Privacy Policy

This Privacy Policy forms part of the Governance Framework for been. It should be read alongside GOV-001 – Our Commitment, GOV-002 – Ethical Principles of been, GOV-003 – AI Transparency Statement, and the remaining governance documents. Together, these documents explain how been is designed, governed, and operated to support the responsible, transparent, and ethical use of the Companion.

1. Purpose

Respect for privacy begins with respect for the person.

This Privacy Policy explains how been collects, uses, stores, protects, retains, and manages participant information. Its purpose is to provide clear and transparent information about what information may be collected, why it is collected, how it is used, how it is protected, and the choices available to participants regarding their personal information.

Privacy is a fundamental ethical commitment of been. Protecting participant information is not only a legal responsibility but also an essential expression of respect for the trust participants place in the Companion. Information is collected only to the extent reasonably necessary for clearly communicated and ethically justified purposes.

Whenever reasonably possible, been follows the principle of data minimization by collecting only the information necessary to provide the Companion, maintain its security and reliability, support responsible governance, and improve the methodology through appropriate evaluation and research.

The way information is handled should always reflect the same commitments that guide every conversation: respect for autonomy, transparency, restraint, and participant ownership.

For the purposes of applicable data protection law, the data controller responsible for participant information described in this policy is Doaa Samir Bazan, reachable at hello@beencompanion.app.

2. Scope

This Privacy Policy applies to all individuals who access or use been, including registered users, and individuals who interact with the Companion through official applications, websites, or other supported platforms.

The policy applies to participant information collected through the normal operation of the Companion, including:

• participant accounts;
• conversations;
• Journal entries;
• feedback and evaluation forms;
• support communications;
• approved research participation; and
• other services provided as part of been.

This Privacy Policy also applies to information processed in connection with maintaining the security, reliability, governance, and responsible operation of the Companion.

This policy does not apply to third-party services that operate independently of been. Where participants choose to use external authentication providers or other third-party services, those services remain subject to their own privacy policies, terms of use, and data handling practices.

Where third-party providers process information on behalf of been, they are expected to do so only for the purposes of supporting the operation of the Companion and in accordance with appropriate contractual, security, and privacy obligations.

3. Information We Collect

The information collected by been depends on how participants choose to use the Companion. Wherever reasonably possible, participants decide what information they wish to provide.

been follows the principle of data minimization. Only information reasonably necessary to provide the Companion, maintain its security and reliability, support responsible governance, and improve the service through appropriate evaluation and research is collected.

Account Information

Where participant accounts are used, been may collect information necessary to create, maintain, and secure an account, including:

• name or chosen display name;
• email address;
• authentication information (such as sign-in through supported identity providers); and
• account preferences and settings.

Only the information reasonably necessary to provide and secure the service is collected.

Purchase, License, and Access Information

When a participant purchases or activates paid access, been may process information needed to verify the purchase, prevent reuse of a license key across accounts, and maintain the participant’s access. This may include:

• the purchaser email address supplied by the payment provider;
• a product reference;
• the date associated with the purchase or issue of the license;
• verification and redemption dates;
• access start and end dates;
• redemption status; and
• a one-way cryptographic hash of the license key.

The license key entered by the participant is transmitted securely to Payhip for verification. been does not store the raw license key in its license-redemption record. Payment-card or payment-account details are processed by the applicable payment provider and are not received or stored by been.

Conversation and Journal Information

Participants may voluntarily share information while interacting with the Companion.

Depending on how the Companion is used, this may include:

• conversation text;
• Journal entries;
• reflections;
• responses to prompts; and
• other information intentionally entered by the participant.

Participants remain responsible for deciding what they choose to share. The Companion does not require participants to disclose personal information beyond what they voluntarily provide.

Because conversations and Journal entries are central to the participant's experience, they are treated with particular care and are handled in accordance with the commitments described throughout this Privacy Policy and the wider Governance Framework.

Voice-to-Text Information

Participants may choose to use the optional voice-to-text feature as an alternative way of entering text into the conversation composer.

When this feature is used, microphone audio is captured temporarily and transmitted to an artificial intelligence transcription service for the purpose of converting speech into text. The resulting transcript is returned to the participant's composer, where it can be reviewed, edited, deleted, or discarded before being sent.

been does not automatically send a voice transcript as a message. A transcript becomes part of the conversation only when the participant chooses to send it using the normal Send function.

Audio submitted for transcription is not stored in been's database, conversation history, or Journal. been does not use the audio itself as conversational input to the Companion; only text that the participant chooses to send enters the normal conversational system.

Voice-to-text is optional. Participants may continue to use been entirely through typed text without enabling microphone access.

Technical Information

To maintain the security, reliability, performance, and responsible operation of the Companion, been may automatically collect limited technical information, including:

• device type;
• browser type;
• operating system;
• IP address;
• session information;
• error logs;
• diagnostic information; and
• basic service analytics.

This information is used only to:

• maintain service reliability;
• improve performance;
• protect platform security;
• detect, investigate, and resolve technical issues;
• support responsible system administration; and
• improve the safety and reliability of the Companion.

Technical information is not collected for behavioral profiling, advertising, or persuasive personalization.

Feedback and Support Information

Participants may voluntarily provide additional information through:

• feedback forms;
• support requests;
• evaluations;
• research questionnaires; and
• communications with the development, governance, or research team.

Providing this information is optional unless it is specifically required for participation in an approved research study.

Feedback provided by participants may contribute to the responsible improvement of the Companion, provided it is used consistently with the purposes described in this Privacy Policy.

Research Information

Participants who voluntarily take part in research activities involving been may be asked to provide additional information in accordance with the relevant Participant Information Sheet, Informed Consent Form, and any other approved research documentation.

Participation in research is voluntary. Choosing not to participate in research will not affect access to the Companion unless the service is explicitly offered as part of a research-only study.

Where reasonably possible, research activities will use de-identified or anonymized information, and all research involving participant information will be conducted in accordance with the ethical commitments, governance framework, and applicable legal and institutional requirements governing the project.

4. Why We Collect Information

been collects and processes participant information only for legitimate, transparent, proportionate, and ethically justified purposes.

Information is collected only to the extent reasonably necessary to provide the Companion, protect its operation, fulfil legal and ethical responsibilities, and support its responsible development. The purposes for which information may be processed include:

• providing, maintaining, and improving the Companion;
• creating, securing, and managing participant accounts;
• verifying license keys and recording their redemption;
• preventing the same license key from being activated by more than one been account;
• calculating and maintaining paid access periods, including additional one-year periods purchased before existing access expires; and
• administering purchase records, access enquiries, disputes, and refund requests;
• supporting conversations and Journal functionality;
• maintaining the security, stability, reliability, and performance of the service;
• responding to participant questions, support requests, and feedback;
• identifying, investigating, and resolving technical or operational issues;
• evaluating and improving the quality, safety, and methodological integrity of the Companion;
• conducting ethically approved research where appropriate consent or another valid legal basis has been established; and
• complying with applicable legal, regulatory, and contractual obligations;
• processing optional voice input solely to generate an editable text transcript requested by the participant.

Information is not collected or processed for purposes that are incompatible with these objectives without appropriate notice and, where applicable, an appropriate legal basis and participant consent.

In particular, been does not collect or use participant information to:

• manipulate behavior or emotional states;
• personalize persuasive content;
• maximize engagement through behavioral optimization;
• sell participant information; or
• use participant information in ways that are inconsistent with the commitments described throughout the Governance Framework.

Every purpose for which participant information is collected should ultimately support the Companion's intended role: creating conditions that respect participant autonomy, preserve ownership of meaning, and maintain trust.

5. How We Use Your Information

Participant information collected through been is used only for purposes that are consistent with the operation, governance, security, and responsible development of the Companion.

Depending on how participants use the service, participant information may be used to:

• provide access to the Companion and its features;
• create, maintain, and secure participant accounts;
• verify a Payhip license key server-side and associate a valid unused key with the participant’s been account;
• maintain the participant’s access start and end dates and add an additional 365-day period where another valid unused key is activated; and
• support purchase, access, dispute, and refund enquiries;
• support conversations and Journal functionality;
• maintain the security, reliability, performance, and stability of the service;
• identify, investigate, and resolve technical or operational issues;
• respond to participant enquiries, feedback, and support requests;
• evaluate and improve the methodology, safety, governance, and implementation of the Companion;
• conduct ethically approved research where an appropriate legal basis and, where required, informed participant consent have been established; and
• comply with applicable legal, regulatory, and contractual obligations;
• transcribe participant-initiated voice input into editable text when the optional voice-to-text feature is used.

Voice recordings submitted through the voice-to-text feature are used only for transcription and are not used by been as conversational content. The participant determines whether the resulting text becomes part of a conversation by reviewing it and choosing whether to send it.

Information is processed only for the purposes described in this Privacy Policy and only to the extent reasonably necessary to fulfil those purposes.

been does not use participant information to:

• manipulate behavior or emotional states;
• personalize persuasive content;
• optimize conversations for engagement, retention, or commercial objectives;
• build behavioral profiles for advertising purposes; or
• use participant information in ways that are inconsistent with the commitments described throughout the Governance Framework.

The use of participant information should always support the Companion's intended purpose while strengthening its safety, reliability, transparency, and methodological integrity.

6. Research Use of Information

One of the long-term goals of been is to contribute to the scientific understanding of perception, recognition, conversational methodology, and the responsible application of Naming Intact Perception (NIP). Research is therefore regarded as an integral part of the Companion's responsible development and continuous evaluation.

Where participant information is used for research purposes, this will occur only under appropriate ethical governance and, where required, with informed participant consent or another appropriate legal basis. Research activities will be conducted in accordance with applicable ethical standards, institutional requirements, and relevant legal obligations.

Participants will be informed whenever their information may contribute to research. Participation in research remains voluntary unless the Companion is explicitly offered as part of an approved research study.

Whenever reasonably possible, research will use information that has been de-identified, anonymized, or otherwise processed to reduce the risk of identifying individual participants. Research findings will be reported in ways that protect participant privacy and confidentiality.

Participant information will never be sold, shared for unrelated commercial research, or used in ways that are inconsistent with the purposes described in this Privacy Policy or the ethical commitments established throughout the Governance Framework.

Research involving been is intended not only to evaluate the Companion, but also to improve its methodology, governance, safety, and implementation through responsible scientific inquiry. Every research activity should ultimately strengthen the Companion's ability to respect participant autonomy, preserve ownership of meaning, and maintain public trust.

7. Data Storage and Security

been is committed to protecting participant information through appropriate technical, organizational, and administrative safeguards.

Reasonable measures are implemented to help protect participant information against unauthorized access, disclosure, alteration, loss, misuse, or accidental destruction. Depending on the architecture of the Companion, these measures may include:

• secure authentication;
• encrypted communication;
• access controls based on operational need;
• secure hosting and infrastructure;
• system monitoring and logging;
• routine software updates and security maintenance; and
• other security practices appropriate to the nature of the information being processed.

Security measures are selected with the objective of supporting the confidentiality, integrity, and availability of participant information while maintaining the reliable operation of the Companion.

Although every reasonable effort is made to safeguard participant information, no method of electronic storage, internet transmission, or information processing can guarantee absolute security. Participants should therefore recognize that all digital services involve some degree of inherent risk.

As been continues to evolve, its security practices may also develop in response to new technologies, emerging risks, legal requirements, and recognized security standards. Significant changes affecting the protection of participant information may be reflected through updates to the Governance Framework and related documentation.

Further information regarding the technical safeguards supporting been is provided in the Security & Infrastructure Statement.

8. Sharing of Information

been does not sell, rent, trade, or license participant information.

Participant information is shared only when reasonably necessary to operate the Companion responsibly, fulfil legal or contractual obligations, protect participant safety, or support the services required for the operation of been.

Depending on the implementation of the Companion, participant information may be shared with trusted service providers supporting functions such as:

• secure cloud hosting;
• user authentication;
• artificial intelligence infrastructure;
• data storage;
• technical maintenance;
• security monitoring;
• system analytics; and
• other operational services necessary to provide and maintain the Companion;
• voice-to-text transcription.
• payment processing, purchase administration, and license verification through Payhip for one-year access purchases.

When a participant chooses to use the voice-to-text feature, the audio recording is transmitted to the transcription service used by been solely for the purpose of generating the requested text transcript. The audio is not stored in been's database, conversation history, or Journal.

Current one-year access purchases are made through Payhip. Payhip processes the purchase on its platform under its own terms and privacy practices. After purchase, the participant receives a unique license key. When the participant enters that key in been, the key is sent securely from been’s server to Payhip for verification. been receives the verification information needed to confirm the key and establish access, including the product reference, purchaser email address, license status, usage information, and issue date. been stores a one-way cryptographic hash of the key, rather than the raw key, together with the information needed to record redemption and maintain the applicable access period.

Conversation content and Journal entries are never provided to Payhip: payment processing and license verification involve no access to what participants share with the Companion.

Where third-party providers process participant information on behalf of been, they are expected to do so only for authorized purposes and in accordance with appropriate contractual, security, confidentiality, and privacy obligations.

Participant information may also be disclosed where required by applicable law, legal process, regulatory obligation, or where reasonably necessary to protect the rights, safety, or security of participants, the public, or the Companion itself.

Outside these circumstances, participant information will not be shared without the participant's knowledge or, where applicable, an appropriate legal basis or participant consent.

Whenever third-party services support the operation of been, the project seeks to work with providers that maintain appropriate standards of security, privacy, and responsible data handling consistent with the ethical commitments described throughout the Governance Framework.

9. Data Retention

Participant information is retained only for as long as reasonably necessary to provide the Companion, fulfil the purposes described in this Privacy Policy, comply with applicable legal and regulatory obligations, maintain the integrity of approved research activities, resolve disputes, or protect the security, reliability, and operation of the service.

Audio captured through the optional voice-to-text feature is processed transiently for transcription and is not retained in been's database, conversation history, or Journal. Further information is provided in the Data Retention & Deletion Policy.

Different categories of participant information, including purchase, license-verification, redemption, and access-entitlement records, may be retained for different periods depending on their purpose, legal requirements, operational needs, or approved research activities. The specific retention periods and deletion procedures applicable to different categories of information are described in the Data Retention & Deletion Policy, which forms part of the Governance Framework for been.

When participant information is no longer required for these purposes, reasonable steps will be taken to securely delete, de-identify, anonymize, or otherwise dispose of it in accordance with applicable legal, ethical, organizational, and technical requirements.

The retention of participant information is guided by the principle of proportionality. Information should not be retained longer than reasonably necessary for the purposes for which it was collected.

10. Your Rights

been respects the right of participants to understand, access, and, where applicable, exercise control over their personal information.

Depending on the laws that apply to your location and the way you use the Companion, you may have the right to:

• request access to the personal information held about you;
• request correction of inaccurate or incomplete information;
• request deletion of your personal information, subject to applicable legal, contractual, operational, or research obligations;
• withdraw consent where consent is the legal basis for processing;
• object to or request restriction of certain forms of processing where permitted by applicable law;
• request information about how your personal information has been collected, used, stored, shared, or retained; and
• contact been with questions or concerns regarding the handling of your personal information.

Requests relating to personal information will be considered in accordance with applicable laws, ethical obligations, and the operational requirements of the Companion. In some circumstances, requests may be limited where information must be retained to:

• comply with legal or regulatory obligations;
• protect the security, integrity, or operation of the Companion;
• preserve the integrity of approved research activities;
• safeguard the rights, privacy, or safety of other participants; or
• fulfil other legitimate obligations permitted by applicable law.

Where a request cannot be fully accommodated, been will seek to explain the reason whenever appropriate and legally permitted.

Respecting participant rights is not only a legal responsibility but also an expression of the transparency, autonomy, and dignity that guide the Governance Framework of been.

11. Children's Privacy

been is designed primarily for adults and is not intended for use by children without the involvement and consent of a parent, legal guardian, or another person legally authorized to provide consent on their behalf.

The Companion is not intended to knowingly collect personal information from children in violation of applicable laws. If it becomes apparent that personal information has been collected from a child without the appropriate authorization or legal basis, reasonable steps will be taken to delete that information in accordance with applicable legal and ethical requirements.

Parents, guardians, or other legally authorized representatives who believe that a child may have provided personal information through been are encouraged to contact the team so that the matter can be reviewed and, where appropriate, addressed promptly.

If been is ever developed specifically for children or younger users, those services will be governed by separate privacy policies, consent procedures, and safeguarding measures appropriate to their age, developmental needs, applicable laws, and ethical requirements.

Protecting children's privacy requires additional care, and been is committed to applying appropriate safeguards whenever services involve younger users.

12. International Use

been may be accessed by participants from different countries and jurisdictions. As a result, participant information may be processed, stored, or transferred in countries other than the participant's country of residence, depending on the technical infrastructure supporting the Companion and the third-party services used to operate it.

Where international processing or transfer of participant information occurs, been seeks to implement appropriate safeguards consistent with applicable privacy laws, recognized security standards, and responsible data governance practices.

Participants should be aware that privacy rights, legal protections, and regulatory requirements may differ between jurisdictions. Regardless of where participant information is processed, been remains committed to the ethical principles, privacy commitments, and governance standards described throughout the Governance Framework.

Where reasonably practicable, international transfers of participant information will be supported by appropriate contractual, organizational, technical, or legal safeguards designed to protect participant information throughout its lifecycle.

The location in which participant information is processed does not alter been's commitment to transparency, participant autonomy, responsible stewardship, and respect for privacy.

13. Changes to This Privacy Policy

This Privacy Policy may be updated from time to time to reflect changes to the Companion, applicable laws, technological developments, research practices, governance processes, or operational requirements.

When changes are made, the revised version will indicate the updated version number and effective date. Where changes materially affect participant rights, privacy practices, or the handling of participant information, reasonable efforts will be made to inform participants before those changes take effect.

Where required by applicable law or ethical obligations, additional notice, renewed consent, or other appropriate measures will be provided before relevant changes are implemented.

Continued use of been after an updated Privacy Policy becomes effective constitutes acceptance of the revised policy, except where applicable law or ethical requirements require additional notice or consent.

Transparency includes communicating not only that changes have been made, but also why they have been made whenever those changes meaningfully affect participants or the operation of the Companion.

14. Contact

Questions, concerns, or requests relating to this Privacy Policy or the handling of participant information may be directed to the been team at:

Email: hello@beencompanion.app

Participants may contact us to:

• ask questions about this Privacy Policy;
• request access to or correction of their personal information;
• request deletion of personal information where applicable;
• exercise applicable privacy rights;
• raise privacy concerns or complaints;
• seek clarification regarding research participation or governance practices; or
• report concerns relating to the handling of participant information.

We are committed to responding to privacy-related enquiries respectfully, transparently, and within a reasonable timeframe. Where appropriate, we will also explain how requests are assessed, any limitations that apply, and the actions taken in response.

Protecting participant privacy is an ongoing responsibility. Every enquiry is treated with respect for the autonomy, dignity, and trust that participants place in been.

Conclusion

Protecting participant information is fundamental to maintaining the trust placed in been.

This Privacy Policy reflects our commitment to collecting, using, protecting, retaining, and managing participant information responsibly, transparently, and with respect for individual autonomy and dignity.

Privacy within been is not understood solely as a legal obligation. It is an ethical commitment that supports participant ownership, responsible stewardship, and trustworthy use of artificial intelligence.

As the Companion continues to evolve, the principles of transparency, proportionality, accountability, and respect for privacy will remain central to how participant information is managed. Every decision relating to participant information should strengthen—not weaken—the trust that participants place in the Companion.