Privacy Policy

1. Overview

This Privacy Policy explains how Be Found Everywhere Inc. ("BFEAI," "Company," "we," "us," or "our") collects, uses, stores, and deletes personal information when you use our website and services (collectively, the "Service").

The Service is intended only for individuals 18 years or older.

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.

For questions about this Privacy Policy or to exercise your data rights, contact us at: privacy@bfeai.com

2. Categories of Data Collected

Account Information

• Name
• Email
• Password hash
• Phone
• Company
• Industry
• Avatar

Billing Data

• Stripe subscription records
• Transaction history
• Credit balances
• Cancellation feedback

We do not store full payment card numbers. All payment processing is handled by Stripe, a PCI Level 1 certified payment processor.

Application-Generated Data

• Keyword research reports
• Search results
• SERP competitor metrics
• Business profiles
• AI visibility scan data
• Mention history

Support Data

• Bug reports
• Screenshots
• Communications

Security & Operational Logs

• Login events
• IP addresses
• User agents
• API usage metrics

3. How We Use Data

We process data to:

• Provide and maintain the Service
• Process billing
• Generate reports
• Improve functionality
• Prevent fraud
• Comply with legal obligations

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

4. Legal Basis (EU/UK)

If you are located in the EU or UK, our processing of your personal data is based on:

• Contract performance — to provide the Service you signed up for
• Legitimate interests — to improve our products, prevent fraud, and ensure security
• Legal compliance — to meet our legal obligations

Where processing is based on consent, you have the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal. To withdraw consent, contact privacy@bfeai.com.

5. Data Retention

We retain personal data only as long as necessary to:

• Provide services
• Meet legal obligations
• Resolve disputes

Upon account deletion:

• Personally identifiable data is permanently removed
• Billing records, reports, and files are deleted
• Logs are anonymized and retained in aggregate form

Specific retention periods:

Data Type	Retention Period
Account information	Until account deletion
Billing records	Deleted upon account deletion; aggregate financial records retained as required by law (up to 7 years)
Application-generated data (reports, scans)	Until account deletion
Security logs	Anonymized after 90 days; aggregates retained for up to 1 year
Support data (bug reports)	Until account deletion or issue resolution, whichever is later
API usage and cost logs	Anonymized after 90 days; aggregates retained for up to 1 year

6. International Transfers

Data is processed in the United States and other jurisdictions where our service providers operate.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we ensure that transfers of personal data to countries outside your jurisdiction are protected by appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Reliance on service providers' compliance frameworks (e.g., Stripe, Supabase, and other providers maintain their own data protection agreements and certifications)

You may request a copy of the applicable transfer safeguards by contacting privacy@bfeai.com.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access — Request a copy of the personal data we hold about you
• Correction — Request correction of inaccurate or incomplete data
• Deletion — Request deletion of your personal data
• Restrict processing — Request that we limit how we use your data
• Data portability — Request your data in a structured, machine-readable format
• Object to processing — Object to processing based on legitimate interests
• Withdraw consent — Where processing is based on consent, withdraw that consent at any time
• Lodge a complaint — You have the right to lodge a complaint with a supervisory authority in your jurisdiction if you believe our processing of your personal data violates applicable law

To exercise any of these rights, contact us at privacy@bfeai.com. We will respond to verified requests within 30 days (or 45 days if an extension is necessary, with notice).

We will not discriminate against you for exercising any of your privacy rights. You will not receive different pricing, a different quality of service, or be denied service for making a data rights request.

You may designate an authorized agent to submit requests on your behalf. Authorized agents must provide written authorization from the data subject and may be required to verify their own identity.

8. California Rights (CCPA/CPRA)

California residents have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know — Request disclosure of the categories and specific pieces of personal information collected
• Right to delete — Request deletion of personal information
• Right to correct — Request correction of inaccurate personal information
• Right to opt-out of sale or sharing — You may opt out of the sale or sharing of your personal information

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

To exercise your rights, contact privacy@bfeai.com or use the "Do Not Sell or Share My Personal Information" link on our website.

Categories of third parties receiving data:

Third Party	Data Shared	Purpose
Stripe	Billing data, email	Payment processing
Supabase	Account data, application data	Database hosting and storage
OpenAI (and other AI providers)	User-submitted queries, business profiles	AI-powered analysis and report generation
Resend	Email address	Transactional email delivery
DataForSEO	Search queries	SEO data retrieval

Financial incentive disclosure: We may offer introductory pricing (e.g., a $1 trial period). Participation is voluntary, and you may cancel at any time without penalty. The value of the introductory offer is reasonably related to the value of the data collected during the trial period.

9. Cookies

We use cookies for authentication, security, and session management.

We do not currently use advertising or tracking pixels.

Types of cookies used:

Cookie	Purpose	Duration
bfeai_session	Authentication (SSO)	7 days
bfeai_theme	User theme preference	Persistent

Because our cookies are strictly necessary for the operation of the Service (authentication and security), they do not require opt-in consent under GDPR. We do not use analytics, advertising, or third-party tracking cookies.

10. Security

We implement reasonable technical and organizational safeguards to protect your personal data, including:

• Encryption in transit (HTTPS/TLS on all connections)
• Encryption at rest (AES-256 database encryption)
• Secure password hashing (bcrypt)
• HTTP-only, secure cookies with domain-scoped access
• Rate limiting and account lockout protections
• Row-Level Security (RLS) on all database tables ensuring users access only their own data
• Security event logging and monitoring
• Regular security and vulnerability assessments

No system is completely secure. If you believe your account has been compromised, contact privacy@bfeai.com immediately.

11. Data Breach Notification

In the event of a confirmed data breach that affects your personal information, BFEAI will:

• Notify affected individuals via email within 72 hours of confirming the breach, in compliance with GDPR Article 33 and applicable law.
• Notify relevant supervisory authorities as required by applicable data protection laws.
• Provide clear information including:
  • A description of the nature of the breach
  • The categories and approximate number of individuals affected
  • The categories of personal data affected
  • The likely consequences of the breach
  • The measures taken or proposed to address the breach
  • Recommendations for affected individuals to protect themselves
• Conduct a post-incident review within 14 days to identify root cause and implement remediation measures.

Our full Incident Response Policy governs internal breach handling procedures, including detection, classification, containment, and recovery.

12. Sub-Processors

We use the following sub-processors to deliver the Service:

Sub-Processor	Location	Purpose
Stripe, Inc.	United States	Payment processing and subscription management
Supabase, Inc.	United States (US-East)	Database hosting, authentication infrastructure, file storage
Netlify, Inc.	United States	Application hosting and content delivery
OpenAI, Inc.	United States	AI-powered analysis and content generation
DataForSEO	United States	SEO and keyword data retrieval
Resend, Inc.	United States	Transactional email delivery
Upstash, Inc.	United States	Rate limiting and security infrastructure

We require all sub-processors to maintain appropriate data protection measures. We will update this list as sub-processors change and notify users of material changes.

13. Children's Privacy

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a child under 18, we will take steps to delete that information promptly. If you believe a child has provided us with personal data, contact privacy@bfeai.com.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a prominent notice on our website at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

15. Contact

If you have questions about this Privacy Policy, wish to exercise your data rights, or need to report a security concern:

Be Found Everywhere Inc. Oaklyn, NJ
Email: privacy@bfeai.com

For EU/UK residents: If you are not satisfied with our response to a data rights request, you have the right to lodge a complaint with your local data protection supervisory authority.