Privacy Policy
Last updated 26 October 2026
This policy explains what personal data BeLateral ("we", "us") collects when you use our website, Able° and our consulting services, why we use it, who we share it with and the choices you have. We've written it in plain English. If anything is unclear, email us at hello@belateral.co.
It is written with Thailand's Personal Data Protection Act (PDPA) and, where it applies to you, the EU and UK General Data Protection Regulation (GDPR) in mind.
Who is responsible for your data
BeLateral is the data controller for the personal data described in this policy: your account, your team, billing, support and the enquiries you send us.
When you use Able° to talk with other people, for example customers or colleagues who message your agent, you decide what your agent does with their messages. For that data you are the controller and we process it on your behalf, only to run the service for you.
What we collect
When you create an account
- Your name, email address and password. We store the password only as a secure hash, never in readable form.
- Security settings you choose, such as two-factor authentication and passkeys.
- Your notification preferences.
When you set up and use Able°
- Your team: its name, the members you invite (their email address and role) and the answers you give in the setup wizard.
- Your agents: their names, the instructions you give them and their settings.
- Your chat app connections: the account or number you connect, and the access keys the connection needs. We store keys encrypted and never show them in full again once saved.
- Usage records for AI requests: which agent made the request, the model, how many tokens were used, the cost and the time. We use these to charge your credits, enforce your spending limits and show you your usage.
- If you use the advanced options: the public SSH keys you add, and a record of terminal sessions you open (when and from which IP address).
When you pay
Payments are handled by Stripe. We send Stripe your billing name, billing email, billing address and, if you give one, your tax ID, together with what you're buying. We keep a reference to your Stripe customer, your orders, invoices and credit balance. We never see or store your full card details.
When you contact us
- If you use our contact or consulting form: your name, email address, company, phone number (if you give it), what you'd like help with, the other details you choose to fill in and the IP address the form was sent from.
- If you write to support: your messages, any files you attach and the replies.
Automatically
- Session data: your IP address, browser (user agent) and when you were last active, so we can keep you signed in and secure.
- An activity log of important actions on your account and team, such as signing in, changing settings or making a purchase, with the IP address and browser used. Team Owners can see their team's activity log.
What we don't collect
- The content of your chats. Messages between you (or the people you talk to) and your agent pass through our systems on the way to your agent and to the AI model, but we don't keep their content. The one exception: if a message can't be delivered after repeated attempts, a copy may be kept in our system so our team can investigate the fault.
- What your agent remembers. Your agent's memory and conversations live on your own private server, not in our central systems.
- Analytics. We don't use analytics or advertising trackers on our website or in the dashboard.
Why we use your data, and our legal basis
| Purpose | Legal basis |
|---|---|
| Creating your account, running Able° and your server, connecting your chat apps | To perform our contract with you |
| Taking payment, issuing invoices and keeping financial records | Contract, and our legal obligations for tax and accounting |
| Metering AI usage, charging credits, enforcing spending limits and sending low-credit alerts | Contract |
| Renewal reminders and service emails, such as a plan ending or a server about to be removed | Contract |
| Keeping accounts and systems secure, preventing abuse and keeping an activity log | Our legitimate interest in running a safe service, and legal obligations |
| Replying to enquiries and support requests | Steps you ask us to take before a contract, contract, or our legitimate interest in answering you |
| Statistics cookies, if you allow them | Your consent |
We don't sell your personal data, and we don't use it for advertising.
Who we share it with
We use trusted service providers to run BeLateral. They process data on our instructions:
- Stripe, for payments and invoices.
- Postmark, to send and receive our emails.
- Our hosting providers for your agent's private server: Vultr, DigitalOcean, UpCloud or OVHcloud. Servers are in Singapore.
- Cloudflare, which connects securely to your server so it never has to be open to the internet.
- OpenRouter and the AI model providers it connects to (for example Anthropic for Claude and OpenAI for GPT), which receive the requests your agent makes so they can produce a reply.
- Our database and cache hosting, which runs in Singapore.
When you connect a chat app such as Telegram, LINE or WhatsApp, messages also pass through that platform. Those platforms are run by their own companies under their own terms and privacy policies.
We may also share data if the law requires it, to protect our rights or the safety of others, or as part of a sale or restructuring of our business, in which case this policy would continue to protect it.
International transfers
Your agent's server and our main database are in Singapore. Some of our providers, including Stripe, Postmark, OpenRouter and the AI model providers, may process data in other countries, such as the United States. Where the PDPA or GDPR requires it, we rely on appropriate safeguards for these transfers, such as the providers' standard contractual clauses.
How long we keep it
- Your account stays until you delete it.
- Your server and everything on it is removed when your plan ends and the grace period has passed (currently 14 days). If you had the backups add-on, the latest backup is kept for a short time afterwards (currently 14 days) in case you come back.
- Invoices and payment records are kept as long as tax and accounting law requires.
- Activity logs, usage records, support messages and enquiries are kept to run and protect the service and to answer questions about past activity.
- Team invitations that aren't accepted expire and are deleted automatically.
Deleting your account
You can delete your account at any time from your profile settings. If you own a team with other members, you'll be asked to hand it to someone else first. When you delete your account, your login and profile are removed, and teams you own alone are deleted too: their plans end and their agents stop working, and their servers, agents (including what they remember) and chat app connections are kept for 7 days, then removed for good. An Owner can also delete a team on its own, with the same result. Contact us within those 7 days to undo a deletion. Some records stay because the law requires them or to protect the service, such as invoices and the activity log (which keeps the email address of the deleted account).
Your rights
Depending on where you live, you can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct data that's wrong or incomplete;
- delete your data, or restrict how we use it;
- move your data to another service (data portability);
- stop using your data where we rely on our legitimate interests, or withdraw consent you've given (this doesn't affect anything we did before).
You can update most of your details yourself in your settings. For anything else, email hello@belateral.co. We'll reply within the time the law allows, and we may need to confirm your identity first. You can also complain to your data protection authority, for example Thailand's Personal Data Protection Committee, or the supervisory authority in your country if the GDPR applies to you.
Cookies
We use a small number of cookies. Necessary and preference cookies are used now; statistics cookies only if you allow them:
| Cookie | What it does | When it's set | How long it lasts | Type |
|---|---|---|---|---|
Session (belateral-session) |
Keeps you signed in and the site working | When you visit | 2 hours after your last visit | Necessary |
XSRF-TOKEN |
Protects forms against cross-site request forgery | When you visit | 2 hours after your last visit | Necessary |
Remember me (remember_web_…) |
Keeps you signed in | Only if you tick "Remember me" when you sign in | Up to 400 days, or until you sign out | Necessary |
belateral_consent |
Remembers your cookie choices | When you make a choice in our cookie banner | 180 days | Necessary |
appearance |
Remembers light or dark mode | Only when you choose a theme in your settings | 1 year | Preference you set |
sidebar_state |
Remembers whether the dashboard sidebar is open | Only when you open or close it | 7 days | Preference you set |
| Statistics cookies | Help us see how the site is used | Only if you allow statistics | We'll list each one here when we add them | Optional, with your consent |
Necessary cookies are needed for the service to work. The two preference cookies are only set when you change that setting yourself, and your theme choice is also kept in your browser's local storage on the same terms. We don't use statistics or analytics cookies yet; when we add them, they'll stay off until you allow statistics in our cookie banner, and we'll list them above. We don't use advertising cookies.
You can change your choice at any time from Cookie settings at the bottom of every page. If you withdraw consent, we stop setting optional cookies from then on.
Security
We protect your data with encryption in transit, encrypted storage for keys and other secrets, two-factor authentication and passkeys for your account, required two-factor authentication for our staff, and an activity log of important actions. Each Able° customer gets their own private server, reachable only through a secure tunnel. When our support staff need to see your account to help you, the session is recorded in your team's activity log, and they can't make payments, see secrets or open your server's terminal while doing so.
No system is perfectly secure. If we learn of a breach that affects your personal data, we'll tell you and the relevant authorities as the law requires.
Children
BeLateral is for people working in businesses and isn't meant for children. We don't knowingly collect data from anyone under 18.
Changes to this policy
If we make important changes, we'll tell you by email or in your dashboard before they take effect. The date at the top of this page shows when it was last updated.
Contact us
Questions or requests about your data: hello@belateral.co.