1. Data Controller
The data controller for personal data processed through the Beekeeper platform is:
- Risan Solutions (enkeltpersonforetak)
- Org.nr: 937 137 273
- Registered address: Valenvegen 49, 3802 Bø i Telemark, Norway
- Country: Norway
- Contact: privacy@beekeeper.bz
This Privacy Policy explains how we collect, use, and safeguard personal data when you use the Beekeeper platform ("Service"). The Service is designed around the principle of data minimization — we collect only what is necessary for the functionality of the platform.
2. Scope
This policy applies to all users of the Beekeeper platform, including Merchants and Creators with registered accounts, as well as coupon recipients (end consumers) who interact with Coupon Tokens. The Service is intended for use by businesses and professionals in a commercial capacity. For details on the terms governing use, see our Terms of Service.
3. Information We Collect
Merchant & Creator Accounts
When you register an account, we collect and process:
- Email address and display name
- Hashed password (passwords are not stored in plaintext)
- Business name and details (Merchants)
- Two-factor authentication secrets (stored encrypted)
- Stripe account identifiers (for billing and payouts)
- Layout and interface preferences — your chosen sidebar position, color theme, navigation item order, dashboard panel order, and shortcut configuration. By default these are stored server-side so your workspace stays consistent across devices. You may opt out at any time via Settings → Privacy & Data → “Store Layout Preferences Locally Only”.
Direct Messages and Voice Calls
The platform includes a direct messaging inbox and voice calling feature for communication between Merchants and Creators. When you use these features, we collect and process:
- Message content: The text of direct messages you send or receive, including timestamps, sender identity, read status, and edit or deletion history.
- Voice call metadata: Call session identifiers, the conversation the call is associated with, call initiator, and call start and end timestamps.
- Call summary markers: Short system-generated messages appended to the conversation to create a readable call log. These are stored as regular messages.
Voice audio is never recorded or stored. All voice calls are transmitted peer-to-peer using WebRTC with SRTP encryption. Our voice call infrastructure (LiveKit) is self-hosted on our own servers — no audio data is sent to any third-party cloud service.
Coupon Recipients (End Consumers)
We apply data minimization for coupon recipients. When a consumer receives or uses a Coupon Token, we do not collect their name or email address. We process only:
- Truncated, hashed IP addresses (for rate limiting and abuse prevention only — full IP addresses are not stored)
- Coupon Token interaction data (issuance, validation, redemption timestamps)
Automatically Collected Data
- Truncated IP addresses (/24 for IPv4, /64 for IPv6) for rate limiting
- Hashed user agent strings for session security
- Timestamps of activity
4. Legal Basis for Processing
We process personal data under the following legal bases as defined in Article 6 of the GDPR:
- Contract performance (Art. 6(1)(b)): Processing necessary to provide the Service, including account management, coupon issuance and redemption, billing, and creator payouts.
- Legitimate interest (Art. 6(1)(f)): Processing necessary for fraud prevention, abuse detection, rate limiting, platform security, and service improvement.
- Legal obligation (Art. 6(1)(c)): Processing required to comply with applicable laws, including financial record-keeping, tax compliance, and responding to lawful requests from authorities.
- Consent (Art. 6(1)(a)): Where you have opted in to marketing communications. You may withdraw consent at any time through your account Settings → Privacy & Data tab, or by contacting privacy@beekeeper.bz.
5. How We Use Your Information
- Service delivery: Process coupon issuance, validation, and redemption
- Billing: Calculate and charge platform fees via Stripe
- Payouts: Process creator commission payments via Stripe Connect
- Security: Detect abuse, prevent fraud, enforce rate limits
- Transactional communication: Send account verification, password resets, and essential service notifications via email
- Marketing communication: Send promotional or informational emails where you have given consent (you may withdraw consent at any time)
- Analytics: Provide merchants and creators with aggregated, non-identifying campaign performance metrics
- Direct messaging: Store and deliver text messages exchanged between Merchants and Creators through the platform inbox. Legal basis: contract performance (Art. 6(1)(b)).
- Voice calling: Facilitate real-time encrypted voice calls between Merchants and Creators. Call metadata is retained and displayed in the conversation history. Voice audio is never recorded. Legal basis: contract performance (Art. 6(1)(b)).
- Interface personalization: Store and apply your dashboard layout preferences across devices. Legal basis: contract performance (Art. 6(1)(b)).
7. International Data Transfers
Some of our service processors, including Stripe and Google, process personal data outside the European Economic Area (EEA), including in the United States. Where data is transferred outside the EEA, we ensure appropriate safeguards are in place, including:
- EU-US Data Privacy Framework (DPF): Both Stripe, Inc. and Google LLC are certified under the EU-US Data Privacy Framework, providing an adequacy basis for transfers to the USA.
- Standard Contractual Clauses (SCCs): Where DPF certification alone is not sufficient, transfers are additionally covered by SCCs approved by the European Commission.
- Adequacy decisions: Transfers to countries covered by an adequacy decision of the European Commission require no additional safeguards.
8. Data Security
We implement appropriate technical and organizational measures to protect personal data, including:
- Passwords hashed with bcrypt
- All connections encrypted with TLS/HTTPS
- Session tokens with HttpOnly, Secure, and SameSite attributes
- Two-factor authentication (TOTP)
- IP-based rate limiting with privacy-preserving truncation
- Automated abuse detection mechanisms
- Role-based access control for platform operations
- End-to-end encrypted voice calls using WebRTC SRTP (audio never recorded or stored)
While we take reasonable measures to protect your data, no system is completely secure. We cannot guarantee absolute security of data transmitted or stored through the Service.
9. Data Retention
We retain personal data only as long as necessary for the purposes described in this policy:
- Account data: Retained while your account is active. Deleted upon account deletion request, subject to legal retention obligations.
- Transaction and billing records: Retained for 7 years as required by Norwegian bookkeeping law (bokføringsloven).
- Direct messages: Retained while your account is active. When your account is deleted, message content is permanently anonymised and authorship disassociated.
- Voice call metadata: Retained alongside the associated conversation while both participants' accounts are active.
- Rate limiting data (truncated IPs): Purged within 24 hours.
- Session data: Expires after 7 days of inactivity.
- Audit logs: Retained for 1 year for security and compliance purposes.
11. Your Rights Under GDPR
Under the General Data Protection Regulation and Norwegian data protection law, you have the following rights:
- Right of access (Art. 15): Request a copy of the personal data we hold about you.
- Right to rectification (Art. 16): Request correction of inaccurate or incomplete data.
- Right to erasure (Art. 17): Request deletion of your personal data, subject to legal retention obligations.
- Right to restriction (Art. 18): Request restriction of processing in certain circumstances.
- Right to data portability (Art. 20): Request your data in a structured, machine-readable format.
- Right to object (Art. 21): Object to processing based on legitimate interest.
- Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
Exercising Your Rights
Many of these rights can be exercised directly from your account — no need to contact us:
- Download your data, restrict processing, object to processing, manage marketing consent: Settings → Privacy & Data tab.
- Correct your profile information (Art. 16): Settings → Profile tab
- Delete your account (Art. 17): Settings → Danger Zone tab
For rights not covered by in-app tools, contact us at privacy@beekeeper.bz. We will respond within 30 days as required by GDPR.
12. Data Breach Notification
In the event of a personal data breach, we will, where required by Article 33 GDPR, notify the Norwegian Data Protection Authority (Datatilsynet) within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to your rights and freedoms, we will notify affected data subjects without undue delay in accordance with Article 34 GDPR.
To report a suspected security vulnerability or incident, please contact security@beekeeper.bz immediately.
13. Right to Lodge a Complaint
If you believe that our processing of your personal data violates data protection law, you have the right to lodge a complaint with the relevant supervisory authority. For Norway, the supervisory authority is:
- Datatilsynet (Norwegian Data Protection Authority)
- Website: www.datatilsynet.no
- Email: postkasse@datatilsynet.no
We encourage you to contact us first at privacy@beekeeper.bz so that we can try to resolve your concern directly.
14. Children's Privacy
The Service is intended for use by businesses and professionals and is not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 18, we will delete it promptly.
15. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes via email at least 30 days before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.
16. Marketing Communications
Beekeeper may send you marketing or promotional emails only where you have given explicit opt-in consent (GDPR Art. 6(1)(a)). Marketing consent is off by default — we do not pre-tick consent boxes or treat registration as consent to marketing.
- Transactional emails (account verification, password resets, payout notifications, billing alerts, creator invitations) are sent on the basis of contract performance (Art. 6(1)(b)) and do not require separate marketing consent.
- Marketing emails (newsletters, product updates, promotional offers) are sent only if you have affirmatively opted in. You can manage this at any time via Settings → Privacy & Data → Marketing consent toggle, or by contacting privacy@beekeeper.bz.
- Consent withdrawal is effective immediately upon request and does not affect any processing lawfully carried out before withdrawal.
- No third-party marketing: We do not share your contact details with third parties for their marketing purposes, and we do not purchase marketing lists.
17. Performance Analytics and Profiling
Beekeeper provides merchants and creators with internal performance analytics — aggregated, campaign-level statistics about coupon issuance, redemption rates, conversion funnels, and creator commission performance.
What analytics we process
- Merchant analytics: Redemption counts, revenue attributed, campaign performance over time, creator leaderboard. Data is isolated per merchant.
- Creator analytics: Coupon issuance counts, redemption counts, earnings, and conversion rates for campaigns the creator participates in.
- No cross-platform profiling: We do not combine your data with third-party sources, build behavioral profiles for advertising, or share analytics data with advertising networks.
No third-party analytics tools
Beekeeper does not use Google Analytics, Mixpanel, Hotjar, Meta Pixel, or any other third-party analytics or advertising SDKs. All performance metrics are generated from first-party platform data, processed internally, and never shared with advertising technology companies.
You may object to internal analytics at any time via Settings → Privacy & Data → "Object to processing".
18. Contact
For privacy-related questions, data subject requests, or complaints:
- Data Controller: Risan Solutions (Org.nr 937 137 273)
- Address: Valenvegen 49, 3802 Bø i Telemark, Norway
- Privacy email: privacy@beekeeper.bz
- General: hello@beekeeper.bz
[URGENT].