Last updated: 30 September 2026

Beans Tech Ltd ("Beans", "we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store and share information about you when you visit beans.tech, use the Beans platform, or take part in an event supported by Beans.

We are the data controller for the purposes of UK GDPR and the Data Protection Act 2018. Beans Tech Ltd is registered in England and Wales. Our senior officer responsible for data protection is Alistair William Lilly, Co-founder and Director. Contact us at privacy@beans.tech.

1. Who this policy applies to

This policy is in two parts.

Part A covers the Beans platform and our services:

• Community organisers (hosts) who sign up to run sponsored events
• Brand and agency users who use Beans to discover and sponsor community events
• Event attendees who claim a partner offer, RSVP to an event, or appear in event content

Part B covers visitors to our marketing website at beans.tech.

Part A: The Beans platform

2. What data we collect

2.1 Community organisers

When you create and manage a Beans account we collect:

• Name and email address
• Mobile number (used to contact you on WhatsApp)
• Your community's name, activity type, typical attendance and community channel details (for example, how many members are in your group chat)
• Your community's Instagram handle and, if you choose to connect it, the data described in 2.4
• Club or event location (venue address or postcode). Where an event takes place in your home, we use the address only to deliver campaign materials to you. Brands and agencies receive the city or region of your events, never the address.
• Event details you add: name, date, time, location, expected attendance
• Event content you upload: photos and short videos from your events
• Payout details, held by Stripe, our payment provider (see section 5). Beans does not store bank account details.

Sign-in is via Google. Beans does not hold your password.

2.2 Brand and agency users

Name, work email address, job title and employer, plus the campaign and brief information you provide.

2.3 Event attendees

If you RSVP to an event through a Beans link shared by your community organiser, we do not ask for your name or contact details. You answer two questions: whether you plan to attend, and whether you are happy to appear in photos and video shared with the partner brand.

If you claim a partner offer on a Beans event page, we do not ask for your name or contact details. We record the time of the claim, how you reached the page (link, QR code or NFC tag) and a random identifier stored on your device to prevent duplicate claims. We do not collect your location, and we do not set advertising or analytics cookies on event pages.

Some campaigns include a Beans-built web page for guests at an event, for example to join an activity or see a message from the partner brand. These pages do not ask for your name or contact details, set only the strictly necessary cookies needed to work, and carry no third-party tracking.

If you attend an event, you may appear in photos and video taken by the host or, for some campaigns, by a production crew commissioned by Beans and working under contract to us. Your host will tell you before and at the event that content is being captured and may be shared with the partner brand. You can opt out by telling the host on the day, and you can ask for content to be removed at any time (section 8).

From time to time your community organiser may share an anonymous survey asking about the demographics, interests or brand views of the community, sometimes on behalf of a partner brand. These surveys do not ask for your name or contact details, do not record your IP address or device, and responses cannot be linked to you. Results are reported in aggregate only.

2.4 Connected Instagram accounts

If you connect your community's Instagram account to Beans, we receive from Meta the account's username, profile picture, follower count and account type, your recent posts (caption, image or video thumbnail, link and posting time) and their performance metrics (reach, views, likes, comments, saves and shares). We only receive this after you approve it on Instagram's own consent screen, and only for the account you choose to connect.

We use this data to show your community's recent posts and audience reach to brands considering or running a sponsorship with you, and to report on sponsored posts you attach to a campaign. We store the access token Instagram gives us encrypted, refresh it automatically and never share it. We do not post on your behalf, read your messages or access other people's accounts. You can disconnect at any time from Profile > Socials in the Beans app, or by removing Beans under Instagram > Settings > Website permissions > Apps and websites. Either revokes our access immediately. To have all Instagram-derived data deleted, disconnect and email privacy@beans.tech, or use Instagram's "Delete data" option for Beans, which we honour automatically.

3. How we use your data and our lawful bases

• Creating and managing organiser and brand accounts, matching communities with sponsors, running campaigns and paying hosts. Data: Organiser and brand data (2.1, 2.2). Lawful basis: Performance of a contract
• Sharing your community's name, your name as organiser and your Instagram handle with the sponsoring brand and its agency, so they can plan the activation and amplify your content. Data: Organiser name, community name, Instagram handle. Lawful basis: Performance of a contract
• Confirming attendance and preventing duplicate offer claims. Data: Timestamp, source and device identifier for offer claims and RSVPs (2.3); no names. Lawful basis: Legitimate interests
• Understanding how community groups index against contextual, demographic and behavioural audience segments, to help brands choose communities. Data: Community-level profile data declared by organisers (activity type, size, location, chat size) and anonymous survey results. Lawful basis: Not personal data
• Verifying that an event took place and how many people attended, and evidencing delivery to the sponsoring brand. Data: Group event photos and video. Lawful basis: Legitimate interests (incidental appearance); consent (featured individuals)
• Using event content on the host's, Beans' and the partner brand's channels. Data: Event photos and video. Lawful basis: Consent, collected before and at the event
• Reporting campaign results to brands. Data: Aggregated attendance counts and anonymised survey results. Lawful basis: Not personal data
• Sending you marketing about Beans. Data: Email address. Lawful basis: Consent (opt-in, withdraw at any time)
• Communicating with brand and agency contacts. Data: Business contact details. Lawful basis: Legitimate interests
• Keeping payment, invoicing and tax records. Data: Transaction records. Lawful basis: Legal obligation

Where we rely on legitimate interests we have completed a Legitimate Interests Assessment, available on request from privacy@beans.tech.

4. Who we share your data with

Sponsoring brands and their agencies. For each campaign, the brand and its media agency receive your community's name, your name as organiser, your community's Instagram handle, the city or region of your events, aggregated attendance and reach figures, anonymised audience insight, and event photos and video supplied as evidence of delivery. They never receive home or venue addresses, attendee identities, or any individual-level data. Content featuring an identifiable individual is only shared where that individual has given consent.

Your community organiser. Your host can see how many people have RSVP'd to or claimed an offer at their event, not who.

Delivery partners. Where a campaign includes materials sent to you as a host, your delivery address is shared with our courier for that delivery only.

We do not sell personal data and we do not share it with data brokers or advertising networks.

5. Service providers

We use the following providers to run the platform. Each processes data only on our instructions and under a written contract.

• Supabase. Purpose: Database, authentication and file storage. Location: EU (Frankfurt)
• Vercel. Purpose: Hosting the Beans web apps. Location: EU and US edge network, with UK-approved safeguards
• Render. Purpose: Hosting the Beans API. Location: EU (Frankfurt)
• Google. Purpose: Sign-in (OAuth), Workspace email, Maps for venue addresses. Location: UK/EU/US under Google's UK data transfer addendum
• Meta (WhatsApp Business Platform, Instagram API). Purpose: Messaging with organisers; connected Instagram accounts. Location: EU/US under Meta's UK data transfer addendum
• n8n. Purpose: Workflow automation for organiser onboarding messages. Location: EU
• Stripe. Purpose: Our payment provider for host payouts. Stripe is authorised by the FCA. Beans never sees or stores bank details. Location: UK/EU/US under Stripe's data transfer terms
• Brevo. Purpose: Welcome and, with your consent, marketing email. Location: EU
• Resend. Purpose: Account emails such as password resets. Location: EU/US under Resend's data transfer terms
• Couriers and production crews (campaign-specific, named on request). Purpose: Delivering campaign materials to hosts; filming at selected events under contract to Beans. Location: UK

Where a provider processes data outside the UK we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and on the UK adequacy decision for the EU.

6. How long we keep your data

• Organiser and brand account data. While your account is active, then deleted within 30 days of closure unless we must keep it by law
• Offer claims, RSVPs and campaign page interactions (no names held). 12 months after the campaign closes, then deleted. We keep the total number per event, which contains no personal data.
• Event photos and video. 24 months after the campaign closes, then deleted, unless the host asks us to keep it
• Instagram-derived data. While connected; posts and metrics attached to a completed campaign are kept for 24 months for reporting
• Marketing consent. Until you withdraw it
• Payment, invoicing and tax records. 6 years, as required by HMRC
• Brand and agency contact details. Duration of the relationship plus 24 months

7. Security

Data is encrypted in transit and at rest. Access to personal data is limited to the Beans founding team and controlled by role. Hosts can only see data for their own community and events, enforced by row-level security in our database. Sign-in uses Google with multi-factor authentication for Beans staff. We review access and our providers' security certifications at least annually.

8. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Restrict or object to how we process your data
• Receive your data in a structured, machine-readable format
• Withdraw consent at any time, where processing is based on consent

To exercise any of these rights, email privacy@beans.tech. We respond within 30 days.

If you ask us to remove event content in which you appear, we will remove it from Beans' channels within 5 working days and require the partner brand to do the same.

Part B: Visitors to beans.tech

9. Website analytics and cookies

Our marketing website at beans.tech is hosted on Webflow, which processes technical data including IP addresses as part of hosting the site.

With your consent, we use the following tools on the marketing website to understand how it is used and to measure our advertising:

• Google Analytics. Pages visited, device and browser type, approximate location derived from IP address, and referral source.
• Microsoft Clarity. Session recordings and heatmaps showing how visitors interact with pages. Form inputs are masked.
• Meta Pixel. Measures the effectiveness of our advertising on Meta platforms.

These tools are only loaded after you accept non-essential cookies in the banner shown on your first visit. You can change your choice at any time via the Cookie preferences link in the footer. Google, Microsoft and Meta may transfer data to the US under the UK Extension to the EU-US Data Privacy Framework or Standard Contractual Clauses.

None of these tools run on the Beans platform, event pages or RSVP pages, which set only the strictly necessary cookies needed for sign-in and to prevent duplicate offer claims.

10. Children

Beans is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. Hosts are asked not to feature children in event content. If you believe we have inadvertently collected data from a minor, contact privacy@beans.tech and we will delete it promptly.

11. Changes to this policy

We may update this policy from time to time. We will notify registered users of material changes by email. The date at the top of this document always reflects the most recent revision.

12. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113. We would appreciate the chance to resolve your concern first: please contact privacy@beans.tech.

13. Contact us

Email: privacy@beans.tech

Company: Beans Tech Ltd

Website: beans.tech