Privacy policy

Who we are

becos is operated by Becos AI (“becos”, “we”). For anything in this policy, write to privacy@becos.ai.

When a company uses becos for its team, that company decides what its engineers capture and is the controller of that content; becos processes it on the company's behalf. For account and website data, becos is the controller.

What we collect

Account information

• Name, work email, team and role, set by you or your team admin.
• A password hash if you set a password (never the password itself), and short-lived sign-in codes sent by email.
• If you sign in with Google: your email address, the fact that Google has verified it, and your name. We use these only to match you to your existing becos account. We do not receive your Google password, Gmail, contacts or files.

Coding sessions captured by the becos plugins

When you install a becos plugin in a coding agent (Claude Code, Codex, opencode, Cursor), it sends parts of your sessions to your team's becos record. By default that is:

• Your prompts and the agent's text replies.
• Repository name, branch, commit id and author, and the paths of changed files.
• In the Claude Code and opencode plugins: the commands the agent runs, their output, and the code edits it makes. In the Codex plugin: code blocks from the agent's replies (Codex never sends commands, their output or diffs).

Secrets are redacted before anything is sent, and files such as .env, private keys and certificates are withheld entirely. Redaction is pattern-based, so it reduces the risk of a secret being sent but cannot guarantee it. Each kind of capture can be turned off in the plugin settings. The model's thinking is not sent unless you turn it on. The security page lists the exact settings.

Files and shared packages

• Files in no-code projects: when you work outside a code repository, your conversations are filed under a project you name, and the files the assistant creates or changes are saved to that project in the background. Files that look like they hold passwords or keys are skipped; only text and code files are checked this way, so PDFs and images are stored as they are.
• Shared packages: when you share work with a teammate (for example by mentioning them with @name), becos stores the package you send: the context the assistant prepared and any files you attach, after you review and confirm it. Files that look like they hold passwords or keys are blocked from sending, with the same limit on what is checked.

These files are stored by becos in private storage on our own infrastructure and can be opened only by authorised members of your workspace, through links that expire after 15 minutes.

What we derive from it

• Facts and decisions distilled from your sessions, with their author, repository and time, the links between them by repository, feature and person, and search indexes (embeddings) used to find them.
• The questions your agents ask becos (recall queries) and which records were returned.

Technical and website data

• Service logs, including IP addresses, used for security, rate limiting and debugging.
• Website visits, measured with a self-hosted analytics tool that sets no cookies and reports only aggregate counts.
• If you request a demo or contact us: your work email, what you tell us you want to use becos for, and the campaign tag of the link you came from.

How we use it

• To run becos: storing your team's record, answering your agents' questions with citations, and showing team activity to people on your team.
• To sign you in, keep accounts secure and prevent abuse.
• To support you and tell you about changes to the service.
• To understand which parts of the website are useful, in aggregate.

We do not sell personal information, and we do not use your team's content to train AI models.

Who can see your team's record

Content captured from your sessions is visible to people on your team: their agents can recall it, and teammates can ask what was decided or worked on. Team admins can manage members and see oversight views. Files saved in no-code projects are private to their author until the author shares them. A shared package is visible to every active member of your workspace; the person you mention is only notified first. It is kept separate from every other team's record. becos staff access it only to operate or support the service, or where the law requires.

Service providers

We use these providers to run becos. Each receives only what its job needs.

• Hosting: our cloud hosting provider — servers and databases.
• DeepSeek — language models that distil sessions into facts and answer recall questions. Session text is sent to it for processing. We may use other model providers; this list names the ones we use today.
• Voyage AI — builds the search index (embeddings) from that text.
• Amazon Web Services (SES) — sends sign-in codes and invitations.
• Google — sign-in with Google, and the spreadsheet that receives demo requests.

Some of these providers process data outside your country, including in the United States and China.

becos's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How long we keep it

• Account information: while your account is active.
• Your team's record: while your team uses becos. When a team leaves, or asks us to, we delete it within 30 days; backups expire within a further 30 days.
• Files in no-code projects and shared packages, with their files: deleted 30 days after they are saved or sent. After deletion we keep a record that the package existed, for audit.
• Service logs: up to 90 days.
• Demo requests: until you ask us to delete them, or 24 months after the last contact.

Your choices and rights

• Choose what the plugin captures with its settings, or uninstall it to stop capture.
• Ask your team admin, or write to privacy@becos.ai, to access, correct, export or delete your information.
• Depending on where you live (for example the EU, UK or California), you may have further rights, including to object to processing and to complain to a data protection authority. We will not discriminate against you for using them.

Security

Traffic is encrypted in transit, each team's record is kept apart, and access to production systems is limited. See the security page for detail, including what is still in progress. No system is perfectly secure; if we learn of a breach affecting your information we will tell you as the law requires.

Children

becos is a tool for professional software teams and is not meant for anyone under 16.

Changes

We will update this page when our practices change and change the date above. For significant changes we will also tell account holders by email.

Contact

Becos AI · privacy@becos.ai