Privacy Policy

1. Information We Collect

Account & Workspace Data

When you create a workspace or user account on the Beezifi team communication platform, we collect:

• Name, email address, and password (stored as a bcrypt hash — never in plaintext)
• Username and display name chosen during registration
• Workspace name (slug) and the role assigned to your account (owner, admin, member, or guest)
• Optional: TOTP 2FA secret (stored encrypted; used solely for authentication)

Workspace Content You Create

The Service allows you to store and share team communication including messages, channel conversations, direct messages, file attachments, pinned messages, saved messages, documentation, and webhook configurations. This content belongs entirely to your organization. We store it to provide the Service and do not use it for advertising, profiling, or any purpose beyond delivering the Service to you.

Usage & Technical Data

We may collect limited technical data to operate and improve the Service, including:

• IP address and browser/device type at login (for security and rate-limiting purposes)
• API request logs for debugging and audit purposes
• Timestamps of significant actions (login, message sent, file uploaded, member invited)

Payment Information

Billing is handled by our payment processor (Stripe). We do not store full credit card numbers on our servers. We retain only the plan type, subscription status, and billing cycle associated with your workspace.

2. How We Use Your Information

We use collected information to:

• Provision and operate your workspace and team communication features
• Authenticate users and enforce role-based access controls
• Deliver real-time messages and notifications via WebSocket
• Send transactional communications (account confirmation, password reset, billing receipts)
• Provide customer support when you contact us
• Detect and prevent fraud, abuse, and unauthorized access
• Comply with legal obligations
• Improve the platform's reliability and performance

3. Data Isolation & Multi-Tenancy

The Beezifi platform is designed with strict data isolation between workspaces. All workspace data — messages, channels, files, members, and configurations — is logically separated so that data from one organization is never accessible to another through the application layer, shared query results, or our internal tooling without explicit authorization.

Even Beezifi employees accessing the infrastructure for support purposes can only do so through audited, role-gated processes. We enforce access controls at the API layer on every request.

4. Data Sharing & Third Parties

We do not sell, rent, or trade your personal information. We may share data only in the following limited circumstances:

• Service providers: Infrastructure hosting and payment processors who operate under confidentiality agreements and are permitted to use data only to perform services for us.
• Legal requirements: If required by law, subpoena, or court order, we will notify you where legally permitted before disclosing your data.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify affected users and provide options where feasible.
• With your consent: Any other sharing will only occur with your explicit written consent.

5. Data Retention

We retain your data for as long as your workspace is active and your subscription is in good standing. Upon termination of your account:

• Active workspace data is retained for 30 days after cancellation to allow for recovery or export.
• After 30 days, the workspace data is permanently deleted. This deletion is irreversible.
• Backup snapshots are purged within 90 days of workspace deletion.
• Authentication logs and billing records may be retained for up to 7 years to satisfy legal and financial compliance obligations.

You may request early deletion by contacting us at privacy@beezifi.com.

6. Security

We take data security seriously. Technical safeguards in place include:

• All passwords hashed using bcrypt with a work factor of 10 or higher
• All data transmitted over HTTPS (TLS 1.2+)
• JSON Web Tokens (JWT) with short expiry windows for session management
• Refresh tokens stored in HttpOnly, Secure, SameSite cookies — not accessible by JavaScript
• Optional TOTP-based two-factor authentication for all accounts
• Rate limiting on all authentication endpoints to prevent brute force attacks
• HTTP security headers (Content-Security-Policy, HSTS, X-Frame-Options) enforced on all responses
• Role-based access controls enforced at the API layer on every request

Despite our efforts, no system is 100% secure. In the event of a security breach affecting your data, we will notify you within 72 hours of discovery as required under applicable law.

7. Cookies & Session Storage

The Beezifi platform uses minimal cookies and browser storage:

• HttpOnly refresh token cookie (refresh_token): A Secure, HttpOnly cookie used to maintain your authenticated session and obtain new access tokens. It is not accessible by JavaScript and is essential for the Service to function.
• Session storage: We use sessionStorage to remember your last-used workspace within a browser tab. This data is cleared automatically when the tab is closed.
• No advertising cookies: We do not place third-party advertising or tracking cookies.
• No analytics pixels: We do not embed third-party analytics scripts that profile individual behavior.

You may clear your browser's cookies and session storage at any time, which will sign you out of the Service.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Correct inaccurate or incomplete data (your profile settings are editable directly in the app).
• Erasure: Request deletion of your data, subject to legal retention requirements.
• Portability: Workspace admins can export workspace data at any time by contacting support. Message history and file metadata can be provided in structured formats upon request.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at privacy@beezifi.com. We will respond within 30 days.

9. Children's Privacy

The Service is intended for business use and is not directed at children under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us immediately at privacy@beezifi.com and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page. For material changes, we will provide at least 14 days' notice via email to the workspace admin on file before the change takes effect. Continued use of the Service after the effective date constitutes acceptance of the revised policy.

11. Contact Us

For any privacy questions, requests, or concerns, reach out to us directly:

• Email: privacy@beezifi.com
• General inquiries: hello@beezifi.com

We aim to respond to all privacy inquiries within 5 business days. A mailing address is available upon request.