Privacy Policy

How Be[X] collects, uses, and protects your identity data.

Last updated: March 2026

1.What We Collect

Identity dimensions you provide: country, tribe, language, faith, craft, skills, and any other dimensions you choose to add to your profile.
Account information: email address, display name, and profile photo (if signing in via Google).
Graph connections: the corridors, opportunities, and experiences you engage with on the platform.
Payment records: transaction amounts, currency, method (M-Pesa / Stripe), and status. We do not store raw card numbers or M-Pesa PINs.
Usage data: pages visited, discovery queries, and interactions — to improve routing and relevance.
Device and browser information: IP address, browser type, and operating system for security and fraud prevention.

Route you to opportunities, experiences, and connections that match your identity dimensions.
Power the Discovery engine — surfacing corridors, Hosts, and Explorers whose dimensions overlap with yours.
Process payments for experiences and opportunities via M-Pesa (Kenya) or Stripe (international).
Send transactional emails: sign-in links, payment confirmations, and opportunity updates via Resend.
Improve platform recommendations through aggregated, anonymised analytics.
Detect and prevent fraud, abuse, and unauthorised access.
We do not sell your data. We do not use your identity dimensions for advertising profiling.

Data is stored in a PostgreSQL database hosted on Neon (EU region, SOC 2 Type II certified).
Authentication tokens are short-lived JWTs stored in secure, httpOnly cookies.
Payment records are retained for 7 years to comply with financial regulations in Kenya and the EU.
Profile data is retained for as long as your account is active. You may request deletion at any time.
Backups are encrypted at rest and retained for 30 days.
All data in transit is encrypted via TLS 1.3.

Access: request a full export of your data at any time via contact@benetwork.app.
Correction: update your identity dimensions and profile details directly in your account settings.
Deletion: request account deletion — we will remove your personal data within 30 days, subject to legal retention requirements.
Portability: receive your identity dimension data and graph connections in JSON format on request.
Objection: opt out of analytics tracking by contacting us. Core platform functionality remains available.
For EU/EEA Explorers: these rights are guaranteed under GDPR. For Kenya residents: rights are provided under the Kenya Data Protection Act, 2019.

Session cookie (next-auth.session-token): required for authentication. HttpOnly, Secure, SameSite=Lax. Expires after 30 days of inactivity.
CSRF cookie (next-auth.csrf-token): required for form security. Session-scoped.
We do not use third-party advertising cookies or cross-site tracking pixels.
Analytics are server-side and do not require any cookies on your device.
You can clear cookies at any time via your browser settings. Doing so will sign you out.

Questions about your data?