Beam Prism: Privacy Policy
Last updated: 4 November 2026
This policy explains what personal data Beam Prism ("Prism") collects, why, and what rights you have. It covers the Prism web application, desktop application, mobile application and messaging channels. Beam's agent platform has its own privacy policy at beam.ai/legal/privacy-policy.
1. Who is responsible
Beam Technologies GmbH, Schönhauser Allee 74a, 10437 Berlin, Germany ("Beam", "we").
Where you use Prism through your employer or another organisation that has a contract with Beam, that organisation is the controller of your data and Beam processes it on their behalf under the Prism Data Processing Agreement (prism.beam.ai/legal/data-processing). This policy then explains how Prism works; your organisation's own privacy notice governs your rights. Where you use Prism on your own account, Beam is the controller.
2. What data we collect
| Data | Where it comes from |
|---|---|
| Account data: name, email address, workspace membership, sign-in identifiers | You, when you sign up or sign in with Microsoft or Google |
| Email data: sender, recipients, subject, date, Prism's summary and suggested actions, short quotes used to flag a suspicious message, drafts you approved | Your connected Microsoft 365 or Google mailbox. Prism does not store full copies of your emails or attachments. |
| Calendar data: event titles, times, attendees, locations and join links | Your connected calendar |
| Messages you exchange with Prism on WhatsApp, Slack, Telegram or iMessage, including voice messages (transcribed to text), images and files, and your phone number | You |
| Meeting transcripts and summaries, and audio of recordings made in the mobile application | Recordings you start in the desktop or mobile application, or note-taking services you connect |
| Your conversations with Prism's assistant, which may include text from attachments you asked Prism to read | You |
| Connection tokens for the Microsoft 365, Google and other accounts you connect | The account provider, when you connect |
| Technical data: product usage events, error reports with secrets removed, AI quality records with personal identifiers removed, and the data described in Section 9 | Your use of Prism |
Prism also processes personal data of people you correspond or meet with, such as colleagues, clients and suppliers, because it appears in your email, calendar, messages and meetings. We process that data only to provide the service to you.
3. Why we process it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Providing Prism: sorting and summarising your mail, drafting replies you approve, preparing you for meetings, answering your questions, running automations you set up | Performance of a contract (Article 6(1)(b) GDPR) |
| Keeping Prism secure, fixing errors and improving the service using AI quality records with personal identifiers removed | Our legitimate interest in a reliable, secure service (Article 6(1)(f) GDPR) |
| Sending you account emails such as invitations and password resets | Performance of a contract |
| Measuring use of the website and product | Your consent where the law requires it; otherwise our legitimate interest (Section 9) |
| Billing | Performance of a contract and legal obligations |
We do not use your data to train AI models. We do not sell your data.
4. AI processing
Prism uses AI models to read and summarise your mail, prepare briefs and answer your questions. Those models are run by external providers, including DeepSeek, Tencent, Moonshot AI, Alibaba (Qwen), Z.ai, MiniMax, OpenAI, Anthropic and Google, reached through a model-routing service. Processing by these providers may take place outside the European Union. You can choose the model used for chat and daily briefs in your settings. Email analysis uses Prism's standard models.
5. Who we share data with
We share data only with the service providers that help us run Prism, listed with their locations in Annex 3 of the Prism Data Processing Agreement at prism.beam.ai/legal/data-processing. They include hosting in the Netherlands and Ireland, AI model providers, the WhatsApp messaging service, error reporting, product analytics and transactional email. We also share data where the law requires it.
If you connect another application through the "More apps" catalogue, that connection is made through an integration partner, which holds the credentials for that application.
6. Where your data is stored and international transfers
Prism's servers are in Amsterdam, Netherlands. Its database and file storage are in Ireland. Your conversations with the assistant are stored on Prism's servers in Amsterdam.
Some service providers, including AI model providers, process data in the United States or in a location chosen per request. Where data leaves the European Economic Area, we rely on the EU Standard Contractual Clauses or, for certified recipients in the United States, the EU-U.S. Data Privacy Framework. Details are in the Data Processing Agreement.
7. How long we keep your data
| Data | Kept for |
|---|---|
| Messages exchanged with Prism on chat channels | 180 days, then deleted automatically |
| Email summaries, suggested actions and your conversations with the assistant | Until your account is deleted |
| Meeting transcripts and recordings | Until you delete them, or until your account is deleted |
| Connection tokens | Until your account is deleted |
| Account data and billing records | For the life of your account, and afterwards as long as the law requires |
When you disconnect an account, Prism stops using it. The stored connection remains until your account is deleted. You can also remove Prism's access in your Microsoft or Google account settings at any time.
To delete your account, write to us at the address in Section 11. Deletion removes your records, including connection tokens, summaries, transcripts, messages and conversations. Where you use Prism through an organisation, that organisation's data is deleted within 90 days after its contract ends.
8. How we protect your data
Data in transit is protected by TLS. The database and file storage are encrypted at rest with AES-256, and server disks use the hosting provider's encryption at rest. Each workspace's data is tagged with its workspace and every request is checked against workspace membership. Connection tokens are stored only on Prism's servers and cannot be read by users or client applications. Access to production systems is restricted to authorised personnel and contractors, who are bound by confidentiality.
9. Website analytics and advertising measurement
On prism.beam.ai and in the web application we use a product analytics service to understand how Prism is used. It records usage events, not the content of your mail, messages or conversations. The marketing pages also use an advertising measurement pixel that records page views and sign-ups with a scrambled account identifier. Where the law requires it, these run only after you consent through the cookie banner, and you can withdraw consent there at any time.
10. Your rights
Under the GDPR you can ask us to access, correct, delete or restrict your personal data, to receive it in a portable format, and to object to processing based on our legitimate interests. Where processing is based on consent, you can withdraw it at any time. You can also complain to a data protection supervisory authority; for Beam that is the Berlin Commissioner for Data Protection and Freedom of Information.
If you use Prism through an organisation, please contact that organisation first; we will support them in answering you.
11. Contact
Beam Technologies GmbH, Schönhauser Allee 74a, 10437 Berlin, Germany. Email: support@beam.ai.
12. Children
Prism is not intended for anyone under 16, and we do not knowingly collect data from them.
13. Changes
We will post changes to this policy here and update the date at the top. For material changes we will notify you in the application or by email.