Privacy Policy

Bepors is an AI assistant for everyday questions, at bepors.ai and in our mobile app. This policy explains what we collect, why, who else ever sees it, and what you can ask us to do about it.

Many of the people who use Bepors have good reasons to be careful about what is attached to their name. We built the system around that, and Section 3 describes the specific design decision it rests on.

1.1 Who operates Bepors, and who answers for your data

Bepors is a product of Hubizens LLC, a limited liability company registered in the State of Delaware, United States. In this policy, “we”, “us” and “our” mean Hubizens LLC, and Hubizens LLC is the controller of the personal information described here.

Hubizens LLC is a small, independent team. We have no legal, financial, operational or organisational affiliation with any government, governmental body, political organisation or other institution, anywhere in the world. Nobody outside the team directs what we build, and no such body has access to your information, standing to ask for it, or any route to it other than the valid legal process described in Section 7.

2.1 Your account

• Email address — to verify your account, sign you in, recover access, and send you the notifications you have not turned off.
• Password — stored only as a one-way hash. We cannot read it and we never see it after you type it.
• Name — used to build a display name and to address emails to you. It does not have to be your legal name.
• Language and notification preferences.

2.2 Your public profile

• A display name — typically a first name and an initial.
• An optional profile photo, if you upload one.
• Your city, so questions and answers reach the right community.
• Optionally, the topics you are willing to help with.
• Counts of what you have contributed, and the trust signals attached to it.

2.3 What you post

• Questions you ask, answers you write, and vouches you leave.
• Listings, events, business claims and self-introductions you submit.
• Messages you send in a connection thread with a business.
• Reports you file about a listing or a member.

2.4 Contact details you choose to share

If you ask us to connect you with a business, you decide whether to include a phone number or email address. If you attach a phone number, email address or messaging handle to a listing you post, it is stored with that listing and released only to a signed-in member who explicitly asks to see it — it never appears in the browse feed, and each release is recorded so we can spot anyone systematically harvesting contacts.

2.5 Addresses you type

Address fields — on a listing, an event or a business introduction — offer suggestions as you type. What you type is sent to Photon, a geocoding service built on OpenStreetMap data, to produce those suggestions. No account identifier goes with it. Only the address you finally choose is stored, along with its coordinates.

2.6 When you write to us

If you use the contact page, we store the name you give, the email address to reply to, the subject and your message, and we email them to our support address. Deliberately, a message to support is not run through the automated content checks that apply to what you post — reporting abuse usually means quoting it, and a support channel that rejects the words you are reporting is not a support channel. You do not have to be signed in, and if you are not, the message is not linked to any account.

2.7 Technical and security data

• Sign-in sessions — each active session record stores the IP address, browser or device user agent, and platform it was created from. This is what makes “end all other sessions” meaningful and what lets us spot a stolen session. Records are deleted when the session ends and when you delete your account.
• Rate limiting and abuse prevention — we count requests against a short-lived key derived from your IP address. These counters expire on their own, typically within minutes to an hour.
• Device push tokens — if you enable push notifications, so a notification can reach that device.
• Server logs — routine operational logs kept for a short period for debugging and security.

2.8 Payments (businesses only)

If a business subscribes or buys a placement, payment is handled by Stripe on the web and on Android, and by the Apple App Store on iOS. We store the subscription state, an identifier for the Stripe customer, and — for an iOS purchase — the transaction identifier Apple issues, which we send back to Apple to confirm the purchase is real before anything is unlocked. We never receive or store full card numbers. Nothing in the member experience requires payment.

2.9 What we do not collect

• No background or continuous location. We use the city you pick, not where your device is.
• No access to your contacts, camera roll, call history or messages.
• No advertising identifiers, cross-site trackers, or third-party analytics or advertising SDKs.
• No browsing history from outside Bepors.
• No social-media accounts or the data behind them.
• No card numbers or bank details.

This is the central design decision of the product, and it is structural rather than a setting.

Your identity — email address, name, credentials, sessions — is stored in a separate, isolated part of the database from everything public. Your questions, answers and vouches are attached to an opaque identifier for your public persona, and there is no link in the public data back to the identity side. The public half of the database can be queried, exported or handed to a search index without carrying a single email address or real name with it.

Asking is anonymous by default. A question you post shows no persona at all unless you choose to attach yours. Answers carry your display name, because knowing who is answering is what makes an answer worth reading.

• To run the Service — answer questions, show the directory, deliver listings and events, carry connection messages.
• To keep your account working — sign-in, verification, password recovery, and the security records that protect it.
• To notify you about things you are involved in, subject to the notification settings you control.
• To keep the community safe — automated content checks, rate limits, spam and scam detection, and human review of what those surface.
• To improve the Service using aggregate patterns (which categories are asked about, where coverage is thin) rather than individual profiles.
• To meet legal obligations and to establish, exercise or defend legal claims.

We do not sell your personal information, and we do not share it for advertising.

Answering a question is done by an automated system, and that means some of your text is sent to a third-party AI provider (currently OpenAI) for processing:

• the text of your question, to generate an answer and to search existing answers;
• text you post — answers, listings, events, introductions — to produce the numeric representations used for search, and to run automated safety checks;
• images you upload, for the same safety checks.

This text is sent without your name or email address. It is processed under the provider’s API terms, which do not permit using it to train their models. Please avoid putting sensitive personal details into a question that does not need them — a question works just as well without a passport number in it.

• Public to anyone, including search engines: questions that have been answered and their answers, shown with the answerer’s display name; directory entries; published events and listings.
• Visible to signed-in members who request it: contact details attached to a listing, one release at a time and recorded each time.
• Visible to a specific business: the message and any contact details you chose to share when you asked to be connected.
• Never shown to other members: your email address, your password, your sessions, your notification settings, and the fact that a given anonymous question was yours.

7.1 Providers that receive something

We use a small number of providers, each for one job, and each receives only what that job needs. We name the one we currently use for each, so you can see who is involved rather than having to take a category on trust. They act on our instructions and may use the data only to provide their service to us:

• Cloud hosting and database — running the Service and storing its data.
• Amazon Web Services — transactional email, and storage for uploaded photos.
• OpenAI — generating answers, search embeddings, and safety checks (Section 5).
• Stripe — payments for businesses on the web and on Android (Section 2.8).
• The Apple App Store — purchases and subscriptions made on iOS. Apple handles the transaction under Apple’s own privacy policy; we receive a transaction identifier and a confirmation of what was bought (Section 2.8).
• Apple and Google push services — delivering push notifications to your device.
• Photon, a geocoder built on OpenStreetMap data — address suggestions (Section 2.5).
• Google Places — used to corroborate that a business in the directory exists and is where the listing says. This checks businesses, not members.

If we change a provider, we will update this section; the purposes above do not change without the notice described in Section 15.

7.2 Data we use that receives nothing from you

Two things are worth naming precisely because your information never reaches them — and because their licences ask to be credited:

• GeoNames — the country, currency and place-name reference list is a static file generated from GeoNames data, used under CC BY 4.0. It ships with the Service and is read on our own servers. Nothing about you is sent to GeoNames.
• OpenStreetMap — map and address data underlying the geocoder in Section 2.5 is © OpenStreetMap contributors, available under the Open Database Licence.

7.3 What we do not use

We use no third-party analytics, tracking, advertising, attribution or social-media SDK, on the web or in the app. There is no third party receiving your data for a purpose of its own.

7.4 Everything else

Otherwise we disclose personal information only when required by valid legal process, when necessary to protect someone’s safety, or to enforce our Terms of Service. If Hubizens LLC is ever acquired or merged, data may transfer as part of that transaction, subject to this policy, and we will say so before it takes effect.

Some placements are paid for, and they are labelled as sponsored. They are chosen by city and category only. There is no behavioural targeting, no tracking pixel, and no profile of you is shared with a sponsor. Sponsors see aggregate counts of impressions and clicks, never who viewed or clicked.

• Session cookies — your sign-in tokens are stored in cookies that scripts cannot read, which is what protects them from a script injected into the page.
• A security token cookie — readable by our own page and echoed back on every write, so another site cannot make your browser act as you.
• Local storage — your chosen language and city, kept on your own device so the app opens the way you left it.

We use no advertising or analytics cookies.

• Traffic is encrypted in transit, and stored data is encrypted at rest.
• Passwords are hashed with a slow, salted algorithm designed for the purpose.
• Sessions can be ended everywhere at once, and are ended automatically when you change your password.
• Verification codes expire quickly and stop accepting guesses after a handful of wrong attempts.
• Access to production systems is limited to the people who need it, and privileged actions are recorded in an audit trail.
• Uploaded photos are served through short-lived signed links rather than public URLs.

No system is perfectly secure. If you find a vulnerability, please report it to support@bepors.ai rather than disclosing it publicly.

• Account data — for as long as your account exists.
• Community contributions — indefinitely, in the anonymised form described in Section 12, because other people rely on them.
• Sessions — until they expire or you end them.
• Rate-limit counters — minutes to an hour.
• Support messages (Section 2.6) — kept while the matter is open and for a reasonable period afterwards, so we can pick up a thread you return to.
• Payment records — for the period tax and accounting law requires.

Depending on where you live, you may have rights to access, correct, delete, export or restrict the use of your personal information, and to object to certain processing. You can exercise all of these regardless of where you live, by writing to support@bepors.ai.

• Delete your account — from Settings in the app or on the website. It is immediate. The account deletion page lists exactly what is removed and what remains.
• Get a copy of your data — write to us and we will send it in a portable format.
• Correct something — most fields are editable in the app; for anything else, write to us.
• Turn off notifications — in Settings. Security and account emails still arrive, because they are how you find out someone is trying to get into your account.
• Complain — you may lodge a complaint with your local data protection authority. We would rather you told us first.

Deleting your account removes your identity and the contact details you shared. Questions and answers you contributed remain as anonymous community content, attributed to “Former member”, with no route back to you.

One exception is worth stating plainly rather than leaving you to discover it: a message you sent us through the contact page (Section 2.6) is a support record and is not removed by account deletion — it keeps the name and reply-to address you typed into that form, which is not always the address on the account. Write to support@bepors.ai and we will delete those too.

Bepors is for adults. It is not directed at children, and we do not knowingly collect information from anyone under 18. If you believe a child has created an account, write to support@bepors.ai and we will delete it.

Hubizens LLC is established in the United States, and our servers and providers are located primarily there, so using the Service involves transferring your information to the United States and to the other countries where our providers operate. Those countries may have different data-protection laws from your own. Where the law requires a transfer mechanism, we rely on the appropriate safeguards.

We will update this policy as the Service changes. If a change is material we will notify you by email or in the Service before it takes effect, and the date at the top of this page always reflects the current version.

Questions about this policy, or about your data: support@bepors.ai, or through the contact page.

Hubizens LLC, State of Delaware, United States