Privacy Policy

1. Overview

BEAU ("we," "us," "our") is operated by CYT Bilişim Hizmetleri, a company incorporated in Turkey. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use the BEAU mobile application and website at beauai.app (collectively, the "Service").

We are committed to protecting your privacy with the highest standards. This policy complies with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) as amended by the CPRA, and California SB 243 regarding intimate digital companion applications.

By using BEAU, you agree to the terms of this Privacy Policy. If you do not agree, please do not use the Service.

2. Data We Collect

We collect only the data necessary to provide and improve our Service. We never collect data speculatively.

2.1 Data You Provide Directly

• Account Information: Name, email address, age verification (date of birth), and password when you register.
• Profile Information: Your display name, preferences for how Beau communicates with you, and optional profile details you choose to share.
• Conversation Content: Messages you send to and receive from Beau. These are end-to-end encrypted in transit and AES-256 encrypted at rest.
• Sensitive Personal Information (Optional): If you choose to share them, we may store: significant personal dates (birthdays, anniversaries), information about your emotional state or well-being, and other personal context you share with Beau to improve his responses. This data is treated as sensitive health-adjacent data under SB 243 and receives the highest level of protection.
• Payment Information: Processed exclusively by our payment processor. We do not store full credit card numbers.

2.2 Data Collected Automatically

• Device Information: Device model, operating system, unique device identifiers, and mobile network information.
• Usage Data: Features used, session duration, interaction timestamps, and app performance metrics.
• Log Data: IP address, access times, referring URLs, and error logs for security and debugging purposes.
• Push Notification Tokens: Used solely to deliver Beau's proactive messages to your device. Never used for advertising.

2.3 Data We Do NOT Collect

3. How We Use Your Data

Purpose	Legal Basis (GDPR)
Providing the BEAU Service (AI responses, memory, proactive messages)	Performance of Contract
Account creation and authentication	Performance of Contract
Processing payments and managing subscriptions	Performance of Contract
Sending push notifications you have enabled	Consent
Improving AI model quality (anonymized, aggregated only)	Legitimate Interests
Detecting and preventing fraud, abuse, or illegal activity	Legitimate Interests / Legal Obligation
Responding to legal requests and enforcing our Terms	Legal Obligation
Sending important service and security notices	Legitimate Interests

We do not use your personal data for behavioral advertising, profiling for third-party purposes, or any purpose not listed above.

4. Sensitive and Health-Adjacent Data

4.1 What Constitutes Sensitive Data Under This Policy

In compliance with California SB 243 and GDPR Article 9, we classify the following as sensitive data subject to heightened protection:

• Menstrual cycle dates, reproductive health information, or related wellness data you share
• Mental health disclosures, emotional states, or psychological information shared in conversation
• Relationship status, intimate personal details, or relationship history
• Significant personal dates such as anniversaries, birthdays, or memorial dates
• Financial stress or hardship disclosures

4.2 How We Protect Sensitive Data

• AES-256 encryption at rest in isolated, access-controlled data stores
• TLS 1.3 encryption in transit for all data
• Sensitive data is never used to train AI models without explicit, granular opt-in consent
• No third party (including analytics, advertising, or AI providers) receives sensitive data
• Employee access to sensitive data requires multi-factor authentication, is logged, and is subject to strict need-to-know policies

4.3 AI Training

We may use conversation data in aggregated, anonymized form to improve our AI systems. If we ever use your specific conversation data for model training, we will ask for your explicit, opt-in consent separately. Sensitive data (Section 4.1) is excluded from all AI training pipelines by default.

5. Third Parties and Data Sharing

We do not sell your personal data. We do not share your data for advertising purposes. We share data with third parties only in the following limited circumstances:

• Service Providers: Cloud infrastructure providers (for hosting and storage), payment processors, and email delivery services that process data strictly on our instructions under data processing agreements (DPAs). These providers are prohibited from using your data for their own purposes.
• Legal Compliance: If required by law, court order, or governmental authority. We will notify you of such requests to the extent legally permitted.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before this occurs and you will have the right to delete your account and data.
• With Your Consent: We will share data with third parties when you explicitly request or consent to it.

6. Data Retention

We retain your data only as long as necessary to provide the Service or as required by law.

• Conversation history: Retained while your account is active. Free-tier accounts retain 7 days of conversation history. Premium accounts retain unlimited history. All conversation data is deleted within 30 days of account deletion.
• Account data: Retained for the duration of your account plus 30 days after deletion, to allow for re-activation if deletion was accidental.
• Payment records: Retained for 7 years as required by financial and tax regulations.
• Log data: Retained for 90 days for security and debugging purposes.
• Sensitive personal data: Deleted immediately upon your request or within 72 hours of account deletion.

7. Security

We implement industry-leading security measures to protect your data:

• AES-256 encryption for all data at rest
• TLS 1.3 for all data in transit
• Zero-knowledge architecture for sensitive data: our staff cannot read your conversations
• Regular independent security audits and penetration testing
• Intrusion detection systems and 24/7 monitoring
• Principle of least privilege for all employee and system access
• Secure software development lifecycle (SSDLC) practices

Despite these measures, no digital system is 100% secure. In the event of a data breach affecting your personal data, we will notify you and relevant authorities within 72 hours as required by GDPR Article 33, and within the timeframes required by applicable law.

8. Your Rights

Regardless of your location, we provide the following rights to all BEAU users:

8.1 Rights Under GDPR (EU/EEA Users)

• Right of Access (Art. 15): Request a copy of all personal data we hold about you.
• Right to Rectification (Art. 16): Correct inaccurate or incomplete data.
• Right to Erasure / "Right to be Forgotten" (Art. 17): Request deletion of your personal data.
• Right to Restriction of Processing (Art. 18): Limit how we use your data in certain circumstances.
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interests.
• Right to Withdraw Consent: Withdraw consent for consent-based processing at any time, without affecting prior processing.
• Right to Lodge a Complaint: Lodge a complaint with your local supervisory authority (e.g., ICO in the UK, CNIL in France).

8.2 Rights Under CCPA/CPRA (California Users)

• Right to Know: Know what personal information is collected, used, shared, or sold.
• Right to Delete: Request deletion of personal information we collected from you.
• Right to Opt-Out of Sale/Sharing: We do not sell personal information. This right is therefore automatically satisfied.
• Right to Correct: Correct inaccurate personal information we maintain about you.
• Right to Limit Use of Sensitive Personal Information: Limit the use and disclosure of sensitive personal information to what is necessary for the Service.
• Right to Non-Discrimination: You will not receive discriminatory treatment for exercising your rights.

8.3 Additional Rights Under California SB 243

As an intimate digital companion application, we comply with California SB 243 (effective 2025), which provides additional protections for users of AI companion apps, including:

• Clear disclosure that Beau is an AI, not a real person
• Enhanced protections for intimate communication data
• Right to export all conversation history in a portable format
• Right to complete deletion of all intimate communication data within 24 hours of request
• Prohibition on using intimate data for advertising or selling to third parties

8.4 How to Exercise Your Rights

To exercise any of these rights, you may:

• Use the in-app Privacy Settings menu (Settings → Privacy → My Data)
• Email us at [email protected] with the subject line "Privacy Request"

We will respond to verified requests within 30 days (GDPR) or 45 days (CCPA). We may need to verify your identity before processing requests.

9. California-Specific Disclosures

9.1 "Do Not Track"

Our Service does not respond to Do Not Track (DNT) signals because we do not engage in cross-site tracking of any kind.

9.2 Shine the Light Law

Under California Civil Code Section 1798.83, California residents may request information regarding disclosure of personal information to third parties for direct marketing purposes. We do not disclose personal information to third parties for direct marketing purposes.

9.3 Categories of Personal Information Under CCPA

In the preceding 12 months, we have collected personal information in the following categories: Identifiers (name, email, device ID); Commercial information (subscription details); Internet/electronic activity (app usage, interaction logs); Inferences drawn from the above to create a user profile for personalization. We have NOT sold personal information in any category.

10. Children's Privacy

BEAU is strictly for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If you become aware that a minor has provided us with personal data, please contact us at [email protected] and we will delete that data within 24 hours. We comply with the Children's Online Privacy Protection Act (COPPA) and all applicable child protection laws.

11. International Data Transfers

CYT Bilişim Hizmetleri is headquartered in Turkey. Turkey has been recognized as providing an adequate level of data protection for transfers from the EU under applicable frameworks. For transfers to our service providers in other jurisdictions, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other appropriate transfer mechanisms.

Your data may be processed in Turkey, the European Union, and the United States. All such processing is subject to this Privacy Policy and applicable data protection law.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email and in-app notification at least 30 days before the changes take effect. The updated policy will be posted on this page with a revised "Last Updated" date. Your continued use of BEAU after the effective date constitutes acceptance of the updated policy. If you do not agree to the changes, you may delete your account before the effective date.

13. Contact Us