Privacy Policy

1. Introduction

Beed ("We", "Our", "App") is committed to protecting the privacy of our users. This Privacy Policy describes the information collected when using the Beed mobile application ("App") and how this information is used.

1.1. Data Controller

Under GDPR and other data protection laws, the data controller is:

• Data Controller: Individual developer of the Beed application
• Contact: info@beed-app.com

You can use the contact information above for all your questions, requests, and objections regarding data protection.

2. Information Collected

2.1. Information Provided by Users

• Account Information: Email address, name, profile photo
• Content: Posts, comments, messages
• Expert Profile Information: Additional information for expert users (education, experience, etc.)

2.2. Automatically Collected Information

• Usage Data: In-app interactions, screen views, feature usage
• Crash Reports (Firebase Crashlytics): Technical information about app crashes and errors is collected. These reports are used to improve app stability and fix errors. Crashlytics collects the following technical information:
  • Device Model: Model information of the device used (e.g., iPhone 14, Samsung Galaxy S21)
  • Operating System Version: Device's operating system version (e.g., iOS 17.0, Android 13)
  • RAM and Storage Status: Device's memory and storage usage information at the time of crash
  • Call Stack: Code execution sequence and error location at the time of crash
  • App Version: App's version number at the time of crash
  • Connection Type: Internet connection type at the time of crash (Wi-Fi, mobile data, no connection)
  • Error Messages: Technical error messages and exception details
  Important: Crashlytics reports do not contain personal data. Email address, name, phone number, location information, or other personal identification information is not collected. Only technical error information and device characteristics are collected.
• Device Information: Device type, operating system version, platform information

2.3. Device Permissions

The Beed app may request the following device permissions to provide certain features. These permissions are used only for the specified purposes and cannot be accessed without user consent.

• Camera Permission: Camera access is required to take profile photos and create post images. This permission is only requested when the user wants to use the camera. Camera access is only used during the photo-taking process, does not run in the background, or provide continuous access.
• Gallery/Photo Library Permission: Access to your photo library is required to select profile photos from your device and add post images. This permission is only requested when the user wants to select a photo from the gallery. The app does not access all photos on your device; it only accesses the photo selected by the user. The app only accesses the photos you select; it does not access your entire photo library.
• Notification Permission: Notification permission is required to receive notifications about important updates, messages, comments, and other interactions. This permission is used to improve user experience and deliver important information in a timely manner. You can change or completely disable your notification settings from within the app at any time.

2.4. Information Not Collected

• Location Data: Currently not used
• Personal Identification Information: Real user IDs are not used in Analytics
• Third-Party Data: No data sharing with third parties

3. Artificial Intelligence (AI) Content Disclosure

The Beed app contains some content that was created with artificial intelligence (AI) support. Specifically, "teaching stages" or "instructional stages" content was developed with AI assistance. This content is pre-created and static (not generated in real-time during app use).

3.1. Current AI Content Status

• Pre-Created Content: The app currently contains pre-created, AI-supported content (particularly teaching stages/instructional stages). This content is static and not generated during user interaction.
• No Active Generation: The app does not currently generate new AI content in real-time during user interaction. User-provided information is not sent to AI services for active content generation.
• Intended Users: The Beed app is designed for use by parents, guardians, and professionals (such as special education teachers and experts). The app is not intended for direct use by children.

3.2. AI Content Limitations and Responsibilities

3.3. Medical / Educational Regulation Disclaimer

The Beed app is not a medical device and does not provide medical diagnosis, treatment, or clinical services. Educational content is provided for informational and supportive purposes only.

3.4. Future AI Features

Future versions of the app may introduce active AI content generation features that create content in real-time based on user input. If such features are introduced:

• Users will be informed about the new AI features and their implications.
• This Privacy Policy will be updated to reflect the new functionality.
• Consent will be requested when required, and users will be informed during onboarding or feature activation.
• For information about data transfer related to future AI features, see Section 6.5.

4. Use of Information

Collected information is used for the following purposes:

• Account Management: Creation and management of user accounts
• Service Provision: Operation of app features
• AI-Supported Content Delivery: Providing previously created AI-supported education plans and materials. Currently, the app does not generate new AI content in real-time during user interaction. If future active AI generation features are introduced, they will be described in this policy and users will be informed.
• Communication: Communication with users (notifications, updates)
• Analytics: Analyzing app performance and user experience
• Error Fixing: Detecting and fixing app errors
• Security: Preventing and detecting security breaches

5. Data Security

5.1. Data Storage Location

All data of the Beed application is stored on Google Cloud Firebase EU (European Union) servers. Firebase securely hosts your data using Google Cloud Platform's infrastructure.

• Data Region: All user data is stored on Firebase servers in the European Union (EU) region. This is important for GDPR compliance.
• Encryption: All data is encrypted both during transmission (TLS/HTTPS) and during storage (at-rest encryption). Firebase uses Google Cloud's industry-standard encryption technologies.
• Infrastructure: Data is hosted on Google Cloud Platform's secure and highly available infrastructure. Google Cloud has international security certifications such as ISO 27001, SOC 2, SOC 3.
• Backup: Data is automatically backed up and stored in multiple regions to minimize the risk of data loss.

5.2. Security Measures

• Encryption: Sensitive data is transmitted over encrypted connections (HTTPS/TLS)
• Firebase Security: Security is provided with Firebase App Check
• Access Control: Only authorized personnel can access data
• Anonymization: User IDs are hashed in analytics data

6. Data Sharing and Third-Party Services

The Beed app uses the following third-party service providers to provide our services and improve the app experience. These services process your data according to their own privacy policies.

6.1. Firebase Services (Google)

Our app uses Google's Firebase platform:

• Firebase Authentication: Used for user authentication and account management. Email, Google, and Apple account information is processed by Firebase Authentication.
• Cloud Firestore: Used for storing app data (user profiles, education plans, performance records, posts, messages). Data is transmitted over encrypted connections.
• Firebase Storage: Used for storing files uploaded by users (profile photos, media content).
• Firebase Crashlytics: Collects app errors and crash reports. Does not contain personal data, only technical information (device type, operating system, error messages).
• Firebase App Check: Used to ensure app security and prevent abuse.

6.2. Google Sign-In

Google Sign-In SDK is used for signing in with a Google account. Google processes this data according to its own privacy policy. When you sign in with your Google account, Google's privacy policy applies.

6.3. Apple Sign-In

Apple Sign-In SDK is used for signing in with an Apple account. Apple processes this data according to its own privacy policy. When you sign in with your Apple account, Apple's privacy policy applies.

6.4. Google Translate API

Google Translate API is used for multi-language support of app content. Texts sent for translation are transmitted to Google Translate API and translation results are returned. Google Translate API's privacy policy applies.

• Temporary Processing: Sent texts are temporarily processed by Google. Texts are only sent for translation and are deleted from Google's servers after the process is completed.
• Permanent Data Storage: Google Translate API does not store permanent data. Sent texts are removed from Google's systems after the translation process is completed and are not stored.
• Account Association: Sent data is not associated with any Google account or user ID. Translation requests are processed anonymously.
• Data Security: All translation requests are sent over encrypted connections (HTTPS) and processed in accordance with Google's security standards.

6.5. AI Services Data Transfer

Current Status: Currently, the app does not actively generate new AI content during user interaction. Therefore, user-provided content is not routinely sent to AI services for real-time generation.

Future AI Features: Future versions of the app may introduce active AI content generation features that require sending some user-provided information to AI services (e.g., OpenAI API). If such features are introduced:

Data Transfer Details (for future features):

• Transferred Data: If active AI generation is enabled, information provided by users (e.g., student development information, education goals, education plan requests) may be sent to AI services.
• Anonymization: Personal identifying information (name, ID number, email address, etc.) would be removed before being sent to AI services whenever possible. However, education information necessary for content generation may be sent.
• Third-Party AI Services: OpenAI API may be used if active AI generation features are enabled. Other AI services may be used in the future. This Privacy Policy will be updated when such features are introduced.
• Data Retention: AI service providers have their own privacy policies. For information about OpenAI's data retention policies, please review the OpenAI Privacy Policy.
• Data Usage: If active AI generation is enabled, data sent to AI services would be used only for real-time content generation. It would not be used for retroactive model training (according to OpenAI's current policy).

User Notification: Users will be informed when active AI generation features are introduced, and this Privacy Policy will be updated accordingly.

6.6. Data Sharing Policy

• Personal Data: Your personal data is not shared with third parties except for the services mentioned above.
• Advertising Data Sharing: Collected user data is not used for advertising purposes in any way and is not shared with advertising providers. The Beed app does not contain ads and user data is not processed or sold for advertising purposes.
• Anonymized Data: Analytics and usage data are stored in Firebase Firestore in anonymized form.
• Data Security: All third-party services use industry-standard security measures and make efforts to protect your data.

Important: Third-party services have their own privacy policies. For more information about these services' data processing practices, you can review the relevant service providers' privacy policies:

• Firebase Privacy Policy
• Google Privacy Policy
• Apple Privacy Policy

7. Zoom Integration

The Beed app integrates with Zoom to provide online meeting and consultation features for expert users. This section explains how we use and protect your data when you connect your Zoom account to Beed. It supplements this Privacy Policy and should be read together with Zoom’s own policies.

7.1. Data accessed via Zoom

When you authorize Beed through the Zoom App Marketplace (OAuth authorization), we receive an authorization token that allows us to access limited information from your Zoom account. We request only the following OAuth scopes from Zoom:

• meeting:write:meeting – to create and manage Zoom meetings on your behalf
• meeting:read:meeting – to read basic information about meetings created via Beed
• user:read:user – to read basic account information (such as your Zoom user ID and email)

Through this integration, we may access and store the following information:

• Your Zoom user ID and Zoom account ID
• Your Zoom email address, first name, and last name
• Meeting metadata created via Beed (meeting ID, topic, scheduled date/time, join URL, host URL, and basic settings)

7.2. How Zoom data is used

We use the data obtained via Zoom only for the following purposes:

• To create, update, and manage Zoom meetings associated with your Beed appointments
• To generate and display Zoom join links and meeting details inside the Beed app
• To link your Beed expert profile with your Zoom account and show connection status
• To ensure security of the integration and prevent abuse or unauthorized use

7.3. Legal basis and relationship with Zoom

We process your Zoom-related data primarily on the basis of:

• Contract performance: To provide the online consultation and scheduling features you request.
• Legitimate interest: To maintain a secure and reliable integration with Zoom.
• Consent: You explicitly grant permission when you authorize Beed in the Zoom App Marketplace. You may revoke this authorization at any time by uninstalling the app from Zoom or disconnecting it within Beed.

Zoom Video Communications, Inc. is an independent third party. Your use of Zoom is also governed by Zoom’s own Privacy Policy and Terms of Service.

7.4. Tokens and retention

As part of the OAuth process, we receive access tokens and refresh tokens from Zoom. These tokens are stored securely and used only to perform API calls required for the integration (such as creating or updating meetings).

• Tokens are retained while your Beed account is active and the Zoom connection remains enabled.
• When you disconnect Zoom or uninstall the Beed App from Zoom, we stop using these tokens and delete or anonymize them within a reasonable period, keeping only minimal technical logs where legally required.

Zoom-related metadata is retained only as long as necessary to provide the meeting functionality and is periodically reviewed for deletion.

7.5. Data subject rights for Zoom-related data

Your general data protection rights described in this Privacy Policy (such as the right of access, rectification, erasure, restriction, objection, and data portability) also apply to personal data processed via the Zoom integration. You can exercise these rights by contacting us at support@beed-app.com.

You may also need to contact Zoom directly for requests related to data that Zoom processes as an independent controller.

7.6. No payments through Zoom

Beed does not process payments through Zoom. Any payments related to Beed (if applicable) are handled outside of Zoom. Zoom is not used as a payment processor for Beed, and no billing information is obtained from Zoom.

8. Data Retention

• Active Accounts: Data is retained as long as the account is active
• Deleted Accounts: Data is permanently deleted within 30 days after account deletion
• Analytics Data: Anonymized data is retained for 2 years

8.1. Account Deletion Process

The Beed app allows users to easily delete their accounts from within the app. The account deletion process is performed as follows:

How to Delete an Account?

1. Go to the Profile page within the app
2. Go to the Settings or Account Settings section
3. Find the Delete Account or Remove Account option
4. Confirm the account deletion process
5. Enter the verification code sent to your email address for security (if required)

What Happens When an Account is Deleted?

When you delete your account, the following processes occur:

• Account Information: Your personal information such as email address, name, profile photo is deleted
• Content: Your posts, comments, messages are permanently deleted
• Education Data: Your education plans, performance records, and development tracking data are deleted
• Expert Profile: If you are an expert user, your expert profile and appointment history are deleted
• App Access: You cannot sign in with your account and cannot access all your data within the app

Waiting Period and Recovery

• 30-Day Waiting Period: After the account deletion process is performed, your data is kept in the system for 30 days. You can restore your account during this period.
• Recovery: You can restore your account by signing in with the same email address within 30 days. In this case, all your data will be restored.
• Permanent Deletion: After the 30-day period, your data is permanently deleted and cannot be recovered. This process is irreversible.

Data Not Deleted

The following data is not affected by the account deletion process or is subject to different retention periods:

• Anonymized Analytics Data: Usage statistics and analytics data are stored in anonymized form for 2 years. This data does not contain personal identification information.
• Legal Obligations: Data that must be retained due to legal requirements (e.g., financial records) continues to be stored.
• Content Shared with Other Users: Content you shared with other users (e.g., comments, messages) may continue to appear in other users' accounts even if your account is deleted.

8. User Rights

In accordance with GDPR and other data protection laws, users have the following rights:

• Right of Access: You can request access to your personal data
• Right to Rectification: You can request correction of incorrect data
• Right to Erasure: You can request deletion of your data
• Right to Object: You can object to data processing
• Data Portability: You can transfer your data to another service

9. Children's Privacy

The Beed app does not knowingly collect personal data from children under 13 years of age. If we discover that we have collected information from a child under 13, we will immediately delete this information. The Zoom integration is intended for use by adult professionals and is not designed for direct use by children.

If a parent or guardian believes their child's personal information has been collected without authorization, they can contact us at info@beed-app.com. In this case, all personal data belonging to the child will be immediately deleted.

10. Cookies and Similar Technologies

Our app does not use cookies. However, Firebase services and third-party services may use cookies for technical purposes. These cookies are necessary for app functionality and do not contain personal data.

Firebase SDKs may use device identifiers instead of cookies. These identifiers are not cookies and do not contain personal data. They are used for technical purposes such as app functionality and analytics.

11. Privacy Policy Changes

This Privacy Policy may be updated from time to time. Users will be notified of significant changes.

12. Disclaimer and Legal Warnings

12.1. AI & Education Content Disclaimer

Content provided in the Beed app, especially AI-supported education plans and educational content, is for guidance and support purposes only. For detailed information about AI content, please refer to Section 3.

12.2. General Disclaimer

• The app is provided "as-is".
• No guarantee is made that the app will operate uninterrupted, error-free, or securely.
• No liability is accepted for data loss, material damage, or other losses arising from app use.

13. Explicit Consent / Consent Mechanism

13.1. Consent for AI Content Usage

By using the app, you acknowledge the AI-related disclosures in Section 3 and the legal warnings in Section 12.

13.2. Future AI Features and Consent

If active AI content generation features are introduced in future versions of the app, users will be informed during onboarding or feature activation, and consent will be requested when required. For information about data transfer related to future AI features, see Section 6.5.

13.3. Consent Withdrawal

Currently, the app does not send user data to AI services for active content generation. If future AI features that require data transfer are introduced and you wish to withdraw your consent, you may choose not to use those specific AI features. However, it may not be possible to retrieve data already sent to AI services (depending on AI service provider policies).

14. Contact

15. Legal Basis (GDPR)

Our data processing activities are based on the following legal bases:

• Contract: Data necessary to provide services (account creation, saving education plans, messaging, etc.) is processed under contract. App services cannot be provided without this data.
• Legal Obligation: Data processed due to legal requirements (e.g., financial records, tax obligations).
• Legitimate Interest: Data processing for app security, error detection, and improvement (Crashlytics, security logs, etc.).
• Explicit Consent: Situations requiring user consent (e.g., uploading profile photo, notification preferences, AI content usage). Consent can always be withdrawn.

15.1. Analytics Data and Right to Object

The Beed app collects anonymized analytics data. This data does not contain personal identification information and does not require explicit consent under GDPR. However, to protect our users' rights, we offer the following options:

• Opt-Out from Analytics: Users can restrict analytics data collection from device settings or in-app settings. However, collection of anonymized technical data (error reports, performance metrics) may continue as it is necessary for app stability.
• Right to Object: You can object to legitimate interest-based data processing (e.g., security logs, error reports). You can send your objection to info@beed-app.com. Your objection will be evaluated and processed within the framework of legal requirements.
• Consent Withdrawal: You can withdraw your consent at any time for data processed with explicit consent. When consent is withdrawn, the relevant data processing is stopped (except for legal obligations).