Privacy policy

1. Who we are

Beaquaro Studio, Beaquaro Business and Beaquaro Agency (together, “Beaquaro”) are run by Beaquaro Ltd, a company registered in the United Kingdom (company number 17561331), working from London, UK and Vadodara, Gujarat, India. We decide why and how your personal data is used, which makes us the “controller” of it.

This policy covers studio.beaquaro.com, business.beaquaro.com and agency.beaquaro.com. Questions or requests: privacy@beaquaro.com.

2. What we collect

• Your account: name, email address, mobile number (with country code; not verified by SMS and never used for marketing), and a securely hashed password. We never store your password as text. We record that you agreed to this policy and when. If you sign in with Google, we receive your name and email from Google, and no password.
• Business accounts: company name, website, industry, country, and the contact details you choose to add. If you ask to be verified, the company number you give us.
• Agency accounts: the agency’s name, contact email and website, the team members it invites, the creators it adds (name, email, niche and the private notes the agency writes), invitations and agency codes, what the agency writes for a creator, and a record of what it does for them.
• If you join an agency as a creator: which agency, the permissions you give it (each one separately, all off until you switch them on), whether the agency covers your plan, and a record of what the agency does for you, which you can read in My Beaquaro.
• Connected accounts: if you connect Instagram, Facebook, YouTube, LinkedIn or Bluesky, we receive basic profile information, your posts and statistics, and access tokens (stored encrypted) under the permissions you grant. For Instagram automations we also receive the comments and messages sent to your account, with the sender’s Instagram ID and username, so we can match your keywords and send the replies you wrote. We keep those messages for 30 days and then delete them automatically. If you connect a Facebook Page, we receive the name and follower count of the Page you choose, the posts we publish to it for you with their likes and comments, and a Page access token (stored encrypted). We use them only to publish what you approve, to delete a post you ask us to delete, and to show you how your posts did. We do not read your personal Facebook profile, friends or messages.
• Your videos on Instagram: so that our analysis is not limited to captions, we fetch your recent Instagram videos, have an AI speech model write down what is said (and the language), and have a picture model describe the cover picture, including any words on it. We keep those words and that description for you only, use them to analyse your content and answer your questions, and delete them when you disconnect Instagram or delete your account. We do not use them to train models or share them.
• Content you create: drafts, captions, scheduled posts, photos and videos you upload (kept only until the post is published), the description of your writing style, your automations and their log, and the prompts you give our AI tools.
• Your Beaquaro profile and activity: display name, city, roles, what you can offer and are looking for, short bio, availability and your visibility choice; opportunities you post; applications and invitations, with the messages in them; projects you take part in and whether each person marked them complete; and reports you send or blocks you set.
• Portfolio and messages: the pieces you add to your portfolio (shown to businesses only while you are listed, and only the pieces you leave visible), and the messages you send to people you have agreed to work with on Beaquaro. Message text is stored encrypted. Nobody at Beaquaro browses conversations: we can see a conversation only if one of the two people in it reports it, and then only the latest messages that person chooses to include. Messages are not end-to-end encrypted, because our systems must open them to show them to the two of you. We may also have to share information if the law requires it.
• Performance numbers: followers, average views, engagement and posting rhythm read from platforms you connected. Businesses see these only if you choose to be discoverable, and only for the platforms you choose to show.
• Forms, polls and requests: when someone answers a form, poll or request that a Beaquaro user made, we keep their answers and the email address they typed (if the form asks for one) for the person who made the form, who decides what to ask and what to do with it. A poll that allows one vote each keeps a one-way code made from the connection, never the address itself. The person who made the form can read, export and delete the answers, and they are deleted with the form. We do not use them for anything else.
• When you were last in Beaquaro: once you are signed in, we note when you last used it and, for each day, how many seconds you were actively using it (the page in front of you and touched or scrolled in the last minute). We keep that for about four months, only the person who runs Beaquaro sees it, and we use it to understand how the product is used and to help people who write to us. It does not record what you did or which pages you opened.
• Usage and technical data: we count visits to our public pages and clicks on our buttons without cookies or a visitor ID. We keep a short-lived, one-way code of your connection to limit abuse, and logs that show an email was sent. If you use the contact page, we keep your message and email address.

3. How we use it, and why

Where the law of your country uses different terms (for example India’s Digital Personal Data Protection Act), we rely on your consent or on the legitimate uses that law allows, for the same purposes.

We do not sell your data, use it for advertising, or use Instagram data to train AI models.

4. Who can see what

• Discoverable: you can appear in search, matches and recommendations for businesses and members whose needs fit. This is off unless you choose it.
• Only people I’ve worked or talked with: you never appear in search or matches. People see your profile only after you both said yes to something.
• Hidden: you do not appear in search, matches or any count. You can still browse and apply. The person you apply to sees your profile, what you have made and the numbers you chose to show, for that application only.
• Whatever you choose, your email, phone, drafts and connections are never shown. Contact details are shared only after the other person accepts, and only the ones you chose to share. Anything already shared with someone after you accepted stays with them.
• When both sides mark a project complete it appears on both profiles. You can hide any completed project from yours. A collaborator who is not discoverable is shown as “a Beaquaro member” to people who did not work on the project.
• An agency you join sees only what you allow: writing scripts and hooks for you is always on while you are with it, and everything else (leaving posts for your approval, seeing your results, scheduling, publishing, setting up automations) is off until you switch it on. It never sees your password or your connection tokens. You can change any permission, or leave, at any moment, and its access ends straight away.
• Everything an agency does for you, and everything you allow, is written to a record that you can read.
• Our team can see an account and its related items to deal with a report or a verification request.

5. Who we share it with

We use a small number of providers to run Beaquaro. They process data for us under our instructions:

• Cloudflare: hosting, our database, file storage and AI text generation (Workers AI), which also answers whenever the service below is unavailable.
• OpenRouter, and the company whose model it runs for your request (currently Anthropic): when you use the built-in AI, the text it works on (your prompt, your brand details and the drafts you ask it to improve) is sent to OpenRouter, which passes it to that model to write the answer. We do not send passwords, connection tokens or payment details. What they do with it is set by their own terms, which you can read on openrouter.ai.
• Payment providers, if you pay for a plan: Stripe, or Razorpay or Cashfree for payments from India. You enter your card, UPI or bank details on their own pages or windows, so we never see them. We receive confirmation that you paid, the plan and the amount, and a customer or subscription reference.
• If you agree a paid deal through Beaquaro: the amount agreed, the steps of the deal (who agreed, paid and confirmed, and when), and the proof of payment the paying side uploads (an image or PDF, which can show bank or UPI details, so we tell people to hide what they do not want shared). Only the two sides and Beaquaro can see it. It is used to run the deal and the fee, and to settle problems, and it is deleted when either account is deleted. We also keep a record that a fee was paid, from Stripe or Razorpay, but never your card or bank details.
• If you join our affiliate program or are referred through it: your payout details (a PayPal email or UPI ID), and a record of who referred whom and what was earned. These are used only to run and pay the program.
• An email provider (currently Brevo) to send the alerts and digests you have turned on, once email is switched on.
• The platforms you connect (Meta for Instagram and Facebook, Google for YouTube and sign-in, LinkedIn and Bluesky), which receive what you publish or send through us.
• An AI service you connect yourself (for example OpenRouter): your prompts and brand details go to it instead of the built-in AI, and it bills you directly.
• Authorities, if the law requires us to share something.

6. Cookies and similar technologies

We use one short-lived cookie for Google sign-in and a few items in your browser’s storage to keep you signed in and remember your choices. We use no advertising, tracking or analytics cookies. Details are on our cookies page.

7. Where your data goes

Our providers run servers in several countries, so your data may be processed outside the country where you live. Where the law requires safeguards for that, we rely on the contractual protections of our providers and limit what we send them.

8. How long we keep it

Disconnecting an Instagram account deletes its automations, contacts, conversation log and queued messages straight away.

9. How we protect it

Passwords are hashed. Connection tokens and any AI key you add are encrypted before they are stored. Everything travels over HTTPS and access inside the company is limited. No system is perfectly secure, so if something goes wrong that affects you we will tell you. More on our security page.

10. Your rights and choices

Depending on where you live, you can ask to see your data, correct it, receive a copy, delete it, object to or restrict some uses, and withdraw consent. You can do much of this yourself:

• Change who can find you, edit your profile, and switch the weekly digest on or off in My Beaquaro.
• Disconnect any platform in Profile and connections, or revoke our access from that platform.
• Delete your account and all associated data instantly from the data deletion page.
• You can download a copy of your data yourself at any time from My Beaquaro (Download my data), and delete your account there too. For anything else, write to privacy@beaquaro.com. We aim to reply within 30 days.

11. Complaints

Please tell us first and we will try to put it right. You also have the right to complain to a data protection authority: in the UK that is the Information Commissioner’s Office (ico.org.uk), in India the Data Protection Board, or the authority where you live.

12. Children

Beaquaro is for people aged 16 and over. If you think a child has given us their data, tell us and we will delete it.

13. Changes to this policy

We may update this policy. If a change matters, we will tell you before it applies, and we always show the date it was last updated above.