Who is responsible
Beamfar is operated by CRM LR S.R.L., Sat Câmpani nr. 225, 417140 Comuna Câmpani, județul Bihor, Romania, registration number J2019001334052.
We decide why and how the personal data of our own customers and visitors is used (we are the controller). For the data an agency monitors for its own clients, the agency is the controller and we are its processor (see the data processing agreement). Write to the contact address in the imprint about anything on this page.
What data we keep, why, and on which legal basis
- Your account
- E-mail address, password hash or the sign-in method you use, second-factor data (encrypted), when you confirmed the terms. To give you the service (contract) and keep it secure (legitimate interest).
- Google or GitHub sign-in
- Only the provider’s name, its id for you and the verified e-mail address it reports. Never your password there, your profile, your contacts or the provider’s access tokens. Contract.
- Sessions and security
- Session records, the device summary of a session, rate-limit counters (one-way hashes), an audit log with network prefixes, not full addresses. Legitimate interest in keeping accounts safe.
- Organisations
- Names, members and roles, invitations, the plan, the setup-list preferences of each member, and at most four short labels about the link that brought the organisation (for example “newsletter”): never a page address or an identifier. Contract; the labels: legitimate interest.
- Billing
- What our payment provider reports: customer and subscription ids, plan, invoices and amounts, refunds and disputes. Contract and legal obligation (accounting).
- Who pays and the invoices
- Before the first payment an owner says who pays. For a business: its name, address and VAT or tax number, and the answer of the EU’s VIES service when we check that number. For an individual: name and address only; we do not ask for a personal identification number (CNP) or a date of birth. The invoices and credit notes we issue with those details (number, date, amounts, VAT, the link to the PDF), and a withdrawal from the contract (when it reached us, the refund). Legal obligation (accounting, VAT and RO e-Factura) and contract.
- Support and reports
- What you write to support (in the app or the contact form) and the address you give for the reply; reports of illegal content on hosted pages, with the reporter’s name and address, which are never shown to the owner of the reported page. Contract, legitimate interest, and our legal obligation to handle reports.
- E-mail choices
- Whether you receive the optional monthly report e-mail (on until you turn it off) and the weekly client risk digest (off until you turn it on).
- Monitoring data
- The sites, checks, results, incidents, alert addresses, status pages and deploy events your organisation sets up: processed for the agency under the data processing agreement.
The free site check
The “Check a site now” page needs no account. The web address you enter is sent to our server, used for one check, and is not stored and not logged; there is no link to the result. The only records are rate-limit counters: counts per network range and overall totals, each keyed by a one-way hash and kept for at most two days. They never hold the address of a site. The site you check sees a few requests from our probe (the page, each redirect hop and robots.txt), and only the standard web ports 80 and 443 are used. The page sets no cookie.
Where a visit came from
When an organisation is created, we keep at most four short labels about the link that brought the visit: the utm_source, utm_medium and utm_campaign of the link and the host of the referring website. They travel only in the sign-up link and the app’s memory, never in your browser’s storage; they are stored once with it, never the address of a page or an identifier, removed when the organisation is deleted, and not shared and not sold.
Public records we look up to explain an incident
To show the likely cause of an incident, the service looks up public records about the monitored sites: the domain’s registration (the registries’ RDAP services), the network of the site’s address (RIPEstat, run by the RIPE NCC in the Netherlands), internet outage signals for a network or a country (IODA, in the United States) and the public status pages of hosting providers. Only host names, addresses and network numbers of the monitored sites are sent; nothing about people.
Beam, the help assistant
The “Ask Beam” button answers questions about the service from our own pages. Your question is sent to our server, answered and not stored: the conversation stays in your browser tab and is gone when you close it. The only records are rate-limit counters (counts per network range, keyed by a one-way hash, kept for at most two days) and a cost ledger without any text. Ask Beam is an assistant, not a person: when the operator has switched a language model on it is an AI assistant, answers can be wrong, and the panel says so under its title from the moment it opens. By default no language model is involved and nothing you type leaves our servers. If the operator switches one on, your question and the matching pages of this website go to the model’s provider, after e-mail addresses, keys, card-like numbers and web addresses in your question have been replaced; the provider’s own terms on retention and training apply, and the final list names it. Please do not type passwords or personal data. Signed in, the assistant reads your own organisation’s monitoring data, read only, and with a model switched on that data is sent to the provider for the question you ask. It is not on the public status pages of our customers’ clients: the people who read those pages are never asked anything and nothing about their visits reaches a model provider. Nothing is sent to a person unless you choose “Send a message to a person”, read what will be sent, tick the box and press Send.
How long we keep it
- A deleted account: removed after 14 days. A deleted organisation: removed after 14 days.
- To stop one person from taking the free trial again with another account, when a trial starts we keep a one-way, keyed code made from the e-mail address (ignoring +tags, and dots in Gmail addresses) and from any linked Google or GitHub sign-in, never the address itself, for 12 months, also after the account is deleted (legitimate interest: preventing abuse of the free offer).
- After a plan ends: the organisation’s data is kept 60 days, with e-mails to the owners 14 and 3 days before it is deleted (an organisation that goes back to the Free plan keeps its data).
- Ended sessions: 90 days. Used e-mail links: 30 days. Sent account e-mails: 90 days. Data exports: 24 hours or one download.
- Monitoring history: as long as the plan’s history window, at least the last 100 days. Deploy events: 400 days.
- Invoices and credit notes we issue, and withdrawal records: 5 years from 1 July of the year after the financial year they belong to (Romanian accounting law), then deleted. Other billing records (what the payment provider reports): at least as long. The name, address and tax number on an invoice stay on it for that time, also after the organisation is deleted.
- Who pays (the billing details an owner gives): until the organisation is deleted.
- The audit log: 2 years. Closed support requests and reports: 1 year after they are closed.
- Backups: an encrypted copy of the database every night, kept 30 days; what is deleted from the service is gone from the backups 30 days later.
Who else processes it
None of these is used yet; the final list names each one and where it keeps the data.
- Hosting
- Hetzner Online GmbH, a German company: the servers and the database in Falkenstein, Germany, and the second checking location in Helsinki, Finland.
- Payments
- Stripe: takes your payment details on its own page; the merchant of record may be Stripe’s US company Link, LLC. Data may go to the United States.
- Invoicing
- Oblio (oblio.eu), a Romanian invoicing service: issues the invoices and credit notes in our name and sends the Romanian ones to RO e-Factura. It receives who pays (name, address, the VAT or tax number of a business), the plan and the amounts; never card details. Data kept in the EU (to be confirmed).
- E-mail delivery
- Resend: delivers account, billing, alert and support e-mails. A US company.
- DNS, network and backups
- Cloudflare: name servers, the network in front of the service if we use it, and the storage of the nightly backups, which are encrypted with our own key before they leave our server and kept in Cloudflare’s EU jurisdiction. A US company with EU data centres.
- AI assistant
- Anthropic, only if the operator switches Beam’s language model on (it is not on yet): answers the questions you ask the assistant. On this website that is your question, with e-mail addresses, keys, card-like numbers and web addresses replaced, and the matching help pages; in the app it is also what the assistant’s read-only tools return about your organisation (sites, clients, statuses, incidents, the likely cause of an incident, security results). Nothing about the people who read a client’s public status page. A US company; the data goes to the United States.
Transfers to the United States rely on the EU-US Data Privacy Framework where the company is certified, or on the European Commission’s standard contractual clauses (to be confirmed per company).
Two public bodies receive data because the law requires it; they are not our processors. The Romanian tax administration (ANAF) receives, through RO e-Factura, the invoices of customers in Romania, with the buyer’s name and address. The European Commission’s VIES service receives the VAT number a business gives, to confirm it with the tax administration of its country.
Your rights
You can ask for access, correction, deletion, restriction, objection and a copy in a portable format. Built into the app: download your account’s data, export an organisation’s data, delete your account or an organisation, turn optional e-mails off. For anything else, write to us; we answer within one month.
E-mails we send
Account, security, billing and support e-mails, which the service needs. Two optional ones: the monthly report notice (on until you turn it off) and the weekly client risk digest (off until you turn it on); each has a one-click unsubscribe. No marketing e-mail without your consent.
Children
The service is for people of 18 or older, buying for themselves or for a business. We do not knowingly collect data about children.
Complaints
You can complain to the Romanian supervisory authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP), or to the authority of the country where you live or work.