Privacy Policy

Effective date: June 1, 2026 · Last updated: July 6, 2026

‘Bean’ is operated by “First Lemma” (“Bean,” “we,” “us,” or “our”). This Privacy Policy explains what we collect, why we collect it, how we share it, how long we keep it, and the choices you have when you use our website, applications, browser extensions, APIs, search tools, AI features, or related services together called the “Service.”

1. Scope

This Policy applies to personal data we process when you:

• Use Bean or create an account.
• Enter searches, prompts, URLs, instructions, uploads, or other content.
• Use AI-powered answers, summaries, browsing, agents, or research features.
• Connect third-party accounts or services, if we make that available.
• Subscribe, pay for, or manage a plan.
• Contact us for support, feedback, partnerships, or security matters.

This Policy does not apply to third-party websites, search results, models, plugins, APIs, applications, or services that we do not control. Their own terms and privacy policies apply.

2. What we collect

Account information

We may collect information such as your name, email address, username, login method, password or authentication token, organization name, profile settings, preferences, subscription status, and account identifiers.

Search, prompt, and interaction data

We collect the searches, prompts, URLs, files, text, instructions, chat messages, feedback, ratings, saved items, collections, bookmarks, and other content you submit to the Service.

If you use AI answers, summaries, research, or browsing features, we may process your input and generated output to provide the feature, maintain context, improve quality, prevent abuse, and debug issues.

Public web and result data

When you ask Bean to search, browse, summarize, rank, or retrieve information, we may process publicly available web pages, search results, snippets, metadata, URLs, titles, citations, images, and other public or licensed content needed to provide results.

Public web content belongs to its respective owners. Bean does not control third-party websites or guarantee that third-party content is accurate, available, safe, or current.

Connected services

If you connect a third-party service, such as Google, Slack, Notion, GitHub, email, calendar, storage, or another integration, we collect the permissions you grant, connection metadata, authentication tokens, and the content needed to perform the actions you request.

We use connected-service data only for the purposes you authorize, such as searching, summarizing, organizing, retrieving, drafting, or taking actions you request. You can disconnect integrations through your account settings or by contacting us.

Usage, device, and log data

We may collect technical and usage information such as IP address, browser type, device type, operating system, pages viewed, features used, timestamps, approximate location derived from IP address, referral source, crash reports, latency, error logs, diagnostic data, and security events.

Cookies and similar technologies

We may use cookies, local storage, pixels, SDKs, and similar technologies to keep you signed in, remember preferences, understand usage, improve performance, prevent fraud, measure campaigns, and provide or improve the Service.

Types of cookies may include:

• Essential cookies that are required for login, security, account management, and core Service functionality.
• Preference cookies that remember settings such as language, theme, or saved preferences.
• Analytics cookies that help us understand usage, reliability, errors, and performance.
• Advertising or measurement cookies only if we use them and disclose them through our cookie banner or preference center.

You can control cookies through your browser settings. Some features may not work correctly if essential cookies are disabled.

Billing information

If you subscribe or buy paid features, we and our payment processors may collect billing details such as plan, payment status, invoice history, billing address, tax information, and transaction identifiers. Payment card numbers are processed by our payment provider; we do not intentionally store full card numbers on our own servers.

Support and communications

If you contact us, we collect your message, contact details, attachments, screenshots, logs, feedback, survey responses, and other information needed to respond.

Information from third parties

We may receive information from login providers, integration partners, payment processors, analytics providers, security providers, business partners, and publicly available sources, where permitted by law.

3. How we use information

We use personal data to:

• Provide, operate, maintain, and improve Bean.
• Process searches, prompts, URLs, uploads, AI requests, and generated results.
• Create and manage accounts.
• Authenticate users and keep accounts secure.
• Personalize your experience, settings, saved searches, and preferences.
• Process payments, subscriptions, invoices, taxes, and renewals.
• Provide customer support and respond to requests.
• Monitor reliability, latency, errors, and product performance.
• Detect, prevent, and investigate spam, fraud, abuse, scraping, security incidents, and policy violations.
• Develop new features and improve usability.
• Analyze aggregate or de-identified usage trends.
• Comply with legal obligations and enforce our Terms.
• Send service messages, security notices, policy updates, and, where permitted, marketing communications.

We do not use private user content to train foundation AI models unless you opt in or we clearly disclose a different setting before collection. We may use aggregated, de-identified, or statistical information that does not reasonably identify you to understand and improve the Service.

4. AI providers, search providers, and model processing

Bean may rely on third-party AI model providers, search-index providers, retrieval systems, hosting providers, and infrastructure providers to process your queries and return results.

When your input is sent to these providers, we require them to process it only to provide services to us, protect security, comply with law, and meet their contractual obligations. We do not authorize them to sell your personal data.

AI-generated outputs may be inaccurate, incomplete, outdated, offensive, or unsuitable for your situation. You should verify important information before relying on it.

5. Google and other API data

This section applies only if Bean connects to Google APIs or similar third-party account APIs.

If you authorize Bean to access Google user data, we will use that data only to provide or improve user-facing features you request, comply with security obligations, troubleshoot, and maintain the integration.

• We do not sell Google user data.
• We do not use Google Workspace user data for advertising.
• We do not use Google Workspace user data to train generalized AI or machine-learning models.
• We request only the permissions reasonably needed for the relevant feature.
• You may revoke access through your Bean settings, your Google account permissions page, or by contacting us.

Similar principles apply to other connected services, subject to their permissions and policies.

6. How we share information

We may share personal data in the following situations.

Service providers and subprocessors

We share information with vendors that help us host, secure, operate, analyze, support, and improve the Service. These may include cloud hosting providers, database providers, search providers, AI model providers, analytics tools, crash-reporting tools, customer-support tools, email providers, security tools, and payment processors.

Third-party integrations you authorize

If you connect an outside service or ask Bean to interact with one, we share the information needed to perform your request.

Legal, safety, and security reasons

We may disclose information if we reasonably believe it is necessary to comply with law, legal process, regulatory requests, enforce our Terms, protect rights or safety, investigate fraud or abuse, or secure the Service.

Business transfers

If we are involved in a merger, acquisition, financing, restructuring, bankruptcy, sale of assets, or similar transaction, personal data may be disclosed or transferred as part of that transaction, subject to appropriate protections.

With your consent

We may share information when you direct us to do so or give us permission.

Public or shared areas

If the Service includes public profiles, shared links, team workspaces, public collections, or community features, content you choose to share may be visible to others according to your settings.

7. We do not sell personal data

We do not sell personal data in the ordinary meaning of the word.

If we ever engage in activity that applicable law defines as “selling” or “sharing” personal information, such as certain targeted advertising or cross-context behavioral advertising, we will provide required notices and opt-out choices.

8. Data retention

We keep personal data only as long as reasonably necessary for the purposes described in this Policy, unless a longer period is required or permitted by law.

Typical retention periods are:

• Account data: kept while your account is active.
• Search history and saved content: kept until you delete it, delete your account, or for a 30 day period, depending on your settings.
• Logs and diagnostics: kept for 30 days, unless needed longer for security, debugging, abuse prevention, or legal reasons.
• Billing records: kept as required for tax, accounting, fraud-prevention, and legal obligations.
• Backups: deleted on a rolling schedule, usually within 30 days, unless retained for legal, security, or disaster-recovery reasons.

You can request deletion of your account or certain personal data by contacting us at contact@hellobean.ai.

9. Security

We use reasonable administrative, technical, and organizational measures to protect personal data. These may include encryption in transit, access controls, logging, authentication, vendor review, network protections, and internal policies.

No online service is perfectly secure. You are responsible for keeping your account credentials safe and for using strong, unique passwords or secure login methods.

10. International transfers

Bean may process and store information in the United States and other countries where we or our service providers operate.

If you are located in the European Economic Area, United Kingdom, Switzerland, or another region with data-transfer rules, we rely on appropriate safeguards where required, such as standard contractual clauses, adequacy decisions, data-processing agreements, or other lawful transfer mechanisms.

11. Your choices and rights

Depending on where you live, you may have rights to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete information.
• Delete personal data.
• Export or receive a copy of personal data.
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent.
• Opt out of marketing communications.
• Opt out of certain sales, sharing, or targeted advertising where applicable.
• Limit use or disclosure of sensitive personal information where applicable.
• Appeal a privacy-rights decision where applicable.

You can make a request by emailing contact@hellobean.ai. We may need to verify your identity before fulfilling the request. Authorized agents may submit requests where permitted by law.

You can opt out of marketing emails by using the unsubscribe link in the email. You may still receive non-marketing messages, such as account, security, billing, or legal notices.

12. California privacy notice

This section applies to California residents where the California Consumer Privacy Act, as amended, applies.

We may collect the following categories of personal information: identifiers, account information, internet or electronic network activity, commercial information, approximate geolocation, professional or organizational information if you provide it, user-generated content, inferences, and sensitive personal information if you choose to provide it or connect services that contain it.

We collect this information from you, your device, connected services you authorize, service providers, payment providers, analytics providers, security providers, and publicly available sources.

We use and disclose these categories for the purposes described in this Policy, including providing the Service, security, debugging, analytics, billing, support, legal compliance, and product improvement.

We do not sell personal information. If we use advertising or analytics tools that constitute “sharing” under California law, we will provide a “Do Not Sell or Share My Personal Information” mechanism and honor legally required opt-out signals where required.

California residents may request to know, access, correct, delete, opt out of sale or sharing, limit use of sensitive personal information, and not be discriminated against for exercising privacy rights.

13. EEA, UK, and Switzerland notice

Where applicable, our legal bases for processing personal data include:

• Contract: to provide the Service you requested.
• Legitimate interests: to secure, improve, debug, analyze, and operate the Service, prevent abuse, and communicate with you.
• Consent: for optional cookies, marketing, optional integrations, or other features where consent is required.
• Legal obligations: to comply with law, tax, accounting, legal process, and regulatory obligations.

You may have rights to access, rectify, erase, restrict, object, port data, withdraw consent, and lodge a complaint with your local data-protection authority.

14. Sensitive information

Bean is a general search and AI-assistance service. Do not submit highly sensitive information unless necessary for your use of the Service.

Sensitive information may include government identifiers, financial account details, precise health information, biometric information, children’s information, passwords, secrets, private keys, confidential business information, or highly personal content.

If you choose to submit sensitive information, we process it to provide the Service, secure the Service, comply with law, and honor your settings.

15. Children

Bean is not intended for children under 13. We do not knowingly collect personal data from children under 13.

If you believe a child under 13 has provided personal data to us, contact us at contact@hellobean.ai and we will take appropriate steps to delete it.

Users under 18 may use the Service only with permission from a parent or legal guardian.

16. Changes to this Policy

We may update this Policy as the Service changes. If we make material changes, we will provide notice through the Service, by email, or by another reasonable method. The updated Policy will be effective when posted unless stated otherwise.

17. Contact us

Privacy questions or requests:

Bean
Email: contact@hellobean.ai
Address: Delaware