Privacy Policy

1. Who is responsible

BEM Chat is run by BEM Solutions LLC ("BEM", "we"), Houston, Texas, USA. When you chat on a business's website, that business decides why your data is collected and is the controller of it; BEM processes it for the business, under its instructions and this policy. When you create a BEM Chat account, BEM is the controller of your account data.

2. If you chatted on a website

What we collect. The messages you type and any photos you send; a name, phone number, email or order number if you give one; the page you were on and the language of the page; your rough location (city and region) worked out from your internet address; your browser and device type; and a random visitor id so the chat can remember your conversation when you come back. We do not read anything else on the website.

What we do with it. We show your messages to the business and its team in their inbox; we send them an alert when you ask for a person or leave your details; and, when the AI assistant answers, we send your message and the business's approved facts to an AI model provider to write the reply. If the business connected its online store and you ask about an order, we look that order up with the details you gave. If the business connected its calendar and you ask for an appointment, we offer its free times. We do not sell your data, and we do not use your chats to advertise to you or to train AI models.

Card numbers. If you type a payment card number into a chat it is removed before anything is stored or sent to the business or the AI. Never give card details in a chat.

3. If you run a BEM Chat account

We collect your email address, your name, your business name and website, the people you add to your team, and what you do in the console and inbox. If you buy a plan, Stripe handles your card; we store a Stripe customer id and the state of your subscription, never the card number. We read your website once to draft what the assistant knows, and again when you ask us to.

We email you about your account: sign-in links, alerts, receipts, usage and changes to these terms. We do not send marketing email to BEM Chat accounts without a separate choice from you.

4. Who else handles the data

BEM Chat runs on servers BEM controls in the United States, with a standby copy in a US data centre. These providers process data for us, under their business terms, only to do the jobs listed:

• AI answers: OpenRouter, which routes to models from Anthropic, OpenAI and DeepSeek. They receive the visitor's message and the business's approved facts to write a reply.
• Hosting and delivery: Cloudflare (the connection to the website), OVHcloud (US standby server).
• Email: SendGrid, Resend, or an email account the business connected (for example Google Workspace), to send alerts, receipts and transcripts.
• Phone alerts: Google Firebase and web push, to tell a business's team about a chat.
• Text messages: Twilio, where a business uses texting.
• Payments: Stripe. On Wix and Shopify, their billing.
• Stores and calendars the business connected: WooCommerce, Shopify, Wix, Google Calendar, only to answer the visitor's question.

We change this list when we change providers and keep the current one on this page.

5. How long we keep it

• Conversations, leads and photos: kept for the business for as long as it wants them. The business can delete a conversation, a visitor, or its whole account from the console, and we delete the data from our systems when it does.
• Internet address, browser and device details on a conversation: removed after 90 days.
• Page visits (which page a visitor was on): removed after 90 days.
• Email that could not be delivered and was retried: up to 30 days.
• Account and billing records: for as long as the account is open, then as long as tax and accounting law requires.
• Backups: routine database backups are kept for 14 days, so deleted data ages out of them within that time.

6. Cookies and storage

The chat window stores a random visitor id in your browser so your conversation is there when you come back. It sets no advertising cookies and loads no advertising pixels. It honours the Global Privacy Control signal: with it on, the id is not stored until you open the chat. A business can also set the chat to wait for its own cookie banner before storing anything. The console and inbox use a sign-in cookie and local storage to keep you signed in.

7. Security

Connections are encrypted. Store keys, calendar tokens and email credentials a business connects are stored encrypted. Business logins use one-time links or passwords with optional two-step codes. Access to visitor data is limited to the business it belongs to and to BEM staff who need it to run or fix the service.

8. Your choices and rights

Depending on where you live, you may have the right to see the personal data held about you, to correct it, to have it deleted, to receive a copy, or to object to or limit how it is used. We do not sell personal data or use it for targeted advertising.

Visitors: ask the business whose website you chatted on; it can delete your conversation and details from the console in one step. You can also email us and we will pass the request to the business and help it respond.

Businesses: delete a visitor or a conversation from the console, or email us for a copy of your data or to close your account. We answer within 30 days, and we never treat you differently for asking.

9. Children

BEM Chat is not directed at children under 13, and businesses may set an age gate on their chat. If you believe a child has given us personal data, email us and we will delete it.

10. Changes

When this policy changes, the version at the top changes, and businesses with an account are emailed at least 30 days before a material change takes effect.

11. Contact

BEM Solutions LLC, Houston, Texas, USA. info@bem.solutions.

Version 2026-10-01. This policy covers BEM Chat; BEM's agency website has its own privacy policy.