GDPR

Last updated: September 26, 2026

This notice supplements our Privacy Policy for people in the European Economic Area and the United Kingdom. It explains how Earthena, Inc. complies with the EU General Data Protection Regulation and the UK GDPR when it processes personal data for BEVEL.

Controller

Earthena, Inc. is the controller of your account, authentication, and platform telemetry. Your organization is typically the controller of workspace content; we process that content under our Data Processing Addendum. Contact: hello@bevel.is. Until a dedicated Data Protection Officer is appointed, that mailbox is the privacy contact.

Lawful bases

• Contract (Art. 6(1)(b)). Creating an account, signing in with Google / Apple / Microsoft / OTP, delivering channels, and providing paid plans.
• Legitimate interests (Art. 6(1)(f)). Securing the Service, rate-limiting OTP, debugging, preventing abuse, and understanding how the product is used. You may object; we will stop unless we have compelling grounds.
• Consent (Art. 6(1)(a)). Optional product mail beyond what is needed to run your account. You can withdraw at any time.
• Legal obligation (Art. 6(1)(c)). Tax, accounting, and lawful requests.

Your rights

You may:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase data (right to be forgotten), subject to legal holds
• Restrict or object to processing
• Receive a portable copy of data you provided
• Withdraw consent where processing is based on consent
• Lodge a complaint with a supervisory authority

We respond within 30 days (extendable by 60 days for complex requests). We may need to verify your identity — usually by signing in to the same account. Email hello@bevel.is with the subject “GDPR request.”

Categories and sources

Identity data from Google, Apple, or Microsoft; phone numbers and emails you type on the sign-in screen; OTP metadata we generate; workspace content you or your teammates post; device and IP data from your browser or app. We do not buy personal data from brokers.

Transfers

BEVEL is hosted in the United States. When we transfer personal data from the EEA or UK, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum where required), plus supplementary measures such as TLS in transit and hashed OTP codes. Processors that receive data are listed in the Privacy Policy.

Automated decisions

We do not make solely automated decisions that produce legal or similarly significant effects about you. Agent outputs in a workspace are tools for that workspace, not decisions we take about a natural person as controller.

Supervisory authority

You may complain to your local data protection authority. A list of EEA authorities is published by the European Data Protection Board. UK residents may contact the Information Commissioner’s Office.