How we handle your data.

1. Who we are

Beamprobe ("Beamprobe", "we", "us", "our") is a service operated by Sandra Walczak, a sole trader based in the United Kingdom. We operate the website at beamprobe.com and the related virtual data room service.

Based in: Rochdale, England.
ICO registration: ZC167314, in the name of Sandra Walczak (sole trader), published on the ICO register of fee payers.
Data Protection contact: [email protected]

2. Scope

This policy explains what personal data Beamprobe collects, why, on what legal basis, where it is stored, who it is shared with, and your rights under UK GDPR and the Data Protection Act 2018.

It applies to:

• Visitors to the Beamprobe website
• Account holders ("Customers") who create rooms and upload documents
• End viewers ("Recipients") who access rooms shared by a Customer

3. Data we collect

3.1 From Customers (account holders)

• Account email and name
• Hashed password (bcrypt cost 12)
• Stripe customer ID and subscription metadata (no card numbers - we never see them)
• IP addresses on administrative actions (such as creating a room or link, or deleting a document), and on login when you choose to remember a device for two-factor authentication
• Logs of administrative activity

3.2 From Recipients (people accessing a room shared with them)

• Name and email when an NDA gate or email gate is enabled by the Customer
• IP address
• User-agent (browser identifier)
• Documents accessed, pages viewed, the order they were viewed in and dwell time per page
• Timestamp of each access event

3.3 From documents Customers upload

Beamprobe stores the documents Customers upload to their rooms. Each original file is AES-256-CBC encrypted with a unique random key before it is written to storage; the key is itself encrypted with S/MIME (AES-256, 4096-bit RSA) and the matching private key is held only by the Beamprobe application. Ciphertext is stored in Cloudflare R2 (EU jurisdiction).

To show documents in the viewer and make them searchable, we also:

• render each page as an image and store the page images in Cloudflare R2 (EU jurisdiction), where R2 encrypts them at rest (AES-256, keys managed by Cloudflare) and they are served through short-lived signed links;
• extract the text of each document (using OCR for scanned pages) and store it in our database, to power search, document summaries, Ask this room, the page names in reading summaries and request list suggestions.

We do not use document contents for anything other than providing the service to you.

End-to-end encrypted rooms. A Customer on a paid plan can choose to make a room end-to-end encrypted. Its documents and their names are then encrypted in the Customer's browser (AES-256-GCM) before upload, with a key Beamprobe never receives, and Recipients' browsers decrypt them with the key carried in their link. For those documents we store only the encrypted data, alongside other documents, and we cannot read, render, extract, summarise, search or scan them: none of the processing described above or in section 3.4 applies to them. We still process what is needed to run the room: Recipient details and reading activity as described in section 3.2, the number of documents with their sizes and page counts, and the room name. The room key is stored only locked with the Customer's passphrase, so we cannot restore access if both the passphrase and the recovery file are lost.

3.4 AI features, on our own hardware

Beamprobe's AI features (document summaries, Ask this room, the deck audit, the page names in reading summaries, request list suggestions, and the public Data Room Audit tool) run on a language model hosted on hardware Beamprobe operates itself in the United Kingdom. When a page has no text, its summary and page name may be read from an image of the page, on the same hardware. Document contents, including page images, are never sent to a third-party or cloud AI provider.

The AI server receives only:

• up to the first 16,000 characters of each uploaded document, to write its summary;
• the opening text of each page (up to 700 characters), to name what the page is about;
• an image of each page that has no readable text, for up to 20 such pages of a document, to name the page and describe what it shows (the description can be found through Ask this room, marked as written by AI), and images of the first three pages of a document with almost no text, to write its summary;
• the requests on a request list you add to a room, with the names, folders, page names and summaries of that room's documents, to suggest which documents answer each request;
• the passages relevant to a question asked in Ask this room, with the question;
• the text of a deck you choose to audit;
• whatever a visitor pastes into the public Data Room Audit tool.

It does not receive Recipients' names, email addresses, IP addresses or reading activity. Requests are kept briefly in the AI server's operational logs and are never used to train or fine-tune a model.

3.5 Cookies and analytics

See our Cookie Policy for the full list. Briefly: we use strictly necessary cookies only (session, CSRF). No third-party analytics, no advertising trackers.

4. Legal basis

Under UK GDPR Article 6, our legal bases are:

• Contract (Article 6(1)(b)) - to provide the service Customers subscribe to
• Legitimate interests (Article 6(1)(f)) - for security logging, fraud prevention, product improvement
• Legal obligation (Article 6(1)(c)) - to retain certain data for tax and audit purposes
• Consent (Article 6(1)(a)) - for any optional marketing communications

For Recipients accessing a Customer's room: the Customer is the data controller for the personal data captured at access; Beamprobe is the data processor acting on the Customer's instructions.

5. Where data is stored

Customer accounts, deal-room metadata, extracted document text and Recipient access logs are stored in a Postgres database on our application server, hosted by Hetzner in Helsinki, Finland. Original document files (as ciphertext) and page images (see 3.3) are stored in Cloudflare R2 (EU jurisdiction). Backups remain in the EU. AI processing (see 3.4) takes place on Beamprobe's own server in the United Kingdom. We do not transfer data outside the United Kingdom or EEA.

Email is delivered via an EU-region email provider (currently Resend, EU endpoint).

Stripe processes payments. Stripe stores card data on Stripe's infrastructure under their own DPA; we never store or transmit raw card numbers.

6. Who we share with

We share personal data only with:

• Sub-processors as listed in our Data Processing Agreement - currently Cloudflare R2 (document storage, EU jurisdiction), Hetzner (application server and database, Finland), Stripe (billing), Resend (transactional email)
• Law enforcement where compelled by valid UK or EU legal process
• Successor entity in the event of a merger, acquisition, or asset sale, with notice to affected Customers

We do not sell personal data. We do not share personal data with advertisers. We do not run advertising on Beamprobe. We do not send document contents to any third-party AI provider.

7. Retention

• Customer account data: retained while subscription is active, plus 30 days after cancellation
• Document files: deleted within 30 days of room deletion or subscription cancellation
• Recipient access logs: retained for the duration the Customer's account is active, exportable to CSV by the Customer at any time
• NDA acceptance records: retained for 6 years after the room or link is deleted (UK statute of limitations for contract claims), or until the account is erased if that comes first
• Billing records: retained for 7 years (UK tax law)

8. Your rights

Under UK GDPR you have the right to:

• Access - request a copy of your personal data
• Rectification - correct inaccurate data
• Erasure - request deletion ("right to be forgotten") subject to lawful retention requirements above
• Restrict processing - request we limit how we process your data
• Portability - receive your data in a structured, machine-readable format
• Object - to processing based on legitimate interests
• Withdraw consent - where processing is based on consent
• Complain to the ICO - at ico.org.uk if you believe we have mishandled your data

To exercise any of these, email [email protected]. We respond within 30 days, usually faster.

9. Security

• Encryption in transit: TLS 1.2+ enforced. HSTS preload.
• Encryption at rest: every original document AES-256-CBC encrypted with a unique random key (envelope scheme); per-file key encrypted with S/MIME (AES-256, 4096-bit RSA), private key held only by the application. Page images are encrypted at rest by Cloudflare R2. The database accepts connections only from the application on the same server.
• Optional end-to-end encrypted rooms: documents and their names are encrypted in the browser with a key Beamprobe never receives (see section 3.3).
• Authentication: bcrypt password hashing (cost 12). Optional sign-in with Google or with a Microsoft work or school account.
• Access controls: principle of least privilege. Production access restricted to named engineers.
• Audit logging: every administrative action logged.
• Backups: daily, encrypted, retained 30 days.

10. Breach notification

In the event of a personal data breach affecting Customer data, we will:

• Notify the ICO within 72 hours of becoming aware (UK GDPR Article 33)
• Notify affected Customers without undue delay where there is a likely high risk to rights and freedoms
• Document the breach in our internal breach register
• Provide affected Customers with the information required to comply with their own notification obligations

11. Children

Beamprobe is not intended for use by anyone under 18. We do not knowingly collect data from children. If you believe we have collected data from a child, contact [email protected] and we will delete it.

12. Changes

We may update this policy. Material changes will be notified to Customers by email at least 30 days before they take effect. The "Last updated" date at the top of this page shows the current version date.

13. Contact

Privacy and data protection: [email protected]
Security: [email protected]
General: [email protected]

Postal address available on written request to the email above.

14. Supervisory authority

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom
ico.org.uk · 0303 123 1113