Privacy policy

• Your account — your email address, a hash of your password (never the password), when the account was created, and whether the address was verified.
• Your consent record — that you accepted these terms and this policy, which version, when, and the IP address the acceptance came from. This is kept as evidence of the agreement and for nothing else.
• Your plan — which plan you are on and how it stands with our payment provider. We never see or hold your card number.
• Your letterhead — the business name, address lines and logo you put on statements.
• Support threads — what you write to us on the Help page, and our replies. It is the one free-text box in the product we keep, which is why the page asks you to leave tenants’ personal details out of it.
• If you referred somebody or were referred — the referral code on the account, and the day-by-day count of clicks on a code. Never who clicked.

The substance of the service is data you enter about your properties: buildings, cost pools, expense ledgers, leases and their clauses, tenant names as they appear on leases, the addresses you send statements to, and the statements themselves once frozen. Some of this is about third parties. You decide what goes in and you are responsible for it; we process it only to provide the service to you, on your instructions, and never for our own purposes. Where a data-protection law applies to you, you are the controller of this data and we are your processor.

A statement you send by link is opened by its recipient with the link alone, without an account. The link is a long random token; you can revoke it at any time, after which it answers as if it never existed. We record which address a link was sent to and when, so you can answer a tenant who says they never received it.

There are no third-party trackers, no advertising pixels and no analytics service on this site. Our own page counters record that a public page was viewed on a given day, and nothing else — no IP address, no browser, no session, no path through the site; the row for a page on a day is one integer that many strangers incremented. Signed-in screens are never counted at all. The cookies we set are functional: the one that keeps you signed in, the organisation you are working in, the demonstration while you look at it, your light or dark preference, and a short-lived one while you connect QuickBooks Online. None of them tracks you, which is why there is no cookie banner: there is nothing to consent to.

To provide the service you signed up for — that is the legal basis for nearly everything above. Your consent record is kept to evidence the agreement. Your email address is used to sign you in, to confirm it, to reset a password, and to tell you that a reply is waiting on a support thread; the reply itself stays in the service. We do not send marketing email, and we do not sell, rent or share your data with anyone for their own purposes.

The service runs on a virtual server operated by OVHcloud in France. Beyond that, four companies handle a specific part of the data because the service cannot work without them, and two more only if you choose to use them:

• Stripe (trading as Link) — takes payment, holds your card, issues invoices and collects any tax. Your email address and your plan go to Stripe; nothing about your buildings does. If you turn on online payments, your tenants pay their invoices on Stripe’s page into your own Stripe account: their bank or card details go to Stripe and never to us, and we receive only whether and when a payment went through.
• Resend — delivers the email we send you: verification, password reset, a support notification, and the statement links you send to tenants. It sees the address and the message.
• Cloudflare — the domain, its DNS, incoming email routing, and the access control in front of our own administration screens. It sees network traffic to the site as any network provider does.
• OVHcloud — the server the service and its database run on.
• Intuit (QuickBooks Online) — only if you connect it. The invoices, credit notes and payments you issue or record, and the customer each lease becomes, are sent to your QuickBooks company; your company’s name, country and currency are read when you connect, and — only when a person asks — its items, tax codes, expense accounts, classes and locations, the general ledger of the accounts you choose, and customer balances. What is read is used for the service and nothing else, and is never shared. The connection’s tokens and your company’s QuickBooks ID are stored encrypted. You can disconnect at any time, from Settings or from QuickBooks.
• Anthropic — only if your organization uses the AI assistant (the Pro + AI formula). A document you choose to have read — a lease, an insurance certificate or a vendor invoice, as a PDF — is sent to Anthropic’s API to be read by its Claude model, and the proposals come back to you. With an invoice go the names of the building’s expense categories, so one can be proposed. To draft your reply to a tenant’s question about a statement, the question and the figures of that tenant’s frozen statement are sent, without any name. A question you ask about your portfolio is sent with today’s date only, and the answer is read from your own records. Nothing else about your account goes with any of these. Anthropic does not train its models on what is sent through its API. What the assistant proposes is checked against the document and entered only when a person confirms it.

Our staff can see your account details and, for support, what you can see in the service, and only as far as a support question needs. We disclose data otherwise only if the law requires it.

For as long as your account exists. When you ask us to delete it — or when we delete it for you — everything attached to it goes with it: buildings, leases, ledgers, frozen statements, statement links, letterhead, support threads. The consent record is kept for as long as we may need to evidence the agreement, and invoices are kept by our payment provider for as long as tax law requires. Backups of the database are kept for a short period and then overwritten.

You can see and change most of what we hold from inside the service, and export your buildings’ data as CSV at any time. You can ask us to correct or delete anything, to give you a copy of what we hold, or to stop processing it; write to [email protected] from the address on the account and we will answer within thirty days. If you are in a jurisdiction that gives you a right to complain to a supervisory authority, you may.

Data is encrypted in transit. Every table that holds a customer’s data is protected by row-level security in the database itself, so one account’s data is unreadable from another account’s session by construction and not by convention. Passwords are stored as salted hashes. No system is perfectly secure; if we learn of a breach affecting your data we will tell you without undue delay.

Each revision of this policy carries a new effective date at the top of the page, and we record which version you agreed to. Questions go to [email protected], or by post to Beegma Limited Liability Company, 30 N Gould St Ste R, Sheridan, WY 82801, USA. The terms of service say how the two documents fit together.