Privacy Policy

This Policy explains how the Operator of Betty processes personal data relating to the betty.management site, the access request form, and the Betty CRM. The Operator is the entity identified at the top of this document, under the heading “Identification of the Operator”; the contact addresses shown there are the valid ones for everything set out here.

This Policy forms part of the Terms of Service. The processing of the data a customer stores in its workspace is additionally governed by the Data Processing Addendum.

1. Two distinct roles, and why they matter

The Operator acts in two different capacities, with different consequences for the reader:

1.1. As controller. For the data of those who submit the access request form, the data of CRM user accounts, the technical logs of the infrastructure, and the emails sent to us, the Operator determines the purposes and means. Sections 3 to 12 describe that processing.

1.2. As processor. For the records a customer stores in its workspace — people, companies, opportunities, notes, tasks, and files — the customer is the controller: it decides what data it enters, for what purpose, and on what legal basis. The Operator processes that data only on the customer’s instructions, on the terms of the Data Processing Addendum. If you are a person whose data appears in the workspace of a Betty customer and you wish to exercise your rights, your counterpart is that customer; if you write to us, we will tell you so and pass your request on without delay, as set out in section 13.7.

2. Rules we apply

We apply Regulation (EU) 2016/679 (GDPR) and, depending on each person’s residence, the UK GDPR and the UK Data Protection Act 2018; the California CCPA as amended by the CPRA and its regulations, together with the other US state consumer privacy laws that apply; Colombia’s Ley 1581 de 2012 and Decreto 1377 de 2013; Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties published on 20 March 2025; Brazil’s Lei 13.709 (LGPD); Argentina’s Ley 25.326; in Chile, Ley 19.628 and Ley 21.719 from the date it comes into force; and Peru’s Ley 29733 with its regulation approved by Decreto Supremo 016-2024-JUS.

Where one of those rules grants a right or imposes a safeguard more protective than the others, we apply the more protective one to the person concerned.

3. Access request form

What we collect. Name, work email address, company (optional), the consent checkbox marking, and the date and time of receipt.

Why. To answer the request, assess whether to send a beta invitation, and keep a record of the consent given.

Legal basis. The consent of the person submitting the form, Article 6(1)(a) GDPR. The record of the consent itself and of its date is kept on the basis of the Operator’s legitimate interest in being able to demonstrate that the communication was requested, Article 6(1)(f).

Where it ends up. The request is stored as a person record and an associated note in the Operator’s own workspace within the Betty CRM. It is not published, not shared with third parties, and not added to any marketing list.

How long we keep it. Up to twenty-four (24) months from the last contact relating to the request, or until the person withdraws consent, whichever is earlier. If the request becomes an account, the data is then governed by section 4.

If not provided. Name, email, and consent are necessary in order to reply; without them we cannot process the request. Company is optional.

4. CRM accounts

What we collect. Name, email address, password stored using a cryptographic hash function, role within the workspace, and the identifier of the workspace to which the account belongs.

Why. To create and authenticate the account, apply the permissions attached to the role, send the essential emails of the service, and handle support requested from us.

Legal basis. Performance of the service contract, Article 6(1)(b) GDPR. Where the account belongs to a customer entity and the user is its employee or contractor, the Operator’s basis remains contractual in respect of the account holder, and the relationship between that entity and the individual is governed by the entity’s own rules.

How long we keep it. For as long as the account is active. After termination, it is deleted under clause 13.5 of the Terms: thirty (30) calendar days in active systems and up to ninety (90) calendar days in backups, which are overwritten in the ordinary retention cycle.

5. Data customers store in their workspace

What it contains. People, companies, opportunities, notes, tasks, and attachments, with whatever content each customer decides to enter.

Our role. Processor. We process that data only to host and operate the service, handle support the customer requests, maintain security, and answer the queries the customer or its authorised artificial intelligence client submits through the MCP connector.

Legal basis. The one determined by the customer as controller. The Operator establishes no legal basis of its own for this data.

What we do not do. We do not use this data to train our own or third-party artificial intelligence models, we do not use it for advertising, we do not sell it, we do not transfer it to third parties for their own use, and we do not consult it for purposes unrelated to providing the service.

How long we keep it. As the customer decides, and in any event subject to the exit and deletion periods in clause 13 of the Terms and clause 14 of the Data Processing Addendum.

6. Transactional email

What we send. Beta invitations, email address verification, password resets, and essential notices about the service, security, or changes to these documents.

What is processed. The recipient’s name and email address, and the delivery metadata generated by the sending provider.

Legal basis. Performance of the contract, Article 6(1)(b), for the essential emails of the service; and compliance with legal obligations, Article 6(1)(c), for notices required by law.

How it is sent. Using Amazon Simple Email Service in the Ireland region (eu-west-1).

Marketing communications. We do not send newsletters or automated marketing communications. If any were offered in future, they would require specific acceptance and would carry an unsubscribe link in every message.

7. Technical logs

What they contain. Application and infrastructure logs: timestamp, request identifier, path, response code, error messages, the account or workspace identifier where the request is authenticated, and IP address.

Why. To detect and diagnose faults, investigate security incidents, prevent abuse, and evidence the operation of the service.

Legal basis. The Operator’s legitimate interest in the security and continuity of the service, Article 6(1)(f) GDPR. We have weighed that interest against the rights of those affected: the logs are minimal, access is restricted, they are not used to profile anyone, and retention is short.

How long we keep them. Thirty (30) days as a rule. If a log is needed to investigate a specific incident, it is kept in isolation until the investigation closes and, where relevant, until any resulting claims are time-barred.

Where. Amazon CloudWatch, in the Ireland region (eu-west-1).

8. Communications you send us

If you write to any of our contact addresses, we process your address, your message, and any attachments in order to deal with the enquiry, on the basis of our legitimate interest in replying to those who write to us or, where the enquiry is the exercise of a right, on the basis of compliance with the corresponding legal obligation. We keep that correspondence for twenty-four (24) months from the closing of the matter, and files on the exercise of rights for as long as we must be able to demonstrate that we replied.

9. Where the data lives

All CRM infrastructure is in Amazon Web Services, Europe (Ireland) region, eu-west-1:

The public betty.management site and the function that receives the access request form run on the Vercel platform. The form writes directly into the Operator’s workspace in the CRM hosted in Ireland; Vercel plays no part in processing the data customers store in their workspaces.

10. Who receives the data

10.1. Subprocessors. The full list of subprocessors, with their purpose, location, and the applicable transfer mechanism, is in Annex III to the Data Processing Addendum. On the effective date of this Policy they are Amazon Web Services, Amazon SES, and Vercel.

10.2. Artificial intelligence providers. OpenAI and Anthropic are not subprocessors of the Operator. They are the customer’s own providers, contracted directly by the customer and under their own terms. Section 11 explains how this works.

10.3. Advisers and authorities. We may disclose data to legal or accounting advisers bound by a duty of confidentiality where necessary to defend our rights, and to competent authorities where a legal rule or a decision obliges us. In the latter case we inform the person or customer concerned, unless the law prohibits it.

10.4. What does not happen. We do not sell personal data. We do not “share” it for cross-context behavioural advertising within the meaning of the CCPA. We use no advertising networks, no third-party analytics, and no measurement tools on the site or in the application.

11. The MCP connector and artificial intelligence clients

11.1. Betty can be used from the customer’s own ChatGPT or Claude, through a connector implementing the Model Context Protocol. The connection does not exist until the customer expressly authorises it by OAuth and chooses the scope of access.

11.2. When the customer submits a query from that environment, the connector returns to the artificial intelligence client the workspace data needed to answer it, within the authorised scope. The Operator does not send data to those providers on its own initiative: there is no background synchronisation, no periodic export, and no unsolicited transmission.

11.3. From that point, the information is in the hands of the artificial intelligence provider the customer has chosen, which processes it under its own terms and its own privacy policy and for the periods it determines. The customer must review those terms and, where that provider is outside its own territory, have in place the international transfer mechanism its rules require. The Operator is not a party to that relationship.

11.4. The customer may revoke the OAuth authorisation at any time from its account. Revocation prevents further access; it does not reach what the provider has already received.

12. International transfers

12.1. Processing stays in the European Union. Accounts, CRM records, files, technical logs, and transactional email are processed in Ireland. The Operator does not move that data outside the European Economic Area in order to provide the service.

12.2. Amazon Web Services support access. The Amazon Web Services data processing addendum incorporates the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914, which cover any access by its support teams from third countries.

12.3. Vercel. Vercel Inc. is established in the United States. Its data processing addendum incorporates the standard contractual clauses of Decision (EU) 2021/914 for transfers from the European Economic Area, the United Kingdom, and Switzerland, and the UK International Data Transfer Addendum for UK transfers. As to transfers to the United States relying on the adequacy decision for the EU-US Data Privacy Framework, Implementing Decision (EU) 2023/1795, the General Court of the European Union dismissed the action for annulment in its judgment of 3 September 2025 (Case T-553/23, Latombe v Commission), and the appeal brought before the Court of Justice (Case C-703/25 P) was undecided as at the effective date of this Policy. The adequacy decision remains in force.

12.4. UK customers. Transfers from the United Kingdom to the European Economic Area are covered by the UK adequacy regulations, so a UK customer needs no additional instrument to use a service hosted in Ireland.

12.5. Latin American customers. For a customer exporting data from its country to the infrastructure in Ireland:

• Colombia: European Union Member States appear on the list of countries with an adequate level of protection in Circular Externa 005 de 2017 of the Superintendencia de Industria y Comercio, as amended by Circular Externa 008 de 2017. Transmission to a processor additionally requires the transmission contract under Article 25 of Decreto 1377 de 2013, a role fulfilled by the Data Processing Addendum.
• Brazil: Resolution CD/ANPD No. 32 of 26 January 2026 recognises the European Union and the European Economic Area as a destination with an adequate degree of protection for the purposes of Article 33(I) LGPD, so there is no need to incorporate the standard clauses annexed to Resolution CD/ANPD No. 19/2024.
• Argentina: the countries of the European Economic Area are among those with adequate legislation under Article 3 of Disposición 60-E/2016, as replaced by Resolución AAIP 34/2019.
• Mexico: the 2025 Federal Law on the Protection of Personal Data Held by Private Parties permits transfers necessary for the performance of a contract concluded or to be concluded between the controller and the data subject, and the remittance of data to a processor, which requires no additional consent. The Data Processing Addendum documents that remittance.
• Peru: cross-border flows require a country with an adequate level of protection under Article 18 of the regulation approved by Decreto Supremo 016-2024-JUS; the States of the European Economic Area meet that standard, and the controller must register the flow with the National Authority for the Protection of Personal Data.
• Chile: Ley 19.628 does not subject international transfers to prior authorisation. From the date Ley 21.719 comes into force — 1 December 2026 under its first transitional article — transfers rely on whatever recognition of an adequate level applies to the countries of the European Economic Area or, failing that, on the contractual clauses or safeguards accepted by the Personal Data Protection Agency; the Data Processing Addendum incorporates the processor obligations set out in that law.

12.6. US customers. State consumer privacy laws do not restrict where processing takes place. The Data Processing Addendum includes the terms the CCPA requires of a service provider, with the prohibition on selling or sharing the data and on using it for its own purposes.

13. Your rights

13.1. How to exercise them. Write to the privacy address shown in the identification of the Operator at the top of this document. State which right you are exercising and, if you know, which processing it relates to. We do not charge for handling a request; if one were manifestly unfounded or excessive because repetitive, we would give reasons before refusing it.

13.2. Verification. If we cannot identify you from the information you give us, we may ask for additional information strictly necessary to verify that the request is yours. We do not use that information for any other purpose.

13.3. Time limits. We reply within one (1) month of receipt, extendable by a further two (2) months for complex requests, telling you of the extension and its reasons. Where an applicable rule sets a shorter period, we apply that one: forty-five (45) calendar days with a further forty-five-day extension in California and in the other US states that so provide; fifteen (15) business days for a consulta and fifteen (15) business days, extendable, for a reclamo in Colombia; twenty (20) business days for ARCO rights in Mexico; ten (10) days for access in Argentina; and twenty (20) business days in Peru.

13.4. In the European Economic Area and the United Kingdom. You have the rights of access (Article 15 GDPR), rectification (16), erasure (17), restriction of processing (18), portability (20), and objection (21), and the right not to be subject to automated decisions with legal or similar effects (22) — a right that in Betty has no object, because we take no such decisions. Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of prior processing. You may lodge a complaint with the supervisory authority of your Member State or place of work, and with the Information Commissioner’s Office if you reside in the United Kingdom. You may also go to court.

13.5. In the United States. To the extent your state’s law grants them, you have the right to know what data we process and to obtain a copy, to have inaccurate data corrected, to have it deleted, to portability, and to limit the use and disclosure of sensitive personal information. You may appoint an authorised agent to submit the request on your behalf, with evidence of their authority. We will not treat you in a discriminatory way for exercising these rights. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is no opt-out mechanism for you to use; nor do we respond to opt-out preference signals, because there is no sale or sharing to opt out of. We do not use sensitive personal information to infer characteristics. If we refuse a request, in the states that provide for it — among them Colorado, Connecticut, Virginia, Texas, Oregon, Montana, Delaware, New Jersey, Minnesota, and Maryland — you may appeal our decision by writing to the same address; we will respond to the appeal with reasons and tell you how to contact your state attorney general.

13.6. In Latin America.

• Colombia: rights to know, update, rectify, and delete, to proof of the authorisation given, to revoke the authorisation, and to submit consultas and reclamos (Articles 8 and 14 to 16 of Ley 1581 de 2012). Before complaining to the Superintendencia de Industria y Comercio you must have exhausted the consulta or reclamo procedure with us.
• Mexico: rights of access, rectification, cancellation, and opposition, revocation of consent, and limitation of use or disclosure. The competent authority is the Secretaría Anticorrupción y Buen Gobierno, which took over these functions on 21 March 2025.
• Brazil: rights to confirmation, access, correction, anonymisation, blocking or deletion, portability, information about recipients, withdrawal of consent, and review of automated decisions (Article 18 LGPD), before the Autoridade Nacional de Proteção de Dados.
• Argentina: rights to information, free access at intervals of no less than six months, rectification, updating, and deletion, before the Agencia de Acceso a la Información Pública.
• Chile: rights of access, rectification, cancellation, and opposition under Ley 19.628 and, from the date it comes into force, the rights under Ley 21.719, including portability and blocking, before the Personal Data Protection Agency.
• Peru: rights to information, access, updating, inclusion, rectification, deletion, opposition, objective treatment, and portability, before the National Authority for the Protection of Personal Data of the Ministry of Justice and Human Rights.

13.7. If your data is in a customer’s workspace. In that case the controller is the customer, not the Operator. If you write to us, we will tell you so, pass your request to the customer without undue delay, and give it the assistance provided for in the Data Processing Addendum. We cannot access the contents of a workspace to handle a request without the customer’s instruction.

14. Cookies and browser storage

14.1. The public betty.management site uses no cookies. It sets no identifiers, measures no audiences, embeds no third-party tags, and loads no resources from external domains. The personality style demonstration runs entirely in the browser and stores no preferences.

14.2. The application. The CRM uses only the cookies and local storage strictly necessary to keep the session open, apply the security configuration, and remember the workspace selection. Being essential to provide a service requested by the user, they require no consent under Article 5(3) of Directive 2002/58/EC and its national implementation. They cannot be disabled without preventing use of the application; they can be cleared from the browser, which ends the session.

14.3. Telemetry. Telemetry, product analytics, and third-party error reporting are disabled in the Betty deployment.

15. Automated decisions and profiling

Betty takes no decisions based solely on automated processing that produce legal effects concerning a person or similarly significantly affect them. The suggestions Betty presents — a follow-up, a draft, a reminder — are proposals addressed to a user, who decides whether to act on them. We do not profile people for advertising, scoring, or evaluation purposes.

16. Security

The technical and organisational measures are described in detail in Annex II to the Data Processing Addendum. In summary: encryption in transit with TLS and at rest in the database and file storage; passwords stored using a cryptographic hash function; isolation of data by workspace; role-based access control and least privilege for personnel; logging of administrative activity; backups with tested restores; and incident management with the notification periods in section 17.

No system is invulnerable. If you find a vulnerability, write to the general contact address before disclosing it; we will handle it diligently and take no action against anyone who reports in good faith.

17. Data breaches

If a personal data breach affects data for which the Operator is the controller, we will notify the competent supervisory authority within seventy-two (72) hours of becoming aware of it, where Article 33 GDPR requires it, and the people affected where there is a high risk to their rights, under Article 34. If the breach affects data for which a customer is the controller, we will notify that customer without undue delay on the terms of clause 10 of the Data Processing Addendum, so it can meet its own obligations, including the specific time limits of its country, such as the forty-eight (48) hours set by the Peruvian regulation.

18. Minors

The service is aimed at professionals and businesses. We do not offer it to minors, we do not knowingly request or process data about minors, and we include no features aimed at them. If we become aware that we have received data about a minor without the authorisation applicable law requires, we will delete it. If you believe this has happened, write to the privacy address.

19. Changes to this Policy

We may update this Policy when the service, the infrastructure, the list of subprocessors, or applicable law changes. Substantial changes will be communicated on thirty (30) calendar days’ notice by email to account holders and by notice within the service, unless a rule of immediate application or a security risk requires a shorter period. The effective date shown at the top identifies the applicable version, and the previous version will remain accessible.

20. Complaints

If you believe we are processing your data incorrectly, write to the privacy address first: it is the fastest route to putting it right. In any event you may approach the authority for your territory — among others, the supervisory authority of your Member State in the European Union, the Information Commissioner’s Office in the United Kingdom, the California Privacy Protection Agency or your state attorney general in the United States, the Superintendencia de Industria y Comercio in Colombia, the Secretaría Anticorrupción y Buen Gobierno in Mexico, the Autoridade Nacional de Proteção de Dados in Brazil, the Agencia de Acceso a la Información Pública in Argentina, the Personal Data Protection Agency in Chile, and the National Authority for the Protection of Personal Data in Peru — and go to court.