BeeverForge

Legal

Privacy policy

Version 1.0 · October 27, 2026

1. Who is responsible

BeeverForge ("we") is responsible for the personal data described here. BeeverForge is based in Portugal and administered by Hermes Alves, who answers for the processing described here. You can reach us about privacy at contact@beeverforge.com.

This policy covers this website (beeverforge.com), the Enterprise inquiry form, and the Prototype Builder trial for companies — at app.beeverforge.com and at each company's own address under beeverforge.com — from the waitlist to the end of your company's trial.

2. What we collect, and why

On this website

  • Preferences. Your theme and cookie choices are stored in your own browser. They never reach us.
  • Analytics, only if you accept them. With your consent, Google Analytics measures visits and how the site is used. You can withdraw consent at any time through Cookie settings in the footer.
  • Enterprise inquiries. If you use the contact form, we receive your name, work email, company, topic and message, only to answer you.

The waitlist

  • Your company's name and the address it would like, your name, email, what you want to prototype, your language, and the date and fact of your consent.
  • Your email is confirmed by a link we send. Until you confirm it, we send nothing else.
  • Purpose: to consider your company's request, open its trial and write to you about it.

Your account in the trial

  • You sign in with your email address and a password you choose, or with GitHub. Of a password we keep only a salted hash, never the password itself; when you set one, we check it against known breaches through Have I Been Pwned, sending only the first five characters of a SHA-1 hash of it, never the password nor anything that names you. If you turn on two-step sign-in, we keep its secret, sealed, and your recovery codes as hashes. With GitHub, we keep only your verified email, your name and GitHub's identifier for your account, never your GitHub password.
  • If your company's admin invites you, we receive your email address from them, to send you the invitation.
  • We record which company account you belong to and whether you are its admin, the state of your invitation (invited, active, expired) and its dates, and which version of the terms you accepted and when.
  • A session cookie keeps you signed in. It is strictly necessary and is not used for anything else.

What you create in the trial

  • Your messages, the documents and images you upload, the prototypes, the builder's notes and the requirements generated from them. They belong to your company's account and its people, as the terms of use say.
  • Purpose: to run the trial for your company's account. When you choose to hand your requirements to BeeverForge, our team reads them to prepare a proposal.
  • Usage records — how many runs you made, how long they took and what they cost — without any of the content. Purpose: to apply the quota fairly and to understand the cost of the trial.

Security

  • To protect the trial against abuse (for example, automated sign-ups and repeated access attempts), we and our providers process your IP address and technical data about your browser, for rate limiting, a human-verification check (Cloudflare Turnstile) and firewall rules.
  • We keep an audit record of significant actions (an invitation, a sign-in, an acceptance, a deletion, a hand-over): who, when and what, never the content.

We are established in Portugal, so the EU General Data Protection Regulation (GDPR) and the Portuguese law that implements it apply; if you live elsewhere, your local law may give you further rights (for example, the LGPD in Brazil). We rely on:

  • your consent — for the waitlist contact and for analytics; you can withdraw it at any time, which does not affect the lawfulness of what was done before you withdrew it;
  • the performance of the terms you accept, or steps you ask us to take before them — to run the trial and prepare a proposal you ask for;
  • our legitimate interest — to keep the trial and its users secure and to prevent abuse;
  • legal obligations — where the law requires us to keep or disclose data.

To ask for the trial we need your name, your email address, your company's name, the address it wishes for and a few words (at least 10 characters) about what you want to prototype; without them we cannot consider the request. To use the trial, you sign in with your email address and a password, or with GitHub.

4. What we never do

We do not sell your data. We do not use your content to train AI models. We do not use it for advertising. We do not read your prototypes unless you hand your requirements to us or ask for our help.

5. Who processes your data for us

We use the following providers, each under contract and only for the purpose stated:

  • Our AI model provider (currently Anthropic) — receives what you write and upload, and the prototype's files, to generate the prototype and the requirements.
  • Amazon Web Services — hosts the trial and its data in the United States.
  • Resend — sends our emails (confirmation, invitation, password links, notices) and delivers Enterprise inquiries to us.
  • Cloudflare — the human-verification check on our forms (it sees your IP address and browser signals) and the service that receives Enterprise inquiries.
  • Google — website analytics, only if you consent.
  • GitHub — sign-in, if you choose GitHub; and the hosting of this website.

When you set a password, we also ask Have I Been Pwned, a public service we use without an account or a contract, whether it is a known breached one. It receives the first five characters of a SHA-1 hash of the password, from our server: no personal data.

6. International transfers

Our providers process data in the United States and possibly in other countries, outside the European Economic Area. We use only providers that are certified under the EU-U.S. Data Privacy Framework, which the European Commission has found adequate (GDPR article 45), or that are bound by the Commission's standard contractual clauses in their data processing terms (GDPR article 46). You can ask for a copy of these safeguards at contact@beeverforge.com.

7. How long we keep it

  • Unconfirmed waitlist entries: 7 days.
  • Waitlist and invitation records: 12 months after our last contact with you, or until you ask us to delete them.
  • The account's prototypes, uploads and requirements: 90 days after the last activity in your company's account, or sooner if they are deleted. If the company moves to the Business plan, they stay with its account.
  • Records of the terms you accepted: as long as we may need to show what you accepted.
  • Audit and usage records (no content): 2 years.
  • Security and server logs: 30 days.
  • Requirements you hand over to BeeverForge: for as long as the proposal and any project that follows need them.

8. Your rights

You can ask to access, correct or delete your data, to receive it in a portable format or have it sent to another provider, to know who we share it with, to withdraw your consent, to object to processing based on our legitimate interest and to ask us to restrict it. You can delete your account and everything in it at any time from your account page in the trial, or by writing to contact@beeverforge.com. You may also complain to a data protection authority — in Portugal, the Comissão Nacional de Proteção de Dados (CNPD), or the authority where you live.

9. Security

The trial runs behind a firewall, signs people in with a password (at least 12 characters, checked against known breaches when it is set, kept only as a salted hash) or with GitHub, offers two-step sign-in with an authenticator app — required for BeeverForge's team —, limits repeated attempts, keeps every run of the AI model in an isolated environment, encrypts data in transit, and keeps personal data out of its technical logs. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

10. Children

The trial is not meant for people under 18, and we do not knowingly collect their data.

11. Changes

Each version of this policy has a number and a date. If a change matters for how we use your data, we will tell you before it takes effect.