1. Data protection at a glance
1.1 General information
The following gives a simple overview of what happens to your personal data when you visit this website or use the Beegait platform. Personal data is any data with which you can be personally identified. The detailed policy follows below.
1.2 Data collection on this website and on the platform
Who is responsible? The operator of the website and of the platform, named in section 3.2.
How do we collect your data? Partly because you give it to us: the request form on this site, the account you create on the platform, the projects your organisation stores there. Partly automatically: when your browser or your runner talks to our server, technical data such as the IP address, the time and the requested address are processed to answer the request and to keep the service secure.
What do we use it for? To serve this website, to run the product for you and your organisation, to keep both secure, and to answer your requests. Nothing is used for advertising, and nothing is sold or shared for that purpose.
Which rights do you have? You may at any time ask, free of charge, which of your personal data we hold, where it came from, who received it and why; you may have it corrected or deleted, restrict its processing, take it with you, revoke a consent and lodge a complaint with a supervisory authority. Section 3 describes each right.
1.3 Analysis tools and third-party tools
This website uses none. No analytics, no tracking, no cookies, no consent banner, no external fonts, scripts or content delivery network: every file of this site is served from our own server. That includes the films: they are video files on our own server, played by your browser’s own player, with no video platform involved and nothing reported to anyone when you watch them. The platform contacts third-party services only when you connect them, for example your GitHub repository. Section 6 lists them.
2. Hosting
2.1 Our own server
The website and the hosted platform run on a virtual server rented from IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, located in a data centre within the European Union. IONOS provides the machine and works for us as a processor within the meaning of Art. 28 GDPR. The software on it is operated by us: the web server, the application, its database and its file storage all run on that server and nowhere else.
When you access the website or the platform, the web server and the application write technical log entries: the IP address, the date and time, the requested address, the browser identification and the answer status. We use them to keep the service running securely and to diagnose errors. They are kept for a short period, not merged with other data and not evaluated for any other purpose. The legal basis is our legitimate interest in the secure and reliable operation of the service (Art. 6(1)(f) GDPR).
2.2 Transport encryption and certificates
Every connection to the website and to the platform is encrypted with TLS. The certificates are issued automatically by Let’s Encrypt (Internet Security Research Group, San Francisco, USA); the issuance transmits our domain names, never visitor data.
2.3 Backups
The platform’s storage is backed up once a day on the same server. Backups exist only to restore the service after a failure; they are kept for a limited number of days and age out on their own. Deleted data disappears from the backups as they age out.
3. General and mandatory information
3.1 Data protection
We treat your personal data confidentially and in accordance with the statutory data protection regulations and this policy. Please note that data transmission over the internet, for example by email, can have security gaps; complete protection against access by third parties is not possible.
3.2 Responsible body
The responsible body (controller) for data processing on this website and on the hosted platform is:
SDS SA (Smart Digital Solutions SA)
Route de Crassier 7
Terre Bonne Park, Bâtiment A1
1262 Eysins
Switzerland
Email: contact@sds-ch.com
The controller is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data. For a self-hosted Beegait installation the customer who operates it is the controller (section 7).
3.3 Storage period
Unless a specific period is stated in this policy, your personal data remains with us until the purpose of the processing no longer applies. If you make a justified request for deletion or revoke a consent, the data is deleted unless we have another legally permissible reason to keep it, for instance a retention period under tax or commercial law; in that case it is deleted once that reason lapses.
3.4 Legal bases
Where you have consented, we process your data under Art. 6(1)(a) GDPR. Where the data is needed to perform a contract with you or to take steps at your request before one, the basis is Art. 6(1)(b) GDPR. Where a legal obligation requires it, Art. 6(1)(c) GDPR. Otherwise we rely on our legitimate interests, Art. 6(1)(f) GDPR, and name them at each processing below. The controller is established in Germany: the storage of and access to information on your device is governed by § 25 TDDDG (formerly TTDSG). For persons in Switzerland the Federal Act on Data Protection (FADP) applies alongside. We do not process special categories of personal data by design.
3.5 Transfers to third countries
Hosting, storage, backups and email delivery stay within the European Union. Data leaves the EU only through services that you or your organisation connect to the platform, or that your own developers run on their machines (section 6). Where such a provider is established outside the EU or the EEA, the transfer rests on the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses under the provider’s data-processing terms.
3.6 Revocation of consent
Where a processing rests on your consent, you may revoke it at any time with effect for the future. The lawfulness of the processing carried out before the revocation is unaffected.
3.7 Right to object (Art. 21 GDPR)
Where we process your data on the basis of Art. 6(1)(e) or (f) GDPR, you have the right to object at any time, on grounds relating to your particular situation. We then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. We do not process personal data for direct marketing.
3.8 Right to lodge a complaint
You have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The right is without prejudice to any other administrative or judicial remedy. The controller is established in Switzerland; the Swiss supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland. If you are in the European Union or the EEA, you may also complain to the supervisory authority of your member state.
3.9 Right to data portability
You have the right to receive the data we process automatically on the basis of your consent or of a contract in a common, machine-readable format, or to have it transferred directly to another controller where technically feasible. On the platform this right is built in: every project is a git repository that you can clone in full at any time, and your organisation’s data leaves with it.
3.10 Access, correction and deletion
Within the applicable legal provisions you have the right to free information about your stored personal data, its origin, its recipients and the purpose of the processing, and, where applicable, the right to have it corrected or deleted. Write to the address in section 3.2.
3.11 Right to restriction of processing
You have the right to request that the processing of your personal data be restricted. This applies while we verify the accuracy of data you dispute; where the processing is unlawful and you prefer restriction to deletion; where we no longer need the data but you need it to establish, exercise or defend legal claims; and while the balance of interests after an objection under Art. 21 GDPR is still open.
3.12 Objection to advertising emails
We object to the use of the contact details published under the imprint obligation for sending unsolicited advertising and information material, and reserve the right to take legal action in the event of unsolicited advertising, such as spam emails.
3.13 No automated decision-making
No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place on the website or on the platform.
4. Data collection on this website
4.1 Cookies and local storage
This website sets no cookies. The one thing it stores in your browser is your choice of the light or dark theme, under the key maistroTheme in the browser’s local storage. That value never leaves your browser and is not transmitted to us; it exists only so that the site opens in the theme you chose. It is technically necessary for a function you requested (§ 25(2) TDDDG, Art. 6(1)(f) GDPR) and needs no consent. You can delete it at any time through your browser’s site-data settings.
4.2 The request-access form
The request form asks for three things: a work email address, the size of your team, and a free-text description of what you build with agents today. The website itself stores nothing and posts nothing to a server. When you send the form, your own email program opens with the three answers addressed to sales@beegait.ai, and you decide whether to send that email. We keep it in our mailbox for the purpose of answering the request and opening the preview for you, and delete it when the request is settled or when you ask us to; statutory retention periods remain unaffected. The legal basis is Art. 6(1)(b) GDPR where the request precedes a contract, otherwise our legitimate interest in answering requests addressed to us (Art. 6(1)(f) GDPR). Should a server-side door replace the email step, this section will describe it first.
4.3 Contact by email
If you write to us by email, we store and process your request including the personal data it contains (your name, your address, the request itself) for the purpose of handling it. We do not pass this data on without your consent. The legal basis and the storage period are the same as in section 4.2.
5. The Beegait platform: your account and your projects
The following applies when you use the hosted platform at app.beegait.ai.
5.1 Account data
To use the platform you create an account with an email address, a display name and a handle, and you choose a password. The password is stored only as a salted hash computed with argon2id; we cannot read it. You may add a profile photo; it is optional and stored with your account. The platform records the organisations you belong to, your role in each, the invitations you send (the invitee’s email address) and receive, and the time of your sign-up and sign-ins. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).
When you sign up, the IP address of the attempt is recorded together with it and counted for one hour, so that automated mass sign-ups can be refused (legitimate interest in preventing abuse, Art. 6(1)(f) GDPR). The sign-up, sign-in and password-reset doors ask you to solve a small arithmetic challenge that the platform renders itself; no third-party captcha service is involved and nothing leaves our server for it.
5.2 Cookies on the platform
The platform sets one cookie, mc_session, which keeps you signed in. It is HttpOnly, restricted to same-site requests and valid for 14 days or until you sign out. During the private preview a second cookie remembers, for 30 days on the device, that you entered the preview access code. Both are technically necessary (§ 25(2) TDDDG, Art. 6(1)(f) GDPR); there are no tracking or advertising cookies and therefore no consent banner.
5.3 Project data
A project on the platform (a hub) consists of the cards, trackers, documents, uploaded files, evidence and job history that you and your organisation put into it. It is stored as a git repository plus an object store for larger files, on our server, and mirrored one way to your own git hosting if you connect one. Your organisation decides what goes into a project. Where that content contains personal data, we process it on your instructions as a processor under Art. 28 GDPR; a data processing agreement is available on request. The whole project can be cloned by you at any time. A project you delete is removed from the live platform and disappears from the backups as they age out (section 2.3).
5.4 No provider keys on the platform
Your organisation does not store an AI provider key on the platform, and the platform holds none of its own. Agent work — the free trial included — runs on your developers’ machines with the credentials those machines hold (section 5.5). The platform sends no prompt to any AI provider.
5.5 The runner on your developers’ machines
A runner is a small program a developer installs on their own machine and pairs with your organisation once. It opens no inbound port and only calls out to the platform. It sends: a name for the machine, its operating system, which agent tools and models are installed on it, regular heartbeats, the live output of a job while it runs, and the job’s result, which is pushed as commits into the project repository. Your source code stays on that machine; the platform never receives it. The AI vendor is the one whose subscription or API key the developer runs on that machine (for example Claude Code or Codex); that exchange happens between the developer’s machine and the vendor, and the platform is not a party to it. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).
5.6 Transactional email
The platform sends email only when the product needs it: to verify an address, to deliver an invitation, to reset a password, and to notify you about your projects. These messages are delivered through the relay of Brevo (Sendinblue SAS), 7 rue de Madrid, 75008 Paris, France, which receives the recipient address and the message for the sole purpose of delivering it. We send no newsletter and no marketing email. The legal basis is Art. 6(1)(b) GDPR.
5.7 Job history, audit and logs
For every job the platform records who started or stopped it, when, on which runner, with which engine and model, and the job’s output. This history is part of the project and visible to its members; it is what makes a delivery reviewable. You choose how long the platform keeps the words of a finished job — the chat, the answer, the agent’s trail, the questions and answers: a manager sets a number of days on the workspace’s Settings, after which they are deleted while the record of the job stays. By default they are kept until you choose. The platform also keeps an audit of lifecycle events on projects (created, archived, deleted, restored) with the acting user and the time. The legal bases are the performance of the contract and our legitimate interest in a traceable, secure service (Art. 6(1)(b) and (f) GDPR).
6. Third-party services you may connect
The platform transmits data to the following services only on your organisation’s action (connecting a repository) and only what the action needs.
| Service | What is transmitted | When |
|---|---|---|
| GitHub, Inc., San Francisco, USA | Repository names, branches and commits mirrored from your project, the deploy key or GitHub App installation you register. The App reads repository names and registers deploy keys; it cannot read your files. Personal tokens are accepted only as fine-grained tokens that cannot change your code. A repository connected runner-only gives us its address alone | When you connect a GitHub repository |
| Atlassian Pty Ltd (Bitbucket), Sydney, Australia | Repository names, branches and commits mirrored from your project. No Bitbucket credential is stored on Beegait — repository names are listed and keys registered through your runner, with its own sign-in. A repository connected runner-only gives us its address alone | When you connect a Bitbucket repository |
| Hangzhou DeepSeek Artificial Intelligence Co., Ltd., China | The prompt and project context of a job, sent from the developer’s own machine | Only when a developer points a Codex profile on their machine at DeepSeek; the platform never sends it anything. There is no adequacy decision for China, and the choice is your organisation’s |
Transfers to the USA rest on the EU-U.S. Data Privacy Framework where the provider is certified and otherwise on the Standard Contractual Clauses contained in the provider’s data-processing terms. We do not sell personal data and do not share it for advertising.
7. Self-hosted installations
If your organisation installs the Beegait platform on its own server, it operates the platform and is the controller for everything on it; this policy does not cover that installation. The only thing a self-hosted installation sends to us is a periodic licence check-in: the licence identifier, the licensee name, the plan, the expiry date, the installed version and the time of the check. We use it to serve the release channel and to support you; it contains no project data and no user accounts. The legal basis is the licence agreement (Art. 6(1)(b) GDPR) and our legitimate interest in operating the release channel (Art. 6(1)(f) GDPR).
8. Security
Every connection is encrypted with TLS. Passwords are stored as argon2id hashes and sign-in tokens only as hashes. Git-host secrets and older repository deploy keys are sealed with envelope encryption under the platform’s master key, which is moving to a managed key service. New deploy keys are made on your own machine and never reach us, and a repository connected runner-only leaves no credential with us at all. The hosted platform is served behind a single public front; the application and its database are not exposed. The runner opens no inbound port. Storage is backed up daily. Administrative access to the server is limited to the operator’s own key.
9. Changes to this policy
We update this policy when the product or the law changes and note the date below. The version in force is the one published here.
Last updated: 2026-10-28 · drafted with regard to the GDPR, the Swiss FADP and the TDDDG; first version, a legal review is scheduled before the launch at the apex domain.