Privacy

Draft

What data Bezanbecard processes and why, how long it is kept, and the choices you have.

1. Two different roles

For the businesses that create accounts and their team members, Bezanbecard processes account data to provide the service.
For those businesses' customers, Bezanbecard works on the seller's behalf: the seller decides what to ask and what to use it for. If you bought from a seller, contact them first.

2. Data we process

2. Data we process
Data	From	For
Team members' name, mobile number and email	Sign-up and invitations	Signing in, account security, notifications
Business name, support contacts, logo	Account settings	Showing on the checkout and payment links
The destination card's full number, IBAN and holder name	The cards and accounts you add	Showing customers where to pay, and matching deposits
The bank receipt files the customer uploads (an image or PDF, with a SHA-256 fingerprint of each), and the tracking number, amount, time and payer name they type	The checkout, or a member of the seller's team	The seller's review of the payment and its evidence record
The text and sender of the bank SMS of your own cards and accounts	The optional watcher app on your phone	Reading the amount, card digits and trace number
Each deposit's amount, bank, the payer card's last four digits and the trace number	The bank SMS or a manual entry	Matching deposits to payments
The customer's name, mobile number and email, and the last four digits of the card they pay from	The checkout, a payment link or the seller's API calls	Matching, receipts and the seller's customer records
Phone model, OS and app version, battery and permissions	The watcher app's periodic check-in	Showing the phone's health and warning when it disconnects
IP address, browser and time of sign-ins and requests	Every request	Security, abuse prevention, request logs for developers

Bezanbecard never asks for a card PIN or second password, and has no access to anyone's banking app; a receipt image may show the card or account it was paid from. On Android the watcher forwards only messages from the senders you list in the dashboard (with an empty list every message is sent and non-transactions are set aside); on iPhone only the messages your own automation selects.

3. How long we keep it

3. How long we keep it
Data	Kept for
Bank SMS text	90 days, then wiped; the amount, card digits and trace number stay with the deposit
Forwarded messages in the phone's queue	7 days, on the phone itself
API request logs, events and webhook deliveries	30 days
In-dashboard notifications	90 days
Sign-in one-time codes	5 minutes
Phone pairing codes	10 minutes
Sign-in sessions	30 days at most, or until you sign out
Payments, receipts and their files, deposits, invoices and the audit log	While the account is active and financial records are needed

4. How we protect it

Card numbers, IBANs, phone and webhook secrets and SMS texts are stored encrypted with AES-256-GCM. API keys are kept only as hashes, and passwords with bcrypt.
Every request from the watcher app is signed with a secret that only that phone and our server (encrypted) hold, and that is never sent again after pairing.
Webhook events never carry the full card number, and logs strip card numbers, IBANs, mobile numbers and secrets before they are stored.
Only owner, admin and support members of your team can read SMS texts, and revealing a full card number in the dashboard is recorded.
Receipt files are readable only by the seller's team, through links that expire after a few minutes. Bezanbecard staff cannot open them, and opening a payment's evidence pack is recorded.

We do not sell data. Only these services are used to send messages, and they receive only what that message needs: an SMS service for sign-in codes and SMS notifications, an email service for email notifications, and Telegram if you connect your Telegram account yourself. We disclose data to a competent legal authority when the law requires it. Notifications about test-mode events are never sent by SMS or email.

6. Your choices

View and edit your account, business and customer data in the dashboard, and export your payments and deposits as CSV.
Delete a customer with no open payment, remove phones and revoke keys.
To close your account or make any request about your data, open a ticket from the Support section of your dashboard.

7. Changes to this page

If the way we process data changes, we update this page and announce important changes in the dashboard. The general terms are in the terms of use.

This text is a draft