Privacy Policy

Version 1.5 – 19 October 2026

Changes in this version apply to existing accounts from 18 November 2026.

InitLabs B.V., trading under the name beebeeb.io, attaches great importance to your privacy. This privacy policy explains which personal data we process, for what purpose, on what legal basis, and which rights you have. This policy has been drawn up in accordance with the General Data Protection Regulation (GDPR) and the Dutch GDPR Implementation Act.

The core of beebeeb.io is a Zero-Knowledge Architecture. This means that the content of your files is encrypted on your device before it reaches our servers. We have no technical access to your files or to the keys that would allow them to be decrypted. This fundamentally limits which personal data we can process at all.

1. Controller

The controller for the processing of personal data via the beebeeb.io service is:

• InitLabs B.V., trading under the name beebeeb.io
• Registered address: Kelvinstraat 34A, 6601 HE Wijchen, Netherlands
• KvK number: 95157565
• Email for privacy matters: privacy@beebeeb.io
• General contact: hello@beebeeb.io

We have assessed whether we are required to appoint a Data Protection Officer (DPO) under Article 37 GDPR. At present this is not the case. Privacy enquiries are handled by our internal privacy contact, available via privacy@beebeeb.io.

2. Which personal data we process

Due to our Zero-Knowledge Architecture, the amount of personal data we process is intentionally limited. We process the following categories:

2.1 Account and registration data

• Name (if you choose to provide it)
• Email address
• OPAQUE registration record for your password (sign-in uses the OPAQUE protocol, so your password itself is never sent to us and cannot be read from this record)
• Optionally: organisation, billing address, VAT number (business users)

2.2 Payment and billing data

• Name, billing address, VAT number
• Transaction data (date, amount, subscription type)
• Payment data (such as a reference to a payment method and, for a recurring mandate, the card label, the masked card number and the expiry date, or the last four digits of an IBAN); the full payment data (card number, IBAN mandates) is entered on the hosted payment page of our payment service provider Mollie and is not stored by us. See section 4 for an explanation of Mollie's role.
• Free-trial check: a keyed one-way hash of the fingerprint of the card, or of the IBAN, used to start a free trial. We keep only this hash, not the card fingerprint or IBAN itself, and use it only to enforce one free trial per payment method.

2.3 Technical and usage data

• IP address (truncated/masked, stored for at most the duration set out in section 5)
• Login and logout timestamps
• Device type, operating system and browser (user agent)
• Error and diagnostic data (anonymised where possible)
• Volume of encrypted data stored (in bytes; not the content)
• Email delivery log: recipient address, type of email, subject line, and delivery status and time (never the message body; stored for at most the duration set out in section 5)

2.4 Analytics data (Matomo)

We use a self-hosted Matomo installation within the European Economic Area (EEA) to obtain aggregated insights into the use of our website and Service, to improve performance and to detect issues. Because the Matomo installation runs in our own infrastructure within the EEA, no analytics data is shared with third parties.

Through Matomo we process, among other things:

• Pages visited and the order of visits
• Referring URL (referrer)
• Anonymised IP address (last octet(s) removed before storage)
• Browser type, operating system, language preference and screen resolution
• Time and duration of visit
• Click behaviour and on-page interactions

Matomo is configured by us so that:

• IP addresses are anonymised before storage (privacy-by-design);
• Where possible, we use the cookieless mode;
• "Do Not Track" signals from browsers are respected;
• Data is not shared with third parties or used for advertising purposes.

If Matomo is configured to use cookies or any other optional identifier, you can opt out or withdraw consent through the cookie preference control provided on our website.

2.5 Repeat-offer check (free trials, allowances, gift links)

What we keep. When a free trial, a free storage allowance or a gift link is claimed, we keep a keyed one-way hash of the mailbox it was claimed for, together with the dates of the claim. The key stays on our servers, and we do not store the email address in this record. Why. To stop the same mailbox claiming the same free offer again and again, for example by deleting an account and signing up anew. Legal basis. Legitimate interest (Art. 6.1.f GDPR): preventing abuse of free offers. How long. Twelve (12) months after the claim, also after the account has been deleted; then the record is deleted automatically. What it is not. It is not linked to your files and tells us nothing about what you store. You can see the records tied to your account in your data export (a short prefix of the hash and the dates, never the full hash), and you can object to this processing under section 7.

2.6 What we do not process

We have no access to:

• The content of your files (text, photos, documents, video, etc.)
• Your encryption keys or passwords in readable form
• File names or folder structures, where these are encrypted client-side

3. Purposes and legal bases

We process your personal data for the following purposes, with the corresponding legal basis under Article 6 GDPR:

4. Transfers and (sub-)processors

beebeeb.io uses a limited number of (sub-)processors and external service providers to deliver the Service. An up-to-date list is available at beebeeb.io/sub-processors.

At the time of publication, this includes Mollie B.V., located in Amsterdam, the Netherlands (EEA). See below for Mollie's role. A legacy administrative path to our former payment provider, Stripe Payments Europe Ltd. (Ireland, EEA, with parent company Stripe, Inc. in the United States), was disabled on 24 September 2026; this is disclosed at the end of this section.

Personal data is in principle processed exclusively within the European Economic Area (EEA). If transfers outside the EEA are unavoidable, they will only take place on the basis of an appropriate safeguard pursuant to Chapter V GDPR (such as Standard Contractual Clauses adopted by the European Commission).

Special position of Mollie

Mollie B.V. (Amsterdam, the Netherlands) is our payment service provider. Mollie is licensed and registered as an electronic money institution with the Dutch Central Bank under relationship number F0038. Mollie has a dual role within the meaning of the GDPR:

• As a processor (Article 28 GDPR) for processing payments that you initiate via beebeeb.io, on our instructions.
• As an independent controller (Article 4(7) GDPR) for its own legal obligations regarding fraud and identity screening, anti-money laundering legislation (AML / AMLD), sanctions screening, and compliance with payment regulations (including PSD2). For these purposes, Mollie determines the means and purposes of processing itself.

Payment pages are hosted by Mollie. When you pay, you are redirected from beebeeb.io to Mollie's own payment page and returned to beebeeb.io afterwards. No payment provider script and no payment provider cookie runs on beebeeb.io.

To create a payment we send Mollie your name, your email address, the amount and a description of the subscription. What Mollie returns to us is the payment status and, for a recurring subscription, a summary of the mandate you gave it (as described in section 2.2). We never receive your full card number, and we never store your full IBAN; for the free-trial check we keep only a keyed one-way hash of the card fingerprint or IBAN (see section 2.2).

This processing takes place on the basis of the performance of our agreement with you (Article 6.1.b GDPR) and, for fraud prevention, on the legitimate interest of Mollie and of us and on the legal obligations under which Mollie operates. The part for which Mollie acts as an independent controller falls under Mollie's own privacy statement, and we are not in a position to impose contractual restrictions on it.

Mollie processes personal data within the European Economic Area by default. Mollie states that where personal data is processed outside the EEA it applies an appropriate transfer mechanism such as Standard Contractual Clauses. Mollie also discloses that it shares personal data with Ekata by Mastercard for fraud and identity screening during business onboarding; that concerns our data as a merchant, not your payment data. For more information, please refer to Mollie's privacy statement at mollie.com/legal/privacy.

What we cannot make European. If you pay by card, the card networks (Visa, Mastercard, American Express) and the issuing and acquiring banks are unavoidably part of the authorisation path, and those networks are established outside the EEA. No European payment provider changes this. If you pay by iDEAL or SEPA Direct Debit, the entire payment chain stays within Europe.

Legacy Stripe path. Stripe Payments Europe Ltd. (Ireland, EEA) was our payment service provider until 30 August 2026 and is no longer used for checkout or for updating your payment method. One legacy internal path, not part of our web, mobile or desktop apps, has not received any data since 24 September 2026, when it was disabled.

5. Retention periods

We do not retain personal data longer than necessary for the purposes for which it was collected, or to comply with legal obligations:

• Account and registration data: up to thirty (30) days after termination of the account; thereafter deleted or anonymised.
• Encrypted content: up to thirty (30) days after termination of the account; thereafter irretrievably deleted.
• Accounts whose trial or plan ended without payment: the account becomes read-only, and its encrypted content and account data are deleted fourteen (14) days after the trial ended if the account has never made a successful payment, or sixty (60) days after the trial or plan ended if it has paid before or its free period came from a gift link, unless you take out a subscription before then. Payment and billing data are kept for the statutory period below.
• Free-trial check (hash of the card fingerprint or IBAN): for as long as needed to enforce one free trial per payment method, also after the account has been deleted.
• Repeat-offer check (keyed hash of the mailbox and claim dates): twelve (12) months after the claim, also after the account has been deleted, then deleted automatically.
• Payment and billing data: seven (7) years, pursuant to Article 52 of the Dutch General Tax Act.
• IP addresses and login logs: in principle a maximum of thirty (30) days, unless longer retention is necessary for the investigation of abuse or security incidents (in which case up to twelve (12) months).
• Email delivery log (recipient, type, subject, delivery status): twelve (12) months, or until the account is deleted.
• Matomo analytics data: at most twenty-four (24) months, then automatically deleted or aggregated.
• Customer service communication: up to twenty-four (24) months after the last contact.
• Anonymised usage data: may be retained indefinitely for analysis and product improvement.

6. Security

We take appropriate technical and organisational measures to protect your personal data against loss or unlawful processing, including:

• Client-side encryption of file content (Zero-Knowledge)
• Encryption of data in transit (TLS 1.3) and at rest (AES-256)
• Strict role-based access control for our system administrators, including logging and auditing
• Password sign-in via the OPAQUE protocol, so user passwords never leave the user's device, with Argon2id key stretching
• Regular vulnerability scans; internal security review, with an external penetration test planned
• Secure software development, including code review and dependency scanning
• Geographically distributed backups of encrypted data within the EEA
• Incident response procedure compliant with Articles 33 and 34 GDPR

7. Your rights

Under the GDPR you have the following rights regarding your personal data:

• Access (Art. 15): the right to obtain a copy of the personal data we process about you.
• Rectification (Art. 16): the right to have inaccurate or incomplete data corrected.
• Erasure (Art. 17): the right to have your data deleted, subject to legal retention obligations.
• Restriction (Art. 18): the right to have processing temporarily restricted.
• Objection (Art. 21): the right to object to processing based on legitimate interest.
• Data portability (Art. 20): the right to receive your data in a structured, commonly used and machine-readable format.
• Not to be subject to automated decision-making (Art. 22): we ourselves do not engage in automated decision-making with legal effects. Mollie does apply automated screening to payments in the context of fraud prevention and anti-money laundering compliance; please refer to Mollie's privacy statement for your rights in that context.

You may submit requests to privacy@beebeeb.io. We respond within one (1) month, with a possible extension of two (2) months for complex or multiple requests. To verify your identity, we may ask for additional information.

Important: due to the Zero-Knowledge Architecture, we cannot provide access to the content of your files because we ourselves cannot read it. You can export your files yourself at any time via your account.

8. Complaints

If you have complaints about how we handle your personal data, please first contact us at privacy@beebeeb.io. We strive to resolve every complaint amicably.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), the supervisory authority in the Netherlands: www.autoriteitpersoonsgegevens.nl. If you are based in another EU member state, you may also lodge your complaint with your local supervisory authority.

9. Cookies and similar technologies

beebeeb.io uses a minimal number of cookies and similar technologies. We do not place tracking or advertising cookies. We distinguish:

• Functional cookies (no consent required): necessary for the basic operation of the Service, such as session cookies and cookies for authentication and language preference.
• Security cookies (no consent required): necessary for fraud prevention, brute-force protection and CSRF protection.
• Analytics via Matomo: in cookieless mode where possible. If Matomo places cookies, we will explicitly request your consent via a cookie banner. Anonymised IP addresses and respect for "Do Not Track" are configured by default.
• Payment pages: payments take place on the hosted payment page of our payment service provider, on that provider's own domain. No payment provider cookie or script is placed on beebeeb.io. Any cookie set during the payment step is set by Mollie on Mollie's own domain and falls under Mollie's cookie policy.

A current overview of placed cookies is available in our Cookie Statement at beebeeb.io/cookies.

10. Requests from government authorities

beebeeb.io occasionally receives requests from Dutch and foreign government authorities for the disclosure of data. We assess every request legally and only honour lawful requests based on applicable Dutch and European law.

Due to our Zero-Knowledge Architecture, we cannot provide unencrypted content because we cannot read it ourselves. We can only provide account and billing data, technical metadata, and encrypted content as stored by us.

To the extent legally permitted, we inform you of requests relating to your data. We periodically publish a transparency report with aggregated information on requests received.

11. Changes

We may amend this privacy policy from time to time, for example in case of changes to our services or applicable legislation. The most recent version is always available at beebeeb.io/privacy. Material changes will be announced via email or within the Service, at least thirty (30) days before they take effect.

12. Contact

Do you have questions about this privacy policy or about how we handle your personal data? Please contact us at privacy@beebeeb.io or by post at the registered address mentioned above.

— End of Privacy Policy —