Privacy notice for Be[X]

1.Who is responsible

Controller: 4XOR Software Schäuble, Tobias Schäuble, Dornacherstrasse 17, 4147 Aesch, Switzerland · info@4xor.de · +41 76 639 66 09.

The Swiss Federal Act on Data Protection (FADP/nDSG) applies. Where the EU General Data Protection Regulation (GDPR) applies, for example to Explorers in the EU, its rules apply as well. For Explorers in Kenya, the Kenya Data Protection Act 2019 also applies.

2.What we process and why

• Visiting the map: IP address, time, page, browser and operating system are processed by our host to deliver the site and to protect it from abuse (legitimate interest, GDPR Art. 6(1)(f)). Your IP address is also used for short-lived abuse counters, deleted within a day after they expire.

• Account: with Google sign-in we receive your name, email address, profile photo and Google account ID. We do not keep Google access tokens. With email sign-in we store your email address and, if you set one, a password hash. Purpose: your account (contract, Art. 6(1)(b)).

• Profile: the country, languages, sector, skills, locations and interests you add, and an optional photo. They are used to match you with Opportunities and people.

• We do not ask for or store your faith, worldview, community or tribe. Faith figures on the map are public statistics per country, not data about you.

• Listings (Opportunities): what a Host enters, including an optional contact email. The contact email is shown publicly only if the Host chooses so. New listings are reviewed by us before they go live; the review email contains the name and email of the person who submitted it.

• Messages and Exchanges: what you write to a Host or another member is stored in both inboxes. When you contact a provider, your message is also emailed to them with your email address as the reply address, so they can answer you directly.

• AI agent: what you type and the countries you selected are sent to Anthropic (Claude) to produce the answer, and the conversation is stored in your account so you can continue it.

• Studio live demo: the business description and the optional photo you enter are sent to Anthropic (Claude) once to produce the result. We do not save your entries with your account or in the map database, and we do not use them for anything else. The workflow engine on the Studio server (n8n) keeps a technical record of each run, including your entries and IP address, and deletes it automatically after 14 days. To enforce the daily limits we count runs per account or IP address.

• Payments (M-Pesa, Kenya): your phone number and the amount are sent to Safaricom to start the payment on your phone. We store the amount, currency, status and M-Pesa receipt number, but not your phone number.

• Emails: sign-in links, confirmations and notifications.

• Security log: when an admin views personal data or changes a listing, and when you export or delete your data, we log who did it, when and from which IP address.

3.Who sees your data

• Other signed-in members see your name, photo, country, languages, sector, skills and locations. Your email address, faith and community are never shown to them. Signed-out visitors see no profiles.

• A Host sees the Exchanges and messages sent to their listings.

• Our admins can see account data and listings to moderate the platform and handle support. Each of these views is logged.

• We do not sell personal data and do not use it for advertising.

4.Service providers and countries

We use these providers, bound by data processing agreements. Some of them process data outside Switzerland and the EU/EEA, in particular in the USA (FADP Art. 19(4)):

• Amazon Web Services (AWS EMEA SARL, Luxembourg; Amazon Web Services, Inc., USA): hosting (AWS Amplify, Frankfurt; the Studio server on AWS Lightsail), delivery through the CloudFront network (worldwide), sending and receiving email (Amazon SES, Frankfurt).

• Neon Inc. (USA): the database, on AWS servers in the EU.

• Google (Google Ireland Ltd.; Google LLC, USA): Google sign-in, and our mailbox to which emails to info@4xor.de are forwarded.

• Anthropic (Anthropic, PBC, USA; Anthropic Ireland, Ltd.): the AI agent and the Studio demo. Anthropic does not use API data to train its models and deletes it after a short period under its commercial terms.

• Resend (Resend, Inc., USA): only as a backup for sending emails.

• MapTiler AG (Switzerland): map tiles. Your browser loads them directly from MapTiler, which receives your IP address.

• Safaricom PLC (Kenya): M-Pesa payments, only if you pay with M-Pesa.

5.Transfers abroad

For the USA we rely on the Swiss-U.S. and EU-U.S. Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses as recognised by the FDPIC. Kenya has no adequacy decision: data goes to Safaricom only to carry out the payment you ask for (FADP Art. 17(1)(b), GDPR Art. 49(1)(b)).

6.How long we keep data

• Account, profile, listings and messages: until you delete your account.

• AI agent conversations: deleted after 12 months without activity, or with your account.

• Read notifications: 6 months.

• Abuse counters (with IP or email address): deleted within a day after they expire.

• Studio live demo runs (entries and IP address) on the Studio server: deleted automatically after 14 days.

• Security log: 2 years.

• Payment records: 10 years, as Swiss accounting law requires (Art. 958f CO), without your name or email once your account is deleted.

• Server logs at our host: as short as needed for operation and security.

7.Cookies and storage in your browser

• We only use what the service needs to work: the sign-in cookies (next-auth session, CSRF protection and return address; the session lasts up to 30 days), your language choice (localStorage) and the countries you selected on the map (sessionStorage, cleared when you close the tab).

• No analytics, no tracking and no advertising cookies. That is why there is no cookie banner.

8.Your rights

You can access, correct, export and delete your data, restrict or object to processing, and withdraw consent at any time, without affecting what happened before.

Self-service: under Profile → Settings & your data you can download all your data as a file and delete your account. You can edit your profile directly. For anything else, write to info@4xor.de. We answer within 30 days.

You can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC), to a data protection authority in the EU, or in Kenya to the Office of the Data Protection Commissioner (ODPC).

9.Matching and AI

Be[X] suggests Opportunities and countries based on your profile, and the AI agent gives suggestions. These are recommendations only. No decision with legal effect or similarly significant effect is made automatically. AI answers can be wrong; check important information.

10.Age

Be[X] is meant for people aged 16 and over.

11.Security

Connections are encrypted (HTTPS). Passwords are stored only as salted hashes. Access to personal data is limited to what each role needs, admin access is checked on every request and logged.

12.Changes

We update this notice when the service changes. The version published here applies.