because we are not legally required to. For any privacy question, write to privacy@beevvy.com.
2. Data we collect
We collect the data below from you directly, from your use of Beevvy, and from services you choose to connect.
| Category | Examples | Source |
|---|
| Account | Name, email address, phone number, password (stored hashed), sign-in method (Apple, Google, email) | You |
| Age | Date of birth for creator, business and payout features, to confirm you are 18 or older | You |
| Profile | Handle, role (customer, entrepreneur, creator), city, bio, photo, business details, creator portfolio, plan tier, referral stats | You |
| Business data | Business name, category, website, and the Business DNA profile we generate from your public website | You, your public website |
| Activity | Follows, likes, posts, photos and tags of businesses, mission joins and submissions (photo, screenshot, text, form, QR scan, check-in), points earned and spent, rewards redeemed | Your use of Beevvy |
| Business content | Missions, rewards, voucher codes, announcements, campaigns, Smart Automation messages, follower tags | Businesses |
| Messages and notifications | Message threads, in-app and push notifications, announcement delivery and read status | Your use of Beevvy |
| Matching and events | Matching preferences, requests you post for matches, event attendance, collaboration requests | You |
| Location | Approximate or precise location, only with your permission, for nearby results, distance to businesses, check-in missions, events and event matching | Your device |
| Safety | Reports you make or receive, blocks, moderation decisions and complaints | You, other users, our moderation |
| Store data | Order count, order totals and order dates from a connected Shopify store, linked to Beevvy followers for revenue attribution | Connected store |
| Calendar data | See section 7 | Google Calendar, if connected |
| Payments | Subscription status, plan, invoices and payout details. Card details are handled by Apple, Google Play or Stripe and are never stored by us | App stores, Stripe |
| Technical | Device type, operating system, app version, IP address, push notification token, error logs, and in-app usage events recorded in our own backend | Your device |
| AI connector data | Tool requests and responses when you use Beevvy from an AI assistant | See section 8 |
3. Why we use your data (purposes and legal bases)
We use personal data only for the purposes below. Legal bases refer to Art. 6(1) of the EU General Data Protection Regulation (GDPR).
| Purpose | Data used | Legal basis |
|---|
| Run your account and the Service (missions, rewards, points, follows, messages) | Account, profile, activity, business content | Contract, Art. 6(1)(b) |
| AI matching between businesses, creators and customers | Profile, business data, matching preferences, location if allowed | Contract, Art. 6(1)(b) |
| Announcements, campaigns and Smart Automations sent by businesses you follow | Account, activity, follower tags and segments | Contract, Art. 6(1)(b); the business's legitimate interest (section 9) |
| Revenue attribution and loyalty analytics for businesses | Activity, store data | Legitimate interest, Art. 6(1)(f) |
| AI-assisted features (assistant, drafts, suggestions, Business DNA, screenshot checks), see 3.1 | The content you enter, business content, aggregated activity | Contract, Art. 6(1)(b); consent, Art. 6(1)(a), where the app asks for it |
| Personalised Explore, search and recommendations | Profile, city, location if allowed, follows, likes, saves, interests | Contract, Art. 6(1)(b); legitimate interest in relevant results, Art. 6(1)(f) |
| Content moderation, reports and complaints, see 3.2 | Content you post, reports, account history | Legal obligation under the Digital Services Act, Art. 6(1)(c); legitimate interest in a safe platform, Art. 6(1)(f) |
| Actions you ask an AI assistant to take through the connector | See section 8 | Contract, Art. 6(1)(b) |
| Security, fraud and abuse prevention (for example fake mission submissions) | Technical, activity | Legitimate interest, Art. 6(1)(f) |
| Website analytics (Google Analytics 4, Microsoft Clarity) | Technical, usage data on the website | Consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG |
| Product improvement from in-app usage events | Technical, activity | Legitimate interest, Art. 6(1)(f) |
| Marketing emails from Beevvy | Email address | Consent, Art. 6(1)(a) |
| Legal, tax and accounting duties | Payments, invoices | Legal obligation, Art. 6(1)(c) |
We do not sell personal data. We do not use your data, or data received through the AI connector, to train general-purpose AI models. You need to give us the data marked as required in the app to use the Service; everything else is optional.
3.1 AI features
When you use an AI feature, the text, images or data needed for that request are sent to an AI model, processed, and the result is returned to you. We access the models through our hosting provider Lovable (Lovable AI Gateway), which forwards requests to Google (Gemini models) and OpenAI. According to their API terms, these providers do not use data sent through their APIs to train their models. We send only what the feature needs and do not send passwords, payment details or Google Calendar data. You can switch off AI personalisation in the app settings; some AI features ask for your consent first.
AI results are suggestions. AI chat is labelled as AI in the app, and you decide whether to use a draft. Matching suggestions do not make decisions with legal or similarly significant effects on you.
3.2 Automated moderation and human review
To keep Beevvy safe, AI-based checks screen some new text and images for clearly prohibited content, such as sexual content, violence, hate, scams or child exploitation. A flagged upload can be blocked or removed automatically. Decisions on reports and on restricting accounts are taken or confirmed by a person. If you think an automated check removed your content by mistake, write to legal@beevvy.com and a person will review it. You can always ask for human review, give your point of view and contest a decision (Art. 22(3) GDPR; Terms, section 9).
4. Who receives your data
We share personal data only with the recipients below, and only as far as each one needs it. Service providers process data on our instructions under a data processing agreement (Art. 28 GDPR).
| Recipient | What they receive | Why |
|---|
| Supabase | Service data (database, file storage, authentication) | Hosting and database |
| Lovable, with Google (Gemini) and OpenAI as AI model providers | The content needed for an AI request (section 3.1) and website and web app traffic | Web hosting and AI features |
| Google Cloud (Frankfurt region) | Mission, store and attribution data | Backend services |
| Twilio | Phone number, verification codes | Phone verification |
| Google Firebase Cloud Messaging, Apple Push Notification service | Push token and notification content | Push notifications |
| Meta (WhatsApp Business Platform) | Phone number and notification content, only if you turn on WhatsApp notifications | WhatsApp notifications |
| Cloudflare (Turnstile) | Technical data from your browser during sign-up | Protection against bots and fake accounts |
| Stripe | Name, email, plan, payment and payout details | Web payments, invoices, payouts |
| Resend | Email address, email content | Transactional and marketing email |
| Apple, Google Play | Subscription and purchase status | In-app payments and app distribution |
| Shopify | Store connection tokens; we receive order data from your store | Store integration you enable |
| Google Calendar, Microsoft Outlook Calendar, Notion, Calendly, SumUp, Eventbrite, Luma, Splitwise, Strava, Spotify, Instagram | Data you choose to sync or import | Integrations you enable |
| Komoot (Photon address search) | The address text you type when searching for a place | Address suggestions |
| Google Analytics 4, Microsoft Clarity | Website usage and device data, with your consent | Website analytics |
| AI assistants you connect (OpenAI ChatGPT, Anthropic Claude and others) | The tool responses you request | See section 8 |
| Businesses you follow or interact with | Your public profile, follow date, mission submissions, redemptions, points activity | So they can run missions and rewards (section 9) |
| Other Beevvy users | Your public profile, posts and tags | Community features |
| Authorities and professional advisers | Data required by law | Legal obligations and legal claims |
We never sell data and never share it with advertisers or data brokers.
5. International transfers
We store Service data in the EU where possible. Some providers (for example OpenAI, Anthropic, Twilio, Stripe, Meta, Cloudflare, Google and Microsoft) may process data in the United States or other countries outside the European Economic Area. In those cases we rely on the EU-U.S. Data Privacy Framework where the provider is certified, or on the EU Standard Contractual Clauses (Art. 46 GDPR). You can request a copy of these safeguards at privacy@beevvy.com.
When you use Beevvy from an AI assistant, the assistant's provider receives the tool responses under its own terms and may process them outside the European Economic Area.
6. How long we keep data
We keep personal data only as long as needed for the purposes in section 3.
| Data | Retention |
|---|
| Account and profile | Until you delete your account, then deleted within 30 days |
| Activity (missions, points, redemptions, follows) | For the life of the account. Aggregated statistics that no longer identify you may be kept longer |
| Messages and notifications | For the life of the account, or until deleted |
| Announcements and campaigns | 24 months after sending |
| Store order data from Shopify | 24 months, or until the business disconnects the store |
| OAuth tokens for the AI connector and integrations | Until you disconnect or revoke access. Unused refresh tokens expire after 90 days |
| AI connector request logs | 30 days (section 8.6) |
| Files created with the export tool | Generated on request and not stored by us after delivery |
| Security and server logs | 30 days |
| Reports, moderation decisions and complaints | Up to 12 months after the decision, longer if needed for legal claims or to deal with repeated abuse |
| Invoices and tax records | 10 years (§ 147 AO, § 257 HGB) |
| Marketing consent records | Until consent is withdrawn, plus 3 years as proof |
7. Google API data
Connecting Google Calendar is optional. If you choose to connect it, Beevvy may access Google Calendar event data only to provide Google Calendar features you request. Depending on the features you enable, this may include event titles, descriptions, dates and times, time zones, locations, conferencing links, event status, and other event metadata returned by the Google Calendar API.
We use Google Calendar data only for user-facing features you request, including synchronizing Beevvy events you create or attend, keeping event details and cancellations updated, importing relevant calendar events into Beevvy, scheduling and availability functionality, detecting travel or flight-related events when enabled, and adding confirmed meetups or accepted collaboration calls to your calendar.
Data sharing and disclosure
Google user data is never sold or rented and is not shared with third-party advertisers, data brokers, or external commercial partners for their independent purposes. Google user data is processed within Beevvy's secure infrastructure solely to provide the Google Calendar features requested by the user. We may use service providers acting on our behalf only where necessary to operate the requested feature, and may disclose information where the user directs or consents to the disclosure or where required by applicable law.
AI and machine-learning isolation
Google Workspace user data, including Google Calendar events and metadata, is not used to develop, train, retrain, fine-tune, or improve generalized or non-personalized artificial intelligence or machine-learning models. Beevvy does not transfer Google Workspace user data to third-party AI/ML providers for those purposes. Beevvy may use AI in other parts of the Service, but connecting Google Calendar does not grant those AI models access to Google Workspace data for model training or improvement. Google Calendar data is not available through the Beevvy AI connector described in section 8 and is never sent to ChatGPT, Claude or any other AI assistant.
Limited Use
Beevvy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Your control
You can disable applicable Calendar features or disconnect Google Calendar in Beevvy at any time. After disconnection, Beevvy stops future access under that authorization. You can also revoke Beevvy directly from your Google Account permissions.
8. Using Beevvy in ChatGPT, Claude and other AI assistants
Business owners can connect their Beevvy account to ChatGPT, Claude or another assistant that supports the Model Context Protocol (MCP), through the Beevvy connector at mcp.beevvy.com. This section describes exactly which data the connector receives (tool inputs), which data it returns (tool outputs), why, who receives it, how long we keep it, and how you control it.
8.1 How the connection works
You connect with OAuth 2.0: you sign in to Beevvy in your own browser and approve access there. Beevvy never sees your AI assistant password, and the assistant never receives your Beevvy password. The connector issues an access token tied to your account, which the assistant sends with each request.
The connector acts only as you. Every tool call is checked against your account, so it can only read and change data your account could read and change in the Beevvy app. It cannot reach other businesses' data or other members' private accounts.
When you ask the assistant to do something, it sends Beevvy a tool request containing:
- your access token, to identify your account
- the tool name and its parameters, for example date ranges, result limits, segment names (active, new, cooling, dormant, never redeemed, top spenders), tags, follower IDs, mission, reward, campaign or announcement IDs, and a follower name search term
- content you ask it to create, for example announcement titles and texts, A/B message variants, campaign steps, mission and reward details (title, description, points, discounts, voucher codes, images, deadlines, budgets), Smart Automation messages, links, and feedback notes to customers
The connector does not receive your conversation with the assistant, only the tool request the assistant sends.
| Tool group | Tools | Data returned | Personal data of others |
|---|
| Your account | whoami, get_my_profile, list_my_notifications, get_message_threads | Your name, email, handle, role, city, plan tier, referral stats, notifications, message threads (participants and messages) | Yes: people you message with |
| Followers and customers | list_followers, get_customer_profile, get_top_customers, get_follower_segments, get_follower_growth, get_cohort_comparison, get_activity_feed | Follower IDs, names (only for followers who share their identity), follow date, last activity, points earned and spent, completions, redemptions, tags, segment counts, new follows, daily growth | Yes: your followers |
| Missions | list_missions, get_mission, get_mission_performance, list_mission_completions, list_pending_completions | Mission details, participant counts, completion rates, who completed a mission, submission status and submitted proof (photo, screenshot, text or form) | Yes: participants |
| Rewards | list_rewards, get_reward, list_redemptions, get_redemption_status | Reward details, voucher codes, who redeemed what and when, redemption status | Yes: customers who redeemed |
| Announcements and campaigns | preview_announcement, list_campaigns, list_scheduled_sends, get_announcement_stats, get_campaign_performance | Audience size and a sample of recipients, campaign steps, delivery and read rates, A/B results | Yes: sample recipients |
| Smart Automations | list_smart_automations, get_smart_automation, get_automation_analytics, suggest_automation_strategy, draft_automation_message | Settings, templates, recent send logs, sent, blocked and clicked counts, AI-written drafts and suggestions | Yes: send logs |
| Revenue and store data | get_customer_lifetime_value, get_mission_roi, get_reward_roi, get_revenue_attribution, get_engagement_summary | Orders and revenue per follower from your connected Shopify store, attributed revenue per mission and reward, engagement totals | Yes: customers' order totals |
| Data export | export_data | Up to 5,000 records of followers, redemptions, completions, rewards, missions or announcements, as JSON or CSV | Yes |
Follower names are returned only when the follower chose to share their identity with the business. Followers' email addresses, phone numbers, passwords, precise locations and payment details are never returned by the connector.
8.4 Actions the connector can take (write actions)
These tools change data or contact people. They run only when you ask the assistant to, and the assistant is instructed to confirm the audience and message with you before anything is sent.
| Action | Tools | Effect |
|---|
| Message followers | send_announcement, schedule_announcement, create_campaign | Sends or queues push and in-app notifications to the followers you select. Sent announcements can be recalled within 15 minutes |
| Manage sends | recall_announcement, cancel_scheduled_send, pause_campaign | Stops or removes queued or recent messages |
| Missions | create_mission, update_mission, close_mission | Creates, edits, ends or deletes missions |
| Review submissions | review_mission_completions | Approves or rejects customer submissions, awards points and notifies the customer with your optional feedback |
| Rewards | create_reward, update_reward, bulk_upsert_rewards | Creates or edits rewards and voucher codes |
| Follower tags | tag_followers, untag_followers, upsert_follower_rule_tag | Adds or removes labels on followers, visible only to your business |
| Smart Automations | upsert_smart_automation, toggle_smart_automation | Changes or switches automated messages to followers |
8.5 Purposes
We process connector data only to carry out the request you made in the assistant: to show you your business data, analyse it, and take the actions in section 8.4. The legal basis is performance of our contract with you (Art. 6(1)(b) GDPR). For follower data, see section 9. We do not use connector data for advertising, for profiling followers beyond the segments you see, or for training AI models.
8.6 Recipients and retention
- The AI assistant provider. Tool outputs are sent to the assistant you connected (for example OpenAI for ChatGPT, Anthropic for Claude) and shown in your conversation. From then on, that provider processes them under its own privacy policy and your settings there, including chat history and retention. See the OpenAI privacy policy and the Anthropic privacy policy.
- Our service providers (section 4) host the data the tools read and write.
- Followers receive the announcements, campaign messages, automation messages and review feedback you send.
- Request logs. We log each tool call (time, account, tool name, success or error, and parameters without message bodies) for security, abuse prevention and debugging, and delete these logs after 30 days. We do not keep a separate copy of tool outputs.
- Access tokens are kept until you disconnect. Unused refresh tokens expire after 90 days.
- Data created through tools (missions, rewards, announcements, tags) is kept like the same data created in the app (section 6).
8.7 Your controls
- Connect only if you want to. The connector is optional and off by default.
- Check before sending. Ask the assistant to run
preview_announcement first. Every announcement can be recalled for 15 minutes, and scheduled ones can be cancelled. - Disconnect at any time in the assistant's settings (in ChatGPT under Settings, Apps; in Claude under Settings, Connectors), or email support@beevvy.com and we revoke the access token within 2 working days. After that, the assistant can no longer reach your Beevvy data.
- Delete conversations that contain Beevvy data in the assistant's own settings. We cannot delete them for you.
- Request access, export or deletion of connector logs and all other Beevvy data under section 11.
Connecting Beevvy to an AI assistant does not change our commitment in section 4: we do not sell your personal information, and we do not share it with advertisers or data brokers.
9. Follower data seen by businesses
When you follow a business, join its missions or redeem its rewards, that business can see your activity with it: your public profile (your name only if you share your identity), follow date, points earned and spent with that business, missions completed and their submitted proof, rewards redeemed, the tags it gave you, and, if it connected a Shopify store, the order totals linked to your Beevvy account. A business can view this in the Beevvy app or through an AI assistant it connects (section 8), and can send you announcements and automated messages.
We use this data to run the platform, and the business uses it to run its loyalty program. The business is responsible for how it uses data it takes outside Beevvy, for example in an AI assistant or an export, and must use follower data only for its Beevvy loyalty program and in line with data protection law.
Your controls: unfollow a business to stop its messages and stop new activity being shared with it, mute notifications in the app settings, choose whether to share your identity with businesses, or ask us at privacy@beevvy.com to remove your data.
10. Cookies and analytics
Storing or reading information on your device is allowed only if it is strictly necessary for a service you asked for, or with your consent (§ 25 TDDDG). Analytics tools on our website load only after you click "Accept" in the cookie banner. If you click "Reject" or close the banner, they are not loaded.
| Tool | Provider | Purpose | Storage | Basis |
|---|
| Consent choice (beevvy_cookie_consent_v1) | Beevvy | Remembers your cookie choice | 1 year | Strictly necessary, § 25(2) TDDDG |
| Sign-in and security storage | Beevvy, Supabase | Keeps you signed in in the web app | Until you sign out | Strictly necessary, § 25(2) TDDDG |
| Google Analytics 4 (_ga, _ga_*) | Google Ireland Ltd. | Visitor statistics with shortened IP address; no advertising features | Cookies up to 2 years; data kept 14 months | Consent |
| Microsoft Clarity (_clck, _clsk and others) | Microsoft Ireland Operations Ltd. | Heatmaps and anonymised session recordings to improve the site; text you type is masked | Up to 1 year | Consent |
You can change or withdraw your choice at any time with "Cookie settings" at the bottom of every page. The mobile apps do not use third-party analytics or advertising SDKs. They record usage events in our own backend to keep the app working and improve it.
11. Your rights and controls
Under the GDPR you have the right to:
- access your data and get a copy (Art. 15)
- correct inaccurate data (Art. 16)
- delete your data (Art. 17)
- restrict processing (Art. 18)
- receive your data in a portable format (Art. 20)
- object to processing based on legitimate interest, including attribution, recommendations and analytics, and to direct marketing at any time (Art. 21)
- not be subject to a decision based solely on automated processing that significantly affects you, and to ask for human review (Art. 22)
- withdraw consent at any time, without affecting earlier processing (Art. 7(3))
- lodge a complaint with a supervisory authority, for example the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany
In the product you can:
- delete your account in the app settings, which deletes your data within 30 days, except data we must keep by law
- edit your profile, identity sharing, location permission and notification settings
- disconnect Shopify, Google Calendar, Notion or the AI connector at any time
To use any of these rights, email privacy@beevvy.com. We reply within one month.
12. Children, security and changes
Children. Beevvy is not intended for anyone under 16, and we do not knowingly collect their data. Creator, business and payout features require you to be 18 or older. If you believe a child has an account, contact us and we will delete it. See also our Child Safety Standards.
Security. We use encryption in transit (TLS), encryption at rest, access controls, row-level security so each account sees only its own data, OAuth tokens instead of passwords for integrations, and limited staff access.
Changes. We update this policy when our data practices or the connector's tools change, and update the "Last updated" date above. For significant changes we notify you in the app or by email.
