PRIVACY

Privacy Policy

Effective date: June 9, 2026
Last updated: June 9, 2026

This Privacy Policy explains how personal data is processed when you use the beelo.ai website and the beelo.ai service (the "Service"). beelo.ai is a system for discovering winning advertising creatives and reducing subscriber acquisition cost for subscription apps and services.

We take your data seriously and process it in accordance with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the California Consumer Privacy Act (CCPA, as amended by the CPRA).

1. Who we are (data controller)

The controller of your personal data is:

BrainCode Sp. z o.o.
ul. Floriańska 6/2, 03-707, Warszawa, Poland

For any questions related to data protection, please contact:

Email: privacy@beelo.ai
Privacy contact: Anton Rogachevskyi — anton.rogachevskyi@gmail.com

If you have questions about this policy or wish to exercise your rights, email us at privacy@beelo.ai.

2. Who this policy applies to

This policy applies to:

visitors to the beelo.ai website;
registered users and customers of the Service (typically representatives of companies — advertisers and app owners);
individuals who contact us by email, through forms, or as part of pilots and demos.

The Service is intended for business users (B2B). It is not designed for personal consumer use and is not directed at children (see Section 12).

3. What data we collect

We collect only the data needed to provide the Service and support our customers.

3.1. Account and contact data. Name, work email, company name, job title, phone number (if provided), login and authentication credentials.

3.2. Payment and billing data. Payment details, payment history, tax/corporate information. Card data is processed by our payment providers; we do not store full card numbers on our servers.

3.3. Advertising account and campaign data. To run creative tests and collect results, you may connect your advertising accounts (e.g., Meta Ads, TikTok Ads) to the Service. In that case we receive campaign data: creatives, ad metadata, performance metrics (impressions, clicks, conversions, cost), and authorization tokens. See Section 4 for details.

3.4. Content you upload. Product descriptions, offers, scenarios, advertising materials (video, static, hook/message/CTA copy), as well as generated and tested creative variants.

3.5. Usage data. Actions within the Service, logs, time and frequency of feature use, technical events and errors.

3.6. Technical data. IP address, browser and device type and version, operating system, cookie identifiers and similar technologies, referrer, language, and time zone.

3.7. Communications. The content of your support requests, correspondence, and responses to surveys and interviews during pilots.

We do not intentionally collect special categories of data under the GDPR (race, health, political opinions, etc.) and ask that you not submit them through the Service.

4. Connecting advertising platforms (Meta, TikTok, and others)

A core function of the Service is testing creatives and attributing results at the element level. To enable this, you may grant us access to your advertising accounts through the official APIs of the relevant platforms (OAuth).

We use such access solely to run and analyze your advertising tests, collect metrics, and generate recommendations.
We receive data from your advertising account only to the extent you authorized when connecting it.
We store authorization tokens in encrypted form and use them only for the agreed purposes.
You may revoke access at any time — within the Service and/or in the settings of the advertising platform itself.

Use of data obtained through the Meta and TikTok APIs is also governed by the policies and terms of those platforms. We may use aggregated and de-identified creative-performance statistics that do not identify you or any individual to improve the Service's algorithms.

5. Purposes of processing and legal bases (GDPR)

We process personal data on the following Article 6 GDPR bases:

Purpose of processing	Data categories	Legal basis
Providing and operating the Service, performing the contract, support	Account, content, accounts/campaigns, usage	Performance of a contract (Art. 6(1)(b))
Billing, invoicing, accounting, and tax records	Payment, contact	Performance of a contract and legal obligation (Art. 6(1)(b), (c))
Security, fraud prevention, debugging	Technical, logs	Legitimate interest (Art. 6(1)(f))
Improving the Service, product analytics, training algorithms on de-identified data	Usage, aggregated metrics	Legitimate interest (Art. 6(1)(f))
Marketing emails and product news	Contact	Consent or legitimate interest (Art. 6(1)(a)/(f))
Cookies and website analytics (optional)	Technical, cookies	Consent (Art. 6(1)(a))
Legal compliance, responding to authorities' requests	Any applicable	Legal obligation (Art. 6(1)(c))

Where processing is based on consent, you may withdraw it at any time — this does not affect the lawfulness of processing before withdrawal.

6. Who we share data with

We do not sell your personal data. We may disclose it to the following categories of recipients:

6.1. Service providers (sub-processors). Companies that help us deliver the Service and act on our instructions, including:

cloud hosting and data storage;
payment providers;
analytics and monitoring tools;
email and customer-support services;
AI/infrastructure providers for creative generation and analysis.

We enter into data processing agreements (DPAs) with all sub-processors on terms compliant with the GDPR. A current list of sub-processors is available on request at privacy@beelo.ai.

6.2. Advertising platforms. When you connect advertising accounts, data is exchanged between the Service and the relevant platforms (Meta, TikTok, etc.) to the extent necessary to run tests.

6.3. Professional advisors. Lawyers, auditors, and accountants — where necessary and under confidentiality obligations.

6.4. Business transactions. In a merger, acquisition, asset sale, or reorganization, data may transfer to a successor under the terms of this policy.

6.5. Legal requirements. Where required by law, a court, or a competent authority, or to protect our rights, safety, and prevent fraud.

7. International data transfers

We are located in the European Union (Poland). If data is transferred outside the European Economic Area (EEA) — for example, to service providers in the United States — we ensure appropriate safeguards under the GDPR, in particular:

Standard Contractual Clauses (SCCs) approved by the European Commission; and/or
transfers to countries covered by a European Commission adequacy decision; and/or
other mechanisms permitted by law.

You may request a copy of the relevant safeguards at privacy@beelo.ai.

8. Data retention

We retain personal data no longer than necessary for the purposes for which it was collected:

account data — for the duration of your account and a reasonable period after closure;
billing and accounting data — for the periods required by tax and accounting law (typically up to 5 years or more);
campaign data and de-identified metrics — for the duration of the engagement; aggregated de-identified data may be retained longer to improve algorithms;
logs and technical data — for a limited period for security and debugging;
marketing contacts — until consent is withdrawn or an objection is made.

Once the period ends, data is deleted or irreversibly de-identified.

9. Data security

We apply technical and organizational measures to protect data, including encryption in transit (TLS) and for stored tokens, least-privilege access controls, logging, regular backups, and monitoring. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we continuously improve our measures.

In the event of a data breach that poses a risk to your rights, we will notify the supervisory authority and, where required, you, within the timeframes set by the GDPR.

10. Your rights under the GDPR

If you are in the EEA, you have the following rights regarding your personal data:

Right of access — to obtain confirmation and a copy of the data processed.
Right to rectification — to correct inaccurate or incomplete data.
Right to erasure ("right to be forgotten") — in cases provided by law.
Right to restriction of processing.
Right to data portability — to receive your data in a structured, machine-readable format.
Right to object to processing based on legitimate interest, including direct marketing.
Right to withdraw consent at any time where processing is based on consent.
Right not to be subject to a decision based solely on automated processing that produces legal effects concerning you.

To exercise your rights, email privacy@beelo.ai. We will respond within one month (this may be extended in complex cases, with notice).

Right to complain. You have the right to lodge a complaint with a supervisory authority. For Poland this is the Personal Data Protection Office (UODO — Urząd Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl). You may also contact the supervisory authority in your country of residence.

11. California residents' rights (CCPA/CPRA)

If you are a California resident, you have additional rights:

Right to know what personal data we collect, the sources, purposes, and categories of recipients.
Right to access a copy of the data collected about you.
Right to delete personal data (subject to exceptions).
Right to correct inaccurate data.
Right to opt out of the "sale" or "sharing" of personal data. We do not sell personal data and do not share it for cross-context behavioral advertising within the meaning of the CCPA.
Right to non-discrimination for exercising your rights.

In the preceding 12 months we may have collected the categories of data described in Section 3 (identifiers, commercial information, internet activity, professional/employment-related information) for the purposes in Section 5. To exercise your CCPA rights, email privacy@beelo.ai. An authorized agent may submit a request; we may verify your identity before fulfilling it.

12. Children

The Service is intended for business users and is not directed at individuals under 16. We do not knowingly collect children's data. If you believe a child has provided us with data, contact privacy@beelo.ai and we will delete it.

13. Cookies and similar technologies

The beelo.ai website uses cookies and similar technologies:

Strictly necessary — to operate the site and authentication (no consent required).
Analytics — to understand site usage and improve it.
Functional — to remember your preferences.
Marketing — where used, only with your consent.

On your first visit from the EEA we request consent for optional cookies via a banner; you can change your choice in the settings. You can also manage cookies in your browser settings. See our cookie notice for details (if a separate document exists).

14. Automated processing

The Service uses algorithms to generate, select, and score advertising creatives and to produce recommendations. These processes relate to your business and campaign data and do not make legally significant decisions about you as an individual within the meaning of Article 22 GDPR. Should such processing arise, we will notify you in advance and provide appropriate safeguards.

15. Links to third-party resources

The website and Service may contain links to third-party sites and integrations (e.g., advertising platforms). We are not responsible for their privacy practices — we recommend reviewing their own policies.

16. Changes to this policy

We may update this Policy from time to time. For material changes, we will update the date at the top and, where necessary, notify you by email or through the Service. We recommend reviewing this page periodically.

17. How to contact us

For any privacy questions and to exercise your rights:

BrainCode Sp. z o.o.
ul. Floriańska 6/2, 03-707, Warszawa, Poland
Email: privacy@beelo.ai
Privacy contact: Anton Rogachevskyi — anton.rogachevskyi@gmail.com