Skip to content
Legal

Data Processing Agreement

Draft of November 13, 2026. Soonbeam is a trade name of Beeylo.

Draft, not yet in force This is a draft, still to be reviewed by a lawyer. Until the final version is published here, the section “Your contacts' details” in our Terms of Service applies.

Soonbeam reads the mail in the mailbox you connect. That mail contains personal data of other people: your customers, suppliers and other contacts. For that data you decide why and how it is used, and Soonbeam works on your behalf. The GDPR (article 28) requires an agreement for that. This is it. It is part of our Terms of Service and applies once it has been published as final.

1. Who this is between

  • You, the customer: the business or professional that uses Soonbeam and connects a mailbox. You are the controller.
  • Beeylo, Rucphenseweg 38, 4882 KC Klein Zundert, the Netherlands, Chamber of Commerce (KvK) number 42050169. Beeylo trades as Soonbeam (“Soonbeam”) and was previously called Beeylo. Soonbeam is the processor.

Your own account details (your email address, sign-in data, settings) are not covered by this agreement. For those Soonbeam is the controller, as set out in our Privacy Policy.

2. What Soonbeam does with the data, and why

Soonbeam processes personal data only to provide Soonbeam to you. In practice:

  • reading the mail in the mailboxes you connect, and keeping a copy of it;
  • working out what each conversation asks for: what needs doing, from whom, by when, and for how much;
  • preparing replies in your words, which you check and send yourself;
  • sending a reply from your own mailbox, only after you press Send;
  • keeping your mailbox in step with what you do in Soonbeam: marking as read, archiving, moving to the trash;
  • keeping the facts about your business that you approve, and learning how you write;
  • showing a notification on your phone when new mail needs you.

Soonbeam does not use the data for anything else. No advertising, no profiling, no selling, and no training of AI models. Training on the data is switched off at both AI providers we use, Mistral and Anthropic, so it is never used to train a language model.

3. Whose data, and which data

People involved

  • people who email you or whom you email: customers, prospects, suppliers, partners and other contacts;
  • people named in that mail or in its attachments;
  • colleagues in your team, if you use Soonbeam with a team.

Types of data

  • names, email addresses and other contact details (for example in a signature);
  • the content of mail: subject, date, text, and attachments up to 10 MB, including text read from PDF files;
  • business details in that mail, such as amounts, invoice numbers, due dates and payment links;
  • what Soonbeam works out from the mail: a summary of what is needed, the language, whether the sender writes formally, whether the sender is a person or an organisation, and a numeric fingerprint of the text to find similar questions;
  • facts about your business that you approve, which may mention a contact by name;
  • in a push notification: the sender's name and the subject.

Soonbeam does not ask for special categories of personal data (such as health data). Mail can still contain them, because Soonbeam cannot control what people send you. Such data gets the same protection as all other mail.

4. How long

This agreement runs as long as you have a Soonbeam account. Some duties, such as confidentiality and deletion, continue until all data has been deleted.

5. Your instructions

  • Soonbeam processes the data only on your instructions. Your instructions are these terms, this agreement, and what you do in the app: connecting a mailbox, sending a reply, archiving, disconnecting, deleting your account.
  • Soonbeam does not process the data in any other way, unless the law requires it. In that case Soonbeam tells you first, unless the law forbids that.
  • If Soonbeam believes an instruction breaks privacy law, Soonbeam tells you.

6. Confidentiality

Everyone at Soonbeam who can access the data is bound to keep it confidential. Nobody at Soonbeam reads your mail, unless you ask us to for support, it is needed for security, or the law requires it.

7. How Soonbeam protects the data

Soonbeam takes these measures, and keeps them up to date:

  • Encrypted connections. All traffic between the app, our server, your mail provider and our service providers is encrypted.
  • Encrypted mailbox access. Mailbox passwords and Google and Microsoft sign-in tokens are encrypted separately. The key is not in the database: only our server holds it, and only our server can unlock them. They never reach the app or our logs.
  • Encryption at rest. The database and file storage are encrypted on disk by our database provider.
  • Each account sees only its own data. Database rules check every request against the signed-in user. Attachments are stored privately, in a separate folder per user. In a team, a colleague sees a mailbox only when it is explicitly shared with them, and loses access as soon as they leave the team.
  • No more access than needed. For Gmail, Soonbeam asks for permission to read, label and send mail, not to delete it permanently. Soonbeam never sends anything without your action. The AI model has no access to your mailbox and cannot send anything.
  • Secure sign-in to mailboxes. Connecting a Google or Microsoft mailbox uses a signed, one-time, short-lived request bound to your browser.
  • Hosting in the EU. The database and files are in Frankfurt (Germany), the server runs in Amsterdam (the Netherlands), and AI processing takes place in the EU.
  • Logs without personal data. Our technical logs contain no email addresses, passwords, user identifiers in plain text or mail content. Crash reports go to an EU server and contain only the kind of error and where it happened.
  • Limits. Sign-in attempts and use of the service are limited to prevent abuse.
  • Separate systems. Soonbeam has its own database, separate from the earlier Soonbeam app for consumers.
  • Backups. Our database provider makes daily backups.
  • Access by staff. Only the people at Soonbeam who need it for their work can access the production systems, each with a personal account.

8. Who helps us

You give Soonbeam general permission to use the service providers below (sub-processors). Soonbeam binds each of them to data protection obligations that are at least as strict as those in this agreement, and remains responsible to you for their work.

  • Supabase: database, sign-in and file storage. Servers in Frankfurt, Germany.
  • Railway: runs the Soonbeam server. EU West region, Amsterdam, the Netherlands.
  • Mistral AI (France): AI processing of mail text, to read it and prepare replies. EU hosting. Use of our data for training is switched off; Mistral keeps the data for up to 30 days to detect abuse, then deletes it.
  • Anthropic PBC (United States): its Claude language models write replies, using the text of the mail, the conversation and what you chose. Anthropic does not use data sent through its API to train its models; it deletes that data within 30 days, unless it must keep it longer to enforce its usage policy or to comply with the law.
  • Google Firebase Cloud Messaging: delivers push notifications (sender name and subject), on an iPhone through Apple's push service.
  • Sentry: crash reports, on servers in the EU (Germany). No mail, addresses or identities.
  • Resend: sends Soonbeam's own emails, such as sign-in links and team invitations. Your mail and replies never pass through Resend.

Not sub-processors: Google, Microsoft or your own mail provider, which you chose to host your mailbox, and Cloudflare, which hosts our website but processes none of your mail.

Changes. Before Soonbeam adds or replaces a sub-processor, Soonbeam tells you by email at least 30 days in advance. You can object within that time, with a reason. If we cannot find a solution together, you can end your use of Soonbeam and delete your account, at no cost.

9. Data outside the EU

Your mail, attachments and what Soonbeam knows are stored in the EU. Some providers are American companies, so data can be accessed from outside the EU, for example for support and maintenance, or because a notification or email passes through their systems. Soonbeam allows that only with a valid safeguard:

  • Supabase, Railway, Resend: standard contractual clauses of the European Commission in their data processing terms.
  • Sentry, Google (Firebase), Apple: EU-US Data Privacy Framework and/or standard contractual clauses.
  • Anthropic: US company: standard contractual clauses of the European Commission, in its data processing terms.
  • Mistral AI: EU company, EU hosting. Where Mistral's own providers process data outside the EU, Mistral says it uses standard contractual clauses.

10. Helping you

  • Requests from people. If one of your contacts asks to see, correct or delete their data, you can do part of it in the app, such as editing or removing facts about your business. For anything else, Soonbeam helps you within a reasonable time. If such a request reaches Soonbeam directly, Soonbeam forwards it to you and does not answer it on your behalf.
  • Assessments. If you need to carry out a data protection impact assessment (DPIA) or consult a supervisory authority, Soonbeam gives you the information you need about how Soonbeam works.

11. Data breaches

If Soonbeam discovers a breach of security that affects your data, Soonbeam tells you without undue delay, and no later than 48 hours after discovering it. Soonbeam tells you what happened, which data and people are likely affected, what the likely consequences are, and what Soonbeam has done or will do about it. If not everything is known yet, Soonbeam sends what it has and follows up. You decide whether to report it to the supervisory authority and the people involved; Soonbeam helps you with that.

12. Audits

  • On request, Soonbeam first gives you documentation showing that it meets this agreement, such as a description of the measures above and any assessment reports.
  • If that is not enough, you can have an audit carried out, at most once a year, with at least 30 days' notice, by an independent auditor bound to confidentiality, during business hours, and without access to other customers' data.
  • You bear the cost of the audit, unless it shows that Soonbeam seriously failed to meet this agreement.
  • A supervisory authority can always carry out an audit when it is entitled to.

13. At the end

  • Your mail stays in your own mailbox. Soonbeam never deletes it there.
  • Soonbeam erases a case, with its mail, attachments and replies, when nothing has happened on it for 12 months. Mail that never became a case is erased 12 months after it arrived. Facts about your business stay.
  • If you disconnect a mailbox, Soonbeam stops reading it at once and deletes the stored password or sign-in token. For Google, Soonbeam also withdraws its access to your Google account.
  • If you delete your account (in the app at the bottom of Settings, or on our account deletion page), Soonbeam deletes right away all data covered by this agreement: mailboxes, mail, attachments, cases, replies, facts and writing preferences. Facts you shared with a team stay with that team.
  • Want a copy first? Email [email protected] before you delete your account, and Soonbeam sends it within one month.
  • Copies in database backups disappear as those backups are replaced. Until then they are not used.
  • Soonbeam keeps data longer only where the law requires it.

14. Liability

The limits of liability in our Terms of Service also apply to this agreement. Each party remains responsible for fines that a supervisory authority imposes on it for its own part.

15. Other terms

  • If this agreement and the Terms of Service conflict on personal data, this agreement wins.
  • Soonbeam may update this agreement, for example when the law changes or a provider changes. For significant changes Soonbeam tells you by email or in the app before they take effect.
  • This agreement is governed by Dutch law, like the Terms of Service.

Contact

Questions about this agreement? Email us at [email protected].