Privacy Policy
# Besday Privacy Policy
Last updated 7 September 2026.
This describes what Besday actually collects, what we do with it, and how long
we keep it. Where we do not yet delete something automatically, this document
says so rather than implying otherwise.
## What we collect
**Your account.** Your email address and a password. We never store your
password itself — only a one-way Argon2id hash of it, which cannot be reversed
back into your password.
**Your sign-in sessions.** When you log in we create a session record. Your
browser holds a random token; we store only a SHA-256 representation of it, so a
copy of our database does not yield working sessions.
**Your orders.** The creator you chose, the video length, your brief, any
product link, and any files you upload as reference material.
**Your conversations.** Messages you send about a project, and revision requests
and feedback you submit.
**Your delivered videos.** The finished videos we produce for you, and their
delivery records.
**Payment records.** When you pay, we store the amount, currency, status and the
identifiers our payment processor gives us. We do not store your card number —
we never receive it.
**Security records.** Sign-in and password-reset attempts, used to rate-limit
abuse.
## What we use it for
To produce and deliver the video you ordered, to let you sign in and see your
projects, to contact you about your order, to take payment, and to keep the
service secure.
## Who we share it with
We use a small number of service providers to run Besday:
- **Amazon Web Services (SES)** — sends our email, so your email address is
processed in order to deliver messages to you.
- **Kie** — our video and audio generation provider. Material derived from your
brief is sent there to produce your video.
- **Stripe** — payment processing. Live payments are not yet enabled; when they
are, Stripe handles your card details directly and we never see them.
We do not sell your data. We do not share it for advertising.
## Cookies
We set two cookies, both strictly necessary:
- `besday_session` — keeps you signed in.
- `besday_owner` — links files you upload before you create an account to your
browser, so nobody else can access them.
**We use no analytics, advertising or tracking cookies, and no third-party
trackers.**
## How long we keep it
These are the deletion rules our systems actually enforce today:
| Data | Deleted after |
|---|---|
| Files uploaded before an account is created, if never claimed | 7 days |
| Abandoned unpaid drafts | 30 days |
| Expired password-reset tokens | 7 days |
| Expired or revoked sign-in sessions | 30 days |
| Sign-in and reset attempt records | 2 days |
**Everything else we keep until you ask us to delete it.** That includes your
account, your projects and briefs, your uploaded files, your messages and your
delivered videos. We do not currently have an automatic expiry for them, and we
would rather say so than publish a retention period we do not enforce.
## Deleting your data
There is no self-service delete button yet. Email support@besday.com and we will
delete your account and associated data. We may keep the minimum records we need
for accounting and fraud prevention.
## Security
Passwords are hashed with Argon2id. Sessions are stored as hashes and can be
revoked. Your projects, files and videos are readable only by your own account —
another customer requesting them receives the same response as if they did not
exist.
## Who is responsible for your data
Besday is the controller of the personal data described here. For anything in
this policy, including any request about your data, write to support@besday.com.
## Why we are allowed to use your data
If you are in the EU or the UK, the law requires us to have a lawful basis for
each purpose. Ours are:
| What we do | Lawful basis |
|---|---|
| Create your account and sign you in | Performance of our contract with you |
| Produce and deliver the video you ordered | Performance of our contract with you |
| Send you messages about your order | Performance of our contract with you |
| Take payment | Performance of our contract with you |
| Keep the service secure and prevent abuse | Our legitimate interests in protecting the service and our customers |
| Keep records of sales | Compliance with our legal obligations |
We do not rely on consent for any of the above, because none of it is optional
to providing the service you asked for. We do not send marketing email, so there
is nothing here to opt out of.
## Where your data goes
Besday is operated from the United States and our service providers — Amazon
Web Services, Kie and Stripe — process data in the United States.
If you are in the EU or the UK, that is an international transfer. We rely on
the European Commission's Standard Contractual Clauses (and the UK Addendum
where the UK GDPR applies) in our agreements with those providers, and on the
EU-US and UK-US Data Privacy Framework where a provider is certified under it.
You can ask us for details of the safeguards that apply to a particular
provider.
## Cookies and consent
We set two cookies and both are strictly necessary to provide the service you
asked for: one keeps you signed in, the other links files you upload before you
have an account to your own browser so nobody else can reach them.
Strictly necessary cookies do not require consent under the ePrivacy rules,
which is why you do not see a cookie banner. If we ever add analytics or
advertising cookies, we will ask first.
## Your rights
Wherever you live, you can ask us to:
- **tell you what we hold** about you, and give you a copy
- **correct** anything that is wrong
- **delete** your account and its data
- **export** your data in a portable format
- **restrict or object** to a particular use of it
If you are in the EU or the UK you have these rights under the GDPR or UK GDPR,
including the right to lodge a complaint with your national data protection
authority. In the UK that is the Information Commissioner's Office.
If you are in California or another US state with a comprehensive privacy law,
you have equivalent rights to know, delete, correct and port your data, and to
opt out of the sale or sharing of personal information for targeted advertising.
**We do not sell or share personal information, and we never have**, so there is
nothing to opt out of. We will not discriminate against you for exercising any
right.
## How to exercise them
Email support@besday.com from the address on your account. We will respond
within thirty days. We may ask you to confirm who you are before we act on a
request about someone's data, and we may keep the minimum records we are
required to keep for accounting and fraud prevention even after deleting an
account.
You may use an authorised agent to make a request on your behalf; we will ask
for proof that you authorised them.
## Children
Besday is for businesses and is not directed at children. We do not knowingly
collect data from anyone under 16. If you believe a child has given us data,
write to us and we will delete it.
## Changes to this policy
If we change how we handle your data, we will update this page and change the
date at the top. If a change is significant, we will email account holders.
## Contact
support@besday.com