Request access
EN DE

Privacy Policy

Last updated: 9 October 2026

1. Who is responsible

Bea and this website are run by:

Volve Solutions Pte Ltd
36 Robinson Road, #20-01 City House
Singapore 068877

Email: hello@bea.today

In this policy, “we” means Volve Solutions Pte Ltd.

2. Our role: controller or processor

For this website and for emails you send us, we are the controller.

For our contract with a company that uses Bea, and for the contact details of the people we deal with there, we are the controller as well.

When a company’s employees use Bea to submit and approve expense claims, the company decides what happens with their data. The company is the controller. We process the data on its behalf and on its instructions, as its processor under Article 28 GDPR, under a data processing agreement with the company.

If you use Bea through your employer, your employer is the first place to go with questions about your data. You can also write to us. We will pass your request on and help your employer answer it.

We do not use the data from claims for advertising.

3. Hosting of this website and the web app

This website is hosted by

Vercel Inc.
440 N Barranca Avenue #4133
Covina, CA 91723
United States

The Bea web app, where you sign in, is hosted by Vercel as well. When you open the website or the web app, Vercel processes technical connection data:

  • IP address
  • Date and time of access
  • Requested page or file
  • Referrer URL
  • Browser type and version
  • Operating system and device information
  • HTTP status code

This is needed to deliver the website securely and reliably and to prevent misuse. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is a secure, reliable website.

Vercel runs a worldwide network of servers, so this data may also be processed outside the EU, in particular in the United States (see section 9). More in Vercel’s privacy notice.

4. Cookies and web analytics

This website sets no cookies and stores nothing in your browser. Its fonts are served from this website, not from a third party.

We use Vercel Web Analytics to count page views. It works without cookies. It processes:

  • Date and time of the page view
  • Page viewed
  • Referrer URL
  • Filtered URL parameters
  • Approximate location
  • Browser and operating system
  • Device type

To tell visitors apart, Vercel makes a hash from the incoming request. The hash is discarded after 24 hours. We see only totals, not individual visitors, and visitors are not followed across other websites.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is knowing which pages are used, so we can improve the website. More in the Vercel Web Analytics privacy documentation.

5. When you email us

If you email us, for example to request access to Bea, we use your email address, your name and what you write to answer you and, if your company wants to use Bea, to set up its access. Email to hello@bea.today is received through Google Workspace (see sections 8 and 9).

The legal basis is Article 6(1)(b) GDPR where your message concerns a contract or the steps before one, and Article 6(1)(f) GDPR otherwise. Our legitimate interest is answering the messages we receive.

6. Using Bea

Bea runs expense claims and approvals in Telegram. You send a receipt to the Bea bot, an approver approves or rejects the claim, and your company’s accounting inbox receives one PDF per approved claim. You also sign in to the Bea web app, for example once to connect Telegram to your account.

For everything in this section, we act for the company that uses Bea, as its processor (see section 2). For our own contract with that company, the legal basis is Article 6(1)(b) GDPR.

6.1 Your account

Your company sets up your account or invites you. The account can hold:

  • Name and email address
  • Role, such as submitter, approver or admin
  • Manager, approver and any stand-in during an absence
  • Department, city and hire date
  • Approval limit
  • Language and time zone
  • Whether the account is active, and when you last signed in or used the bot

Your company decides which of these it fills in.

You sign in with your email address, with a sign-in link or a password. Supabase sends the sign-in and invitation emails to that address. Passwords are stored only as a hash.

To connect Telegram, you sign in and open a one-time link to the bot. The link works for 15 minutes, and we store only a hash of it. Once connected, your Telegram user id is stored with your account.

If your company deactivates your account, you can no longer sign in or use the bot. The account and your claims are kept (see section 10).

6.2 The chat in Telegram

The Bea bot answers private chats only. From Telegram, we receive:

  • Your Telegram user id
  • The messages you send to the bot
  • The photos and files you send (receipt photos, PDFs, e-invoice XML files) and their file names
  • The buttons you tap

Bea uses the name in your account.

While you work on a claim, the bot keeps the conversation on our server: the recent messages, the details collected so far and the receipt it is working on. This is deleted automatically 24 hours after your last message to the bot.

Telegram (Telegram Messenger Inc.) processes your messages under its own terms, as an independent controller. We have no influence on that. More in Telegram’s privacy policy.

6.3 Claims and receipts

A claim holds:

  • Merchant, date, amount and currency
  • Category, project, business purpose and notes
  • Who paid: you personally, to be reimbursed, or a company card, shown by its last four digits
  • The supplier’s VAT ID and invoice number, where the receipt shows them
  • Status, approver, any rejection reason, and when it was reimbursed, with the reference

We store the receipt file exactly as you sent it, in private storage. A photo can carry details your phone added, such as where it was taken. These stay in the stored file.

You can open the receipt, as can your approvers, their delegates and anyone your company has given admin or audit access.

For a claim in another currency, Bea fetches the European Central Bank’s rate for the date from the Frankfurter service. That request contains only the date and the currencies, no personal data.

6.4 Reading receipts and messages

Bea uses models from OpenAI to read receipts and to understand what you write to the bot.

For a receipt, we send the image, or for a PDF a new copy of its first three pages, with your company’s category names. Before that, we remove location and other metadata from JPEG and WebP photos and from PDFs. E-invoices (XML) are read on our side and not sent to OpenAI.

For a message, we send your message, the last 20 messages of the conversation and the claim in progress, with your company’s categories, projects and legal entities. Your name is not part of the instructions we send, but a message can contain it.

OpenAI uses this data to send the result back to us. According to OpenAI, data sent to its API is not used to train or improve its models. OpenAI keeps logs to detect abuse for up to 30 days, unless the law requires it to keep them longer.

You see the details Bea has read before you submit a claim, and you can correct them.

6.5 Approvals and notifications

When you submit a claim, Bea sends it to your approver in Telegram. The message shows the reference, merchant, amount, category, date, your name and who paid. Where it applies, it also shows a possible duplicate or the reason the claim was rejected before. The approver can open the receipt.

If the amount is unusually large compared with your approved claims of the last 12 months, the approver sees a short note saying so in Telegram. The note is worked out when the message is sent and is not stored.

Bea tells you in Telegram when a claim is approved or rejected, with the reason. If a claim waits longer than your company has set, the approver gets a daily reminder in Telegram. Your company can switch these reminders off.

Your company can set a limit for automatic approval. Claims outside the automatic approval rules need a person's decision. A claim that may be a duplicate, lacks a receipt your company requires, or was rejected before is never approved automatically.

6.6 The email to accounting

If your company switches it on, Bea emails each claim approved after that to your company’s accounting address, as one PDF. An admin can send a claim again. The PDF holds the claim details, who submitted and approved it and when, the business purpose and the receipt. Location data is removed from receipt photos in the PDF. The admin who switched the email on is set as the reply-to address.

We send this email through Resend, from Ireland. Resend tells us whether the email was delivered, delayed or bounced, and we store that status with its time. We do not record whether the email is opened or a link in it clicked.

6.7 The record of changes

Every change to a claim is recorded: who made it, when, and the claim before and after. Changes to users and company settings are recorded the same way. Records are only ever added, never edited, so the history stays complete. This means an old value, such as an email address that was later corrected, stays in the record.

Opening a claim or a receipt is not recorded.

7. Logs and security

Our servers write technical logs so we can find faults and keep Bea secure. A log line holds the time, the kind of event, any error message and internal ids. Some log lines contain your Telegram user id or your internal user id. Email addresses are masked in logs, and receipts and accounting PDFs are never written to them.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is running Bea reliably and securely. We keep server logs for 30 days and use them for nothing else.

8. Service providers

We use these providers. Each processes data only on our instructions, under a data processing agreement (Article 28 GDPR). Where we act for your company, they are our sub-processors.

  • Hetzner Online GmbH, Germany: the server that runs the bot and keeps the conversation. The server is in Helsinki, Finland.
  • Supabase Pte. Ltd., Singapore: database, receipt storage, sign-in, and the sign-in and invitation emails. The data is hosted in Ireland.
  • OpenAI OpCo, LLC, United States: reading receipts and messages (section 6.4).
  • Plus Five Five, Inc. (Resend), United States: the email to accounting (section 6.6), sent from Ireland.
  • Vercel Inc., United States: hosting of this website and of the Bea web app, and analytics for this website (sections 3 and 4).
  • Google Asia Pacific Pte. Ltd., Singapore: Google Workspace, through which we receive email to hello@bea.today (section 5). The emails are processed by Google LLC in the United States.

Telegram is not our service provider. It processes your messages as its own controller (section 6.2).

9. Transfers outside the EU

Bea’s database and receipts are stored in Ireland, and the bot runs in Finland. Some data still leaves the EU:

  • Our own access from Singapore. We are based in Singapore, and our team can access the data from there. Singapore has no adequacy decision from the European Commission. Where we act for a company in the EU, this access is covered by the EU standard contractual clauses in our data processing agreement with that company (Article 46(2)(c) GDPR).
  • Supabase Pte. Ltd. (Singapore) and OpenAI OpCo, LLC (United States): EU standard contractual clauses (Article 46(2)(c) GDPR).
  • Vercel Inc. and Google LLC (both United States): each is certified under the EU–US Data Privacy Framework, so transfers to them rest on the European Commission’s adequacy decision for it (Article 45 GDPR).
  • Plus Five Five, Inc. (Resend, United States): the EU–US Data Privacy Framework (Article 45 GDPR); EU standard contractual clauses as a fallback (Article 46(2)(c) GDPR).

10. How long we keep data

  • The conversation with the bot: 24 hours after your last message.
  • The link to connect Telegram: valid for 15 minutes.
  • The analytics hash on this website: 24 hours.
  • Server logs: 30 days.
  • Accounts, claims, receipts, the record of changes and the log of accounting emails: as long as your company’s contract with us runs. During that time Bea does not delete a submitted claim. A withdrawn claim is kept too, so the record stays complete. A deactivated account is kept with its claims.
  • We delete this data within 90 days after the contract ends. Your company can ask for an export before then.
  • If your company asks us to delete its data, we do so within 30 days.
  • Emails you send us: until your enquiry is settled, at most 2 years.

Keeping records for the periods the law requires is your company’s duty as controller.

11. Your rights

You have the right:

  • of access (Article 15 GDPR)
  • to rectification (Article 16 GDPR)
  • to erasure (Article 17 GDPR)
  • to restriction of processing (Article 18 GDPR)
  • to data portability (Article 20 GDPR)
  • to object to processing based on Article 6(1)(f) GDPR (Article 21 GDPR)

An informal email to hello@bea.today is enough. Where we act for your company, we pass your request to your company and help it answer.

12. Right to lodge a complaint

You can complain to a data protection supervisory authority, in particular in the EU country where you live or work, or where you think the infringement took place (Article 77 GDPR).

13. Changes to this policy

We update this policy when Bea or the law changes. The date at the top shows the current version.