BYOND Privacy Policy

Effective date: September 17, 2026

BYOND Technologies, Inc. (“BYOND,” “we,” “us”) provides the BYOND website and BYOND enterprise applications for iOS and Android. This policy explains how personal information is collected, used, shared, retained, and controlled.

Enterprise access is tied to an organization’s tenant. Your organization provisions and manages your access and determines how its business information is used. For information processed on your organization’s behalf, BYOND acts under its instructions and applicable service agreements. BYOND also handles information for its own website, service administration, and security purposes. Your organization’s policies may apply alongside this policy.

1. Information we process and why

• Enterprise identity and access: account identifiers, profile information such as name and email, organization membership, roles, permissions, session credentials, and authentication/MFA results are processed to authenticate you, select your tenant, and enforce authorized access. Authentication services handle sign-in and MFA; the app stores refresh credentials in the operating system’s secure credential storage.
• Business content: authorized connected mail, calendar and organizational information, files, attachments, workflow definitions, approval tasks, reports, and app content are retrieved or submitted when you use the corresponding features. Selected documents or images are uploaded to your organization’s services. We use this information to provide tenant-scoped business functionality and perform actions you or your organization authorize.
• Atlas conversations: the text you enter, conversation history, business context, notes, and generated blueprints are sent through our server to AI services to answer questions, extract notes, and generate blueprints. Avoid submitting secrets, confidential business information, or regulated data to this public preview.
• Voice: when you choose voice and grant microphone permission, your audio is transmitted to OpenAI for real-time conversation and transcription. Transcripts and related conversation context may be used in Atlas. You can end voice or revoke microphone permission in your device or browser settings; text chat remains available.
• Preview signups: when you request preview updates, we store your email address, optional name and company, signup source, consent choices, campaign information, and signup timestamps to manage that request and send updates. We also send an internal signup notification through BYOND’s email service.
• Optional usage analytics: with the analytics option enabled, we process a randomly assigned visitor identifier and usage events, such as pages viewed, conversation turn counts, and blueprint actions, to understand and improve the website. These are pseudonymous identifiers, not a guarantee of anonymity. The website analytics endpoint excludes conversation text and email addresses.
• Referral visits: a referral tag in a website link increments an aggregate count even if optional analytics are declined. A short-lived keyed fingerprint derived from request information helps suppress duplicate visits; raw request identifiers are not saved in the referral-count tables. Do not put personal information in referral tags.
• Technical information: IP addresses and request information are processed to deliver the service, limit abusive requests, and protect security. Hosting and AI service providers may also process technical information when delivering their services.
• Push notifications: if you enable notifications, the app registers an Expo push token with BYOND together with platform, app version, preferred organization, and notification preferences. BYOND and push-delivery services process these identifiers and notification payloads to deliver business alerts. Notification content may be visible on your lock screen according to your device settings.
• Device preferences and local working data: the app stores language, display and notification preferences, tenant-scoped draft recovery snapshots, file activity, cached downloads/previews, and approval/snooze records to support your work. Exporting or sharing a file sends a copy to the destination you select; BYOND cannot remove copies held by that destination.

Camera, photo selection, microphone, and notification permissions are used only for corresponding features. Device biometric authentication, if enabled, is evaluated by the operating system; BYOND does not receive your Face ID or fingerprint template through this login feature. Microphone audio is separate from device biometric login. Other people nearby may be captured during a voice call; use voice only where you have appropriate permission to capture and transmit their speech.

2. Cookies, local storage, and choices

The website records consent choices in browser local storage. If you accept conversation persistence, it also saves your transcript, notes, and blueprint on this device so they can be restored. Optional analytics use a separate choice and can store a visitor profile with visit, campaign, and usage information. Declining optional storage does not prevent text chat, but messages must still be transmitted to AI services to produce a response.

“Clear my data” on the website resets conversation storage, the analytics profile, and consent preferences. It does not delete server-held signups, previously submitted analytics, provider-held data, or every browser setting. To remove all BYOND device storage, use your browser’s site-data controls. The staff-only referral dashboard uses an authentication cookie that expires after eight hours.

In the mobile app, you can manage permissions in device settings and notifications in account settings. Signing out clears local authentication material and initiates push-registration revocation, but it is not account or tenant deletion and does not comprehensively erase every draft, database record, or cached business file. To remove remaining app data, use the operating system’s app-data controls where available; contact us for assistance with retained information.

3. Sharing and AI service providers

Our AI service providers include OpenAI, Microsoft Azure OpenAI/Azure AI, Anthropic, and xAI; the provider used depends on the feature and configured model route. Atlas text requests pass through our AI gateway. OpenAI processes website voice audio and transcription. Microsoft Azure provides website infrastructure; hosting and database providers process information necessary to deliver and secure the service.

For enterprise AI features, prompts, conversation history, transcripts, and relevant authorized business context may be transmitted to these AI services to generate responses or support agent actions. Your organization’s enabled integrations and model configuration determine which services are used. Device biometric login is separate from any voice processing or acoustic analysis; acoustic similarity is not identity verification or authorization.

Push delivery uses Expo and the platform push systems, Apple Push Notification service on iOS and Firebase Cloud Messaging on Android. Connected services receive the requests and content necessary for the integrations your organization enables. Your organization’s administrators and other authorized users may access tenant business records according to their permissions.

BYOND requires service providers receiving customer information to provide protections at least equivalent to this policy through applicable contractual obligations. Our AI-provider agreements prohibit using customer content to train shared models. This does not mean zero retention: providers may retain information as permitted by their agreements for service delivery, safety, security, or legal obligations.

Information may also be disclosed where legally required, to protect users and the service, or in connection with a corporate transaction subject to applicable privacy obligations. The public preview does not sell submitted conversation content or use it for advertising. Enterprise content is processed to provide authorized business services, not to grant advertisers access to your organization’s records.

4. Retention and deletion

Consented website analytics records expire after 90 days and are purged at server startup and every six hours. Referral deduplication windows expire after ten seconds and expired records are periodically purged. Aggregate referral counts have no automatic expiry in the current implementation.

Saved browser conversations remain until cleared; the website does not enforce a 90-day inactivity expiry. Preview signups have no automatic expiry. You may withdraw your preview-update request or request deletion through our privacy contact. Provider-held information, AI-gateway caches, and operational records have separate retention arrangements; the 90-day analytics period does not apply to them.

Enterprise business records and conversations are retained according to your organization’s service arrangements, configured policies, and applicable legal obligations. Device drafts and cached files can remain until cleared by the app or operating system; uninstall behavior differs by platform and secure credential storage may survive uninstall. Signing out or uninstalling does not delete server-held tenant records.

Managed accounts and tenant deletion. BYOND enterprise accounts are provisioned and managed by your organization’s IT administrators. Contact your tenant administrator to request access removal or correction/deletion of enterprise information. BYOND assists the organization under its service agreement and applicable law. An individual user’s access removal does not authorize destruction of the organization’s tenant or other users’ records.

Full tenant removal is an organization-administrator action, distinct from individual privacy requests. A dedicated self-service web workflow is not currently available. An authorized organization representative can contact BYOND to discuss tenant removal under the service agreement. Removal must account for associated business records, connected-service access, service-provider copies, and applicable retention obligations; deletion is not accomplished merely by disabling access.

Deletion requests may require identity and organization-authority verification. We explain applicable retention exceptions and the expected completion process when handling a request. Records that must be retained for legal obligations, security, fraud prevention, or resolving disputes are restricted to those purposes. Backup copies may remain until the applicable backup lifecycle expires rather than being removed immediately. Contact us or your organization’s administrator for the arrangements applying to your tenant.

5. Security and international processing

The website keeps long-lived provider credentials on the server, validates incoming requests, restricts access to its staff referral dashboard, and is served over HTTPS. The mobile app uses authenticated, tenant-scoped requests and operating-system secure storage for refresh credentials. Organization permissions and authentication controls protect enterprise access. No service can guarantee absolute security; device drafts and caches are not all stored in the secure credential store.

AI and infrastructure providers may process information outside your country. Processing locations and applicable transfer arrangements depend on your organization’s configuration and service agreements. Contact BYOND for information about the providers, locations, and safeguards relevant to your service.

6. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information; object to or restrict processing; and withdraw consent. Withdrawing consent does not undo prior lawful processing. You may also have the right to complain to your local data-protection authority. We may need to verify your identity before responding to a request.

Use device settings to manage microphone permission and browser settings to remove stored site data. For server-held information or help exercising your rights, email privacy@byond.app. Do not include passwords or sensitive documents in a request.

7. Children

BYOND is a business service, not designed for children under 13, and we do not knowingly collect their personal information. If a child’s information has been submitted, a parent or guardian should contact BYOND to request deletion. Your organization is responsible for authorizing appropriate use of its enterprise service.

8. Changes

We will update this page and its effective date when our practices change. Where required, material changes will be communicated and new consent obtained before the changed processing begins.

9. Privacy contact

Responsible company: BYOND Technologies, Inc.
Privacy contact: privacy@byond.app
Website: www.byond.app

For a privacy or deletion request, tell us the request type and the email address and organization associated with your BYOND use. We will verify identity and authority as appropriate and explain the next steps. Individual requests do not require authorization to delete an entire tenant.