Parties
Beamfar is operated by CRM LR S.R.L., Sat Câmpani nr. 225, 417140 Comuna Câmpani, județul Bihor, Romania, registration number J2019001334052.
The customer (the agency or business that holds the organisation) is the controller of the personal data it asks the service to process; the operator named above is the processor. This agreement forms part of the terms of service.
Subject matter, duration, nature and purpose
Monitoring the customer’s websites, explaining incidents, publishing the customer’s status pages and sending its alerts and reports, for as long as the customer’s subscription runs and the period after it in the section on deletion.
Types of personal data and data subjects
Alert e-mail addresses and webhook destinations (which may belong to the customer’s clients and their staff); names or details in monitored URLs or request headers if the customer puts them there; the names and logins of the people who appear in deploy events the customer connects (GitHub, Netlify, Vercel); what the customer publishes on status pages; the customer’s team members’ accounts.
Documented instructions (Art. 28(3)(a))
We process the data only to provide the service the customer configures, and on its other documented instructions, unless the law requires otherwise; then we tell the customer first unless that law forbids it.
Confidentiality (b)
Only people who need it to run or support the service have access, and each is bound to confidentiality.
Security (c)
Measures built today: passwords hashed with Argon2id; a second factor for owners and admins; second-factor and webhook secrets encrypted; every organisation’s data kept apart by row-level security in the database; secret request headers stored apart and never shown again; an audit log; outbound requests limited to public addresses. The final text describes them as Article 32 of the GDPR requires.
Sub-processors (d)
The customer gives a general authorisation for the sub-processors below. We tell the owners by e-mail at least 30 days before we add or replace one; the customer can object, and if we cannot meet the objection it can end the subscription with a refund of the unused prepaid period. Each sub-processor is bound by the same data protection obligations. None of them is contracted yet.
- Hetzner Online GmbH
- Hosting of all service data: the servers and the database in Falkenstein, Germany; the second checking location in Helsinki, Finland. Germany (EU).
- Resend
- Alert, report and account e-mails: the recipient’s address and the message. United States.
- Cloudflare
- DNS answers; if used in front of the service, the requests to it, including IP addresses; and the storage of the nightly backups, encrypted with our own key before they leave our server and kept in its EU jurisdiction. United States, with EU data centres.
- Anthropic
- Only if the operator switches the in-app assistant’s language model on (it is not on yet): the member’s question and what the assistant’s read-only tools return for it (site and client names, host names, statuses, incidents with their evidence, the likely cause of an incident, security scan results, report figures); never passwords, keys, billing data, the member list or alert addresses. The assistant on the public website does not process customers’ data. United States.
- Stripe
- Only the customer’s own billing data, for which we are controller: not a sub-processor for the monitored data.
Not sub-processors: the public sources the service queries to explain incidents (domain registries, RIPEstat, IODA, providers’ status pages). Only host names, addresses and network numbers of the monitored sites are sent to them.
Transfers outside the EU
Only to the sub-processors listed above, under the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses (to be confirmed per company).
Helping with data-subject requests (e)
The customer exports, corrects and deletes its organisation’s data in the app. A request that reaches us about the customer’s data is passed to the customer without undue delay; we do not answer it ourselves.
Security incidents, breaches and impact assessments (f)
We tell the customer without undue delay after we become aware of a personal data breach affecting its data (target: within 48 hours), with what is known then: what happened, which data and people may be affected, what we have done, and a contact. We add the rest as we learn it and help with the customer’s notifications and impact assessments.
Deletion or return at the end (g)
The customer can export its data at any time. When the subscription ends, the data is kept 60 days and then deleted, after e-mails to the owners 14 and 3 days before (unless the organisation goes back to the Free plan, which keeps it); when the customer deletes the organisation, its data is deleted after 14 days. What the law requires us to keep (invoices and billing records) is kept for that period only.
Audits and information (h)
We make available the information needed to show compliance with this agreement (security description, sub-processor list, audit summaries) and allow audits by the customer or an auditor it mandates, with reasonable notice and confidentiality.