Privacy Policy

Who we are

BVT Global Services (“BEVIEL”, “we”, “us”), registered at Santiago Surco, Lima 15054, Peru, is the controller of the personal data described here. Our data protection contact is legal@beviel.com.

Where you use BEVIEL to process personal data belonging to your own customers or staff, you are the controller of that data and we act as your processor, on your instructions.

What this covers

This policy covers BEVIEL Cloud, the BEVIEL desktop application, the BEVIEL Gateway and this website. It sits alongside the Terms of Service, which govern the service itself.

It does not cover a Model Provider you connect with your own credentials, or the third-party services you link to a workspace. Those are governed by their own policies — see Where your code goes.

What we collect

We do not buy personal data, and we do not build advertising profiles.

Where your code goes

This is the question worth answering precisely, because the answer depends on which model you chose — not on us.

Only what a request needs is sent. The service assembles context from your workspace — the files and symbols relevant to what you asked for — rather than transmitting an entire repository, and it records which model handled each request so you can see after the fact where your work went.

Why we use it

We do not make decisions about you by automated means that produce legal or similarly significant effects. Generating code is not a decision about you.

Who else processes it

We use third parties to run the service. Each one is bound by a written contract, may process your data only on our instructions, and is listed here before it starts.

A provider you connect with your own credentials is not our sub-processor. They are yours.

When we share it

We disclose personal data outside the list above only:

• to your workspace administrator, for the workspaces their organisation owns — if your account was provisioned by an employer, they can see that work;
• where you tell us to, such as when you connect an integration or invite someone;
• where we are legally compelled to — and we will tell you unless the law forbids it, and we will challenge a request that appears overbroad;
• to protect the rights or safety of BEVIEL, our users, or the public, where we have a good-faith reason;
• to a buyer, in a merger or acquisition — under the same protections, with notice to you before your data becomes subject to a different policy.

We do not sell personal data.

How long we keep it

Each period above is a promise about deletion behaviour, not an estimate: if we say deleted content is gone in 30 days, the system has to make that true. Where an enforcing mechanism is still being built we will hold to the shorter of the stated period and what the law requires, and we will correct this table rather than quietly outlive it. Export your work before deleting an account.

International transfers

We are established in Peru, so if you live anywhere else your data is processed outside your own country as soon as it reaches us. There is no onward destination beyond that today: §6 is empty, so nothing is passed to a third country by a sub-processor.

Peru is not covered by a UK or EU adequacy decision. Where we receive personal data from the United Kingdom or the EEA we therefore rely on the European Commission’s Standard Contractual Clauses — with the UK International Data Transfer Addendum where the UK GDPR applies — alongside the safeguards in §10. Ask us at legal@beviel.com for a copy.

When a host or any other sub-processor is engaged, it appears in §6 with its location before it starts, and this section names the new destination and the transfer mechanism at the same time.

How we protect it

• Encryption in transit (TLS) and at rest.
• Provider API keys are stored encrypted and are never displayed back to you in full after they are saved.
• Passwords are stored as salted hashes. We cannot read your password and will never ask you for it.
• Workspaces are isolated, and file operations are confined to the project boundary you are working in.
• Access to production data is limited to staff who need it, and is logged.

No system is perfectly secure. If a breach affects your personal data we will notify the relevant supervisory authority within 72 hours where required, and tell you without undue delay where the risk to you is high.

Report a vulnerability to security@beviel.com.

Your rights

Subject to local law, you can ask us to give you a copy of your data, to correct it, to delete it, to restrict or stop a particular use, or to provide it in a portable format. You can object to processing we base on legitimate interests, and withdraw consent at any time without affecting what was done before.

Most of these you can exercise yourself in the product: your account page shows what we hold, workspaces can be exported, and account deletion is self-serve. For anything else, contact legal@beviel.com. We answer within one month and do not charge.

If your data is in a workspace owned by an organisation, ask them first — they control it, and we will refer your request to them.

Cookies and analytics

This website sets no cookies and runs no analytics or tracking scripts. Nothing on it follows you elsewhere. That is a fact about the code, not an intention — you can verify it in your browser.

It does load two libraries from a public CDN, cdn.jsdelivr.net: Three.js on every page for the background, and GSAP on the home page. Serving those files means jsdelivr sees your IP address and your browser’s user agent, as any server does when it sends you a file. It sets no cookie, receives nothing about what you read here, and is not used to identify you — but it is a third party, so we would rather name it than let you find it in your network tab. We intend to serve both files ourselves, which removes the request instead of explaining it.

The sign-up page keeps the plan you selected in your browser’s session storage so it survives the next step, and it is discarded when you close the tab. It is never sent anywhere except to create your account.

Signing in to the product requires a session cookie, which is strictly necessary and needs no consent. If we ever add analytics we will ask first, it will be off until you agree, and this section will say what it is. Today there is none: no analytics, product telemetry or advertising script runs on this site or in the applications.

Children

BEVIEL is a professional development tool and is not directed at children under 16. We do not knowingly collect their data; if we learn we have, we delete it. Contact legal@beviel.com if you believe a child has created an account.

Changes to this policy

We will update this policy as the service changes. The version and date at the top change with it, and for material changes we will notify account holders at least 30 days’ notice before they take effect rather than relying on you to re-read the page.

Contact and complaints

Privacy questions and rights requests: legal@beviel.com. Postal: BVT Global Services, Santiago Surco, Lima 15054, Peru.

If you are unhappy with our answer you can complain to your data protection authority — in the UK, the Information Commissioner’s Office; in the EEA, the authority where you live or work. We would rather you raised it with us first, but you do not have to.