How we handle your data.

Who we are

Beanshoot is a trading name of Beanshoot AI Technologies LLP, a limited liability partnership registered in India with its office in Chennai, India. For the purposes of the EU and UK General Data Protection Regulation and India’s Digital Personal Data Protection Act, 2023, we are the data controller for the personal data described in this notice, except for the Beanshoot Connect data described in its own section below, where we act on our client’s behalf.

You can reach us on any data-protection matter at hello@beanshoot.ai.

What we collect and why

Audit-request form

When you submit the form on our contact page we receive the name, work email, company, role (if you share it), the domain you selected, and the message you wrote. We also record the date, time, and the IP address the request came from.

We use this information for a single purpose: to reply to your enquiry, assess whether it is a fit, and, if it is, to schedule a 60-minute executive session. The legal basis is your consent (GDPR Art. 6(1)(a)) and our legitimate interest in responding to unsolicited business enquiries (GDPR Art. 6(1)(f)). Under the DPDP Act we rely on the consent you give on the form.

Email correspondence

If you email us directly, the content of that email — and any metadata your email client shares — sits in our mailbox and in our mail provider’s logs. We do not use the content for anything other than the thread it belongs to.

Analytics and cookies

We do not set any advertising or third-party tracking cookies. If we enable first-party, privacy-preserving analytics (e.g. Plausible) we will do so only after you accept the analytics option in our consent banner, and will describe exactly what is collected on the cookies page.

Where your data is stored

Form submissions are emailed to our hello@ mailbox through Resend, a transactional email provider. The mailbox itself is hosted in the European Union. The infrastructure that serves this site (Vercel / Cloudflare) processes request metadata — including IP addresses — at globally distributed edge nodes; that processing is governed by those providers’ data-processing agreements, which we have accepted on your behalf.

For transfers from the EU / UK to third countries, we rely on the Standard Contractual Clauses adopted by the European Commission and the UK International Data Transfer Addendum.

How long we keep it

• Audit-request submissions that do not lead to an engagement: 24 months, then deleted.
• Correspondence that leads to an engagement: retained for the duration of the engagement plus seven years, in line with Indian Companies Act record-keeping requirements.
• Server logs containing IP addresses: 30 days on the edge, then aggregated.

Who we share it with

We do not sell your data. We do not share it with advertisers. We share it only with service providers who help us deliver this site and respond to you:

• Resend — transactional email. Receives form payloads as part of the email body.
• Vercel / Cloudflare — hosting and CDN. Processes request metadata to serve pages.
• Our professional advisors (lawyers, accountants, auditors) when they have a clear need to see specific information.

We will also disclose personal data if required to do so by a law enforcement authority acting with proper jurisdiction and a valid order.

Beanshoot Connect and WhatsApp data

Beanshoot Connect is an app that lets our clients connect their own WhatsApp Business number to manage contacts and conversations. This section covers the data we handle when a client does that.

What we receive

When a client connects their WhatsApp Business number, we receive the messages sent to that number and their delivery status (the message metadata and content needed to provide the service), plus the client’s WhatsApp Business account details from Meta.

Why we use it

Only to provide the service to that client: saving the contacts the client chooses to save, recording each person’s opt-in and opt-out, and sending messages the client approves.

Who controls it

The client is the data controller for their contacts and conversations. Beanshoot processes that data on the client’s behalf and on their instructions.

Where it is stored

In India (Mumbai region).

Sharing

We do not sell this data and do not use it for advertising. We share it only with the service providers needed to run the service (such as hosting and database providers), under contract.

Retention and deletion

• We keep the data while the client uses the service.
• We delete it when the client asks us to, or when a person asks the client to delete their data.
• Anyone can stop receiving messages from a client at any time by replying STOP.

Data requests

If you have received messages from one of our clients and want your data accessed, corrected or deleted, you can contact that client directly or email us at hello@beanshoot.ai and we will pass your request on and help the client act on it.

Meta and WhatsApp

Beanshoot Connect uses Meta’s official WhatsApp Business Platform. Use of WhatsApp is also subject to WhatsApp’s own Business Terms of Service and Business Messaging Policy.

Your rights

Under GDPR, the UK GDPR, and the DPDP Act, you have the right to:

• Ask for a copy of the personal data we hold about you.
• Have inaccurate data corrected.
• Ask us to delete your data (subject to legal retention rules).
• Withdraw consent at any time, with no impact on processing that took place before the withdrawal.
• Object to or restrict processing in certain circumstances.
• Receive your data in a portable, machine-readable format.
• Under the DPDP Act, nominate another person to exercise these rights on your behalf.

To exercise any of these rights, email hello@beanshoot.ai and we will respond within 30 days. You also have the right to complain to a supervisory authority — the relevant Data Protection Board of India, your local EU DPA, or the UK Information Commissioner’s Office.

Security

We use TLS for all traffic to this site, encrypt data at rest with our hosting providers, and limit access to personal data to the people who need it to do their work. Rate-limiting and honeypot fields on the contact form reduce spam and automated attacks. No system is perfectly secure; if a breach occurs that is likely to result in a risk to your rights we will notify you and the relevant authority within the statutory window.

Changes to this notice

We update this notice when our practices change. The “last updated” date at the top always reflects the most recent revision. Material changes will be announced on our site homepage for at least 30 days before taking effect.