1. Who is responsible for your data
1.1 Tapadia Creative Private Limited (CIN U72200TG2007PTC052951), registered office 5-2-122/1, 1st Floor, Susheela Bhavan, RP Road, Secunderabad - 500003, Telangana, India, provides BELA and is responsible for the personal data described in this policy ("BELA", "we", "us").
1.2 To ask anything about your data or to exercise your rights, write to tapadia@bela.im.
2. Whose data, and in what role
2.1 BELA's own records. For account, authentication, workspace, billing, legal-acceptance, security, enquiry and website data, BELA decides why and how the data is processed and is responsible for it.
2.2 Data you put into BELA about other people. Where you submit business descriptions, documents, code or data that contain personal data about your own customers, users or others, you decide why and how that data is processed, and BELA processes it on your instructions to provide the service. You are responsible for having a lawful basis, giving any notice and obtaining any consent that applies, and for answering those people's requests; BELA will help where it reasonably can.
3. What we collect
3.1 Account information — your name, work email address and company, so we can create and secure your account.
3.2 Authentication and session information — credentials (passwords are stored only as secure hashes), session and security tokens, sign-in times and the network address used, so we can authenticate you and protect your account.
3.3 Sign-in with Google — if you choose to sign in with Google, Google shares with us your name, your email address and whether Google has verified it, your profile picture address, and an identifier for your Google account. We store these to recognise you when you sign in again. We do not receive your Google password.
3.4 Workspace and membership information — the workspaces you belong to, your role, and the email addresses of people you invite.
3.5 Business data — the business descriptions, documents, code and data you submit, and the projects, applications, documentation and other output BELA generates from them.
3.6 Legal-acceptance records — which version of a legal document you accepted, its content hash, when, from which account and network address.
3.7 Billing information — where a paid plan applies: billing details, tax registration numbers and invoice and payment records. Card and bank credentials are handled by our payment provider; BELA does not receive or store them.
3.8 Usage, technical and security information — operational and audit information (who did what and when), requests to the service, errors and performance data, IP address and device or browser information, collected as part of serving and securing requests.
3.9 Communications — messages you send us, our replies, and the service emails we send you (email verification, password reset and invitations).
3.10 Enquiries — when you submit a form on our website (for example to request early access, a demo or a call), the details you give us: your name, work email, mobile number, country and city, and, if you choose, your company, role, message and what you are interested in; together with the page and link you used, any campaign or referral details in the link, and your IP address and browser information.
4. Why we use it
4.1 To create, operate and secure your account and provide the service you asked for (clauses 3.1 to 3.6 and 3.8).
4.2 To generate output from your business data, on your instructions (clause 3.5 and clause 2.2).
4.3 To keep billing, invoicing, tax and accounting records (clause 3.7).
4.4 For security, abuse and fraud prevention, audit and accountability (clauses 3.2, 3.3, 3.6 and 3.8).
4.5 To send service emails such as verification, password reset and invitations (clauses 3.1, 3.4 and 3.9).
4.6 To respond to your enquiry and discuss BELA with you, as you asked when you submitted it (clauses 3.9 and 3.10).
4.7 To keep records needed to establish, exercise or defend legal claims, or to comply with law.
4.8 We do not sell personal data, and your business data is not used to train shared or public AI models.
5. Cookies and website analytics
5.1 BELA sets only cookies that are strictly necessary for its website and the service to work and stay secure: a session cookie and a security token that protects against cross-site request forgery. They expire when your session ends or after a short period.
5.2 BELA does not currently use analytics, advertising or cross-site tracking cookies or tags on its website or in the service.
5.3 If BELA decides to use website analytics in the future, it will update this policy before doing so and will ask for your consent where the law requires it.
6. AI processing and your own provider keys
6.1 BELA currently produces output through its own processing and does not send your content to third-party AI model providers, except where you connect your own provider account under clause 6.2. If that changes, BELA will update this policy.
6.2 Where you connect your own AI provider account, those requests run against your account under your agreement with that provider, and their privacy terms apply to that processing. We store the credentials you supply only to make those requests, and you can revoke them at any time.
6.3 BELA does not use your content to train shared or public AI models. Where you connect your own provider, whether that provider may use your content is governed by your agreement with it.
7. Who we share it with
7.1 We use service providers to operate BELA. Amazon Web Services provides our cloud hosting, storage, backups and service email delivery. Google hosts BELA's own email, so messages you send us and notifications of your enquiries are processed in Google Workspace, and Google provides sign-in where you choose to sign in with Google. When a payment provider is enabled for paid plans, it will process payments. Our service providers process data only to provide their services to us.
7.2 We may disclose personal data where required by law, court order or a competent authority, or to establish, exercise or defend legal claims. We may transfer data as part of a merger, acquisition or reorganisation, subject to this policy.
8. Processing outside India
8.1 BELA's production service is hosted in India. Some service providers, including our email provider, may process data outside India. Where that happens, we rely on the protections our providers offer and on the contractual terms we hold with them. If your procurement process needs specific data-transfer terms, tell us what you require.
9. How long we keep it
9.1 We keep personal data only for as long as it is needed for the purposes in clause 4: account data while your account is active and afterwards for as long as needed to close it, resolve disputes and meet legal obligations; enquiry details for as long as needed to respond to you and follow up on your enquiry; billing and tax records for the period tax and company law requires; and legal-acceptance records and audit and security logs for as long as needed to evidence what was agreed and to protect the service.
9.2 Operational backups exist for recovery and are held for a limited period, after which they are rotated out. Data already written to a backup is removed as that backup rotates out rather than instantly.
10. Your rights and how to exercise them
10.1 Subject to the law that applies, you may ask us for:
Access — a summary or copy of the personal data we hold about you;
Correction — correction, completion or updating of inaccurate data (most account details can also be edited in the product);
Portability — an export of your account data in a usable format;
Erasure — erasure of the personal data in your account.
10.2 How to exercise them. Write to tapadia@bela.im from the email address on your account. We may need to verify your identity. We will acknowledge your request and respond within a reasonable time and within any period the law requires. We export your account data, and erase the personal data in your account, on request: there is no self-service control for either in the product today.
10.3 Where your request concerns personal data you submitted about other people (clause 2.2), the business that submitted it is responsible for answering, and we will help it.
11. What erasure does, and what deleting a project does
11.1 Erasure replaces the personal data in your account with values that no longer identify you and closes access to the account. It does not delete your projects or the business data in them. If someone in your account also belongs to another company's workspace on BELA, their details are kept for that workspace.
11.2 After erasure we keep what we are required or entitled to keep: invoices, payment and tax records; legal-acceptance records; the audit trail and security logs; records needed for legal claims or to comply with law; and data in backups until those backups rotate out.
11.3 Deleting a project in the product removes it from your workspace. It does not erase the data behind it, and it is not erasure of your account or personal data. Where your plan includes them, you can download the source code, documents and certificates BELA generated before deleting.
11.4 Deleting business data. You may ask us to delete the business data in your account by writing to tapadia@bela.im. We will delete it, or make it inaccessible, on a valid request or after your account ends, subject to technical feasibility, security and fraud prevention, data held in backups until they rotate out, our legal, regulatory, accounting and tax obligations, the preservation of records relevant to a dispute, and our retention practices in clause 9. We do not commit to a period within which deletion is completed. Deleting business data is separate from erasure of your personal data under clause 11.1.
12. How we protect it
12.1 We use access controls, separation between customers, encryption in transit and at rest and an immutable audit trail, and we require multi-factor authentication for platform administrators and log their access.
12.2 We hold no security certification today and we say so plainly rather than implying one. No security measure is perfect, and we cannot guarantee that data will never be accessed without authorisation. Our current posture is described on the Trust Center page.
13. Personal data breaches
13.1 If we become aware of a personal data breach affecting data we are responsible for, we will take steps to contain it and will notify affected individuals and any authority as the law requires.
14. Grievances and complaints
14.1 If you are not satisfied with how we have handled your data or a request about it, you can escalate to BELA's Grievance Officer, Jay Tapadia (Founder), at tapadia@bela.im. We will acknowledge and respond to your grievance within the periods required by applicable law.
14.2 If you are still not satisfied, you may have the right to complain to the Data Protection Board of India or another competent authority.
15. Children
BELA is a business service and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact tapadia@bela.im and we will act on it.
16. Communications and marketing
We reply to enquiries you send us and send service emails (email verification, password reset and invitations). We do not send marketing email. If that changes, we will ask for your consent first and let you withdraw it at any time.
17. Changes to this policy
We may publish a new version of this policy. Each version carries a version label and an effective date and is kept so that earlier versions remain readable. Where a change is material, we will tell account owners before it takes effect.
18. Contact
Tapadia Creative Private Limited · 5-2-122/1, 1st Floor, Susheela Bhavan, RP Road, Secunderabad - 500003, Telangana, India · tapadia@bela.im.