Last updated: 1 November 2026
This notice explains, in plain English, what personal information Beacon ("we", "us") collects, why, how long we keep it, who we share it with, and the rights you have. It applies to people at businesses we contact about our AI-search visibility audits, people who reply to us, and people at our clients.
Beacon runs AI-search visibility audits for independent dental practices and law firms. We check how AI assistants (such as ChatGPT, Google AI Overviews, Gemini, Perplexity and Copilot) describe a business, and we recommend fixes.
Controller (the organisation responsible for your data): NOVO CAPITAL d.o.o.
Postal address: Rustempašina 23 (Mellain Center), 71210 Ilidža, Sarajevo, Bosnia and Herzegovina
Privacy contact: privacy@getbeaconaudit.com
Beacon is a service of NOVO CAPITAL d.o.o., a company registered in Bosnia and Herzegovina. We have not appointed a data protection officer, because the law does not require us to.
Who you are: A business we may contact (prospect)
What we collect: Business name, website, city, business type and, for UK firms, legal-entity type and company number. Usually a general business inbox published by the business (for example info@ or enquiries@). Sometimes the name and job title of a person the business publicly lists as its contact. Our notes on how AI assistants currently describe the business.
Where it comes from: Public business sources only: the business's own website, Google Maps and similar business listings, public professional registers (for UK law firms, the Solicitors Regulation Authority register and the Law Society's "Find a Solicitor"), and Companies House. We do not buy contact lists, and we do not collect personal or social-media contact details.
Who you are: Someone who replies to us
What we collect: Your name, email address, job title if given, what you write to us, and whether you asked us to stop contacting you.
Where it comes from: You, when you reply.
Who you are: A client
What we collect: The business contact details you give us (name, business email, role), your business's website, services, service area and competitors, our messages with you, and order and payment status.
Where it comes from: You, and the marketplace you hire us through (Upwork or Contra).
We do not collect special category information (such as health information), and we ask you not to send it to us. We do not use tracking pixels in our emails. Our website does not set analytics or advertising cookies. Google Sites, which hosts it, may set strictly necessary cookies that the site needs to work.
Purpose: Finding businesses that may benefit from an AI-search audit, and sending a small number of business-to-business emails (at most three per business) offering a free mini-audit.
Lawful basis (UK GDPR Article 6): Legitimate interests: our interest in promoting our services to relevant businesses, and the business's interest in knowing how AI assistants describe it. We have weighed this against your interests in a written legitimate interests assessment. You can ask for a copy at privacy@getbeaconaudit.com.
Purpose: Keeping a "do not contact" (suppression) list so we never email you again after you opt out.
Lawful basis (UK GDPR Article 6): Legitimate interests, so we can meet our legal duty to respect your objection.
Purpose: Replying to you and preparing a free mini-audit you ask for.
Lawful basis (UK GDPR Article 6): Legitimate interests, and steps you asked for before a contract.
Purpose: Delivering an audit or fix pack you have ordered, communicating with you about it, and managing payment through Upwork or Contra.
Lawful basis (UK GDPR Article 6): Contract.
Purpose: Keeping business and tax records and handling complaints or legal claims.
Lawful basis (UK GDPR Article 6): Legal obligation and legitimate interests.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.
You can tell us at any time to stop sending you marketing, free of charge, and we will stop. This right is absolute: we cannot refuse.
To opt out, do any one of these:
reply to any of our emails with "unsubscribe" (or "stop" or "remove"),
use the opt-out link in any of our emails, which takes you to our opt-out page, or
email optout@getbeaconaudit.com or privacy@getbeaconaudit.com.
We act on opt-outs the same working day where we can, and always within 10 business days. After that we keep only your email address or business domain, the date, and a short reason (for example "opted out" or "firm-wide opt-out"), and nothing more, on our suppression list, so that we never contact you again. If you ask us to stop contacting your whole business, we block your business's email domain.
Information: Prospects who don't reply
How long: Deleted 90 days after our last email to them (our sequence is three emails over about 10 days).
Information: Prospects who reply but don't become clients
How long: Kept for 12 months from our last contact, then deleted.
Information: Suppression ("do not contact") list
How long: If you opt out, we keep only your email address or business domain, the date, and a short reason (for example "opted out" or "firm-wide opt-out"), and nothing more, for as long as we do outreach, so that we never contact you again.
Information: Client records (contact details, messages, delivered reports)
How long: For the length of the engagement, then 6 years after our last engagement, or longer if accounting or tax law in Bosnia and Herzegovina requires it.
Information: AI-assistant screenshots and test results
How long: Kept with the relevant audit for the same period as the client or prospect record they belong to.
Information: Complaint records (including complaint-form responses)
How long: Kept with the record they relate to, for the same period. If there is no other record, kept for 12 months from our last contact about the complaint, then deleted.
We do not sell personal information, and we never sell or pass on the addresses of people who have opted out.
We share information only with:
Our email provider, Google Workspace (Google LLC, USA), which sends and stores our emails for us under contract (a "processor").
Our website host, Google Sites (Google LLC, USA), a processor that hosts this website and the forms on it.
Upwork and Contra, if you hire us through them. They are separate controllers of the data you give them; see their own privacy notices.
AI assistants (such as ChatGPT, Gemini, Perplexity, Copilot and Google Search's AI features). We use them only to run test questions about businesses, such as "best dentist for anxious patients in Austin". We do not enter personal information into these tools.
Professional advisers and authorities, where the law requires it or to establish or defend legal claims.
We are a company registered in Bosnia and Herzegovina, and the people who run Beacon may access information from the United Arab Emirates, where the business is run from. Our service providers may process it in the United States (Google LLC, for Google Workspace email and Google Sites). Neither Bosnia and Herzegovina nor the UAE is covered by UK adequacy regulations. Where we send UK personal information to a separate organisation outside the UK, we rely on Google's Data Processing Addendum, which includes the standard contractual clauses with the UK Addendum. Google LLC is also certified under the EU-US Data Privacy Framework and its UK Extension. You can ask for a copy of the safeguards at privacy@getbeaconaudit.com.
You have the right to:
be informed about how we use your information (this notice),
access a copy of the information we hold about you,
correct inaccurate information,
erase your information in some circumstances,
restrict how we use it in some circumstances,
object to our use of it based on legitimate interests (and, absolutely, to direct marketing; see section 4), and
data portability for information you gave us under a contract.
To use any of these rights, email privacy@getbeaconaudit.com. Using them is free. We respond within one month, and we may ask you to confirm your identity first.
If you are unhappy with how we have used your information, please tell us first at privacy@getbeaconaudit.com or through our complaint form at https://docs.google.com/forms/d/e/1FAIpQLSeU4c0Bv9-dyI9DNOW-lBwm_du3X52O0cvoft0Tc5KtvwVreQ/viewform. We will acknowledge your complaint within 30 days and respond without undue delay.
You also have the right to complain to the UK regulator, the Information Commissioner's Office (ICO):
helpline: 0303 123 1113
post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We will update this notice if the way we use information changes, and we will change the "last updated" date above.