BadPigeon
Privacy notice
This notice explains what personal data we collect, why we use it and the choices and rights available to you.
Effective from 3 October 2026
1. Who we are
BadPigeon is operated by Beamond Limited, a private company limited by shares registered in Ireland under company number 825180.
Registered office: Beamond House, Bellewstown, Co. Meath, A92 X668, IrelandContact: Use our verified contact form
Beamond Limited is the controller of the personal data described in this notice.
2. Who this notice covers
This notice covers people who visit BadPigeon, create or manage a website, accept an invitation to help manage a website, contact us, or visit a customer website hosted by us.
Customers decide what information to publish on their own websites and are responsible for providing any privacy information required for their activities. If you contact one of our customers using details on their website, that customer is responsible for how they use your enquiry.
3. Information we collect
Account and contact information
Your email address, password hash, account and verification records, invitations, permissions, and any information you provide when contacting us or reporting a customer website. Messages sent through our contact form include the reason selected, your message and your verified email address.
Website information
The business, club, organisation or project information you enter; website wording and appearance choices; website addresses; public contact details; announcements; images and image descriptions; and replacement website links.
Subscription and transaction information
Your billing email, country, currency, plan, billing interval, subscription status and identifiers supplied by our payment provider. Card and bank details are handled by the payment provider and are not stored by BadPigeon.
Referral and campaign information
If you follow a valid referral link, we record a privacy-minimised link-visit event containing the referrer, campaign where applicable, landing path and time. This event does not identify you and is used for aggregated programme reporting. If you consent to referral tracking, we also record an opaque attribution identifier and relevant dates. If you register, the attribution may be linked to your account, website and subscription so we can determine whether a referral commission becomes due. You can alternatively enter a referral code during registration without enabling a persistent referral cookie. Referrers see aggregated statistics, not customer names, email addresses, IP addresses or payment details.
Usage, device and security information
Server and security logs may include IP address, browser or device information, request times, pages requested and diagnostic information. Privacy-minimised technical error reports sent to Sentry exclude request details, signed-in identity, IP address, cookies, customer content and free-text exception messages. When you visit our public service-status page, Better Stack may receive ordinary connection information such as your IP address, browser or device information and request times. Help records include privacy-minimised search wording, the page searched from, result and selection counts. Technical reports submitted while signed in, or after verifying a registered email address, include the account identifier, an optional website identifier, category, current page, limited browser information and the description supplied. Reports about customer websites include the website, reason, description and the reporter’s verified email address. We filter likely passwords and security codes and ask people never to submit them. For customer websites we keep aggregate visit and contact-click counts; we do not use these counts to build advertising profiles.
Information made public
Once a website is published, its wording, images and chosen contact details are available publicly and may be indexed or copied by search engines and other internet services.
4. How and why we use personal data
| Purpose | Legal basis |
|---|---|
| Create previews, accounts and websites; publish and manage content; provide exports, support, subscriptions and transactional emails. | To take steps at your request and perform our contract with you. |
| Secure accounts and the service, prevent misuse, investigate verified reports about customer websites, diagnose faults, keep aggregate service statistics and improve reliability. | Our legitimate interests in operating and protecting the service. |
| Check text and uploaded files for prohibited or unsafe content, including malware, and enforce our Terms. | Performance of our contract and our legitimate interests in keeping the service safe and lawful. |
| Maintain transaction, tax, company and compliance records and respond to lawful requests. | Compliance with legal obligations. |
| Remember an accepted referral between visits. | Your consent, which may be withdrawn at any time through Cookie settings. |
| Keep privacy-minimised aggregate counts of valid referral-link visits and campaign performance. | Our legitimate interests in operating, securing and evaluating our referral programme. These records do not contain a visitor identifier. |
| Attribute a registered or paying customer to a referral partner, calculate commission and keep an auditable payment record. | Our legitimate interests in operating and accounting for our referral programme and, where applicable, performing our agreements with referral partners. |
| Use any optional marketing or non-essential tracking introduced in future. | Your consent, which may be withdrawn at any time. |
5. AI assistance and content moderation
If you ask for wording assistance, the relevant details you supplied are sent to an AI provider to produce a suggestion. You choose whether to use, edit or reject the suggestion.
We record that a suggestion was generated and whether you accepted it. This record may include the AI provider and model, a provider response reference, the relevant website field, timestamps and a cryptographic fingerprint of the suggestion. We use this information to operate and monitor the feature, investigate problems and demonstrate compliance. The record does not contain an additional copy of the suggested wording.
Text, images and PDF documents uploaded to the service may also be checked automatically for unlawful, harmful or prohibited material and for malware before they are stored or published. A failed or unavailable security check may prevent a file from being uploaded or published. You may contact us if you believe content was blocked incorrectly. We do not use these checks to make decisions that produce legal or similarly significant effects about you.
Our Responsible use of AI statement explains our oversight, safeguards and human-review process in more detail.
8. International transfers
Some providers may process data outside Ireland or the European Economic Area. Where data is transferred to a country without an adequacy decision, we use an appropriate transfer mechanism, such as the European Commission's Standard Contractual Clauses, and additional safeguards where required.
9. How long we keep information
- Private, unregistered website drafts normally expire after 24 hours.
- Account and website information is kept while the account or website remains active and for only as long afterwards as needed for security, disputes and legal obligations.
- When a customer permanently deletes a website, it is removed from the live service and its stored images are deleted. Residual copies may remain temporarily in restricted backups until those backups are overwritten.
- Verification and password-reset records are kept for short periods appropriate to their security purpose.
- Verified reports about customer websites are kept for as long as needed to investigate the concern, enforce our Terms and handle related disputes or legal obligations.
- Verified contact messages are kept for as long as needed to respond, provide support, handle the request and meet related legal obligations.
- Privacy-minimised technical error records in Sentry are kept for up to 30 days.
- Transaction and accounting records may be kept for six years or longer where law requires.
- Anonymous referral attributions expire after the configured attribution period, currently 90 days. Referral and commission records linked to an account may be retained with transaction and accounting records.
- Security and diagnostic logs are retained for a limited period based on operational and security needs.
We may retain a minimal record where necessary to establish, exercise or defend legal claims, prevent fraud or comply with law.
10. Your data-protection rights
Depending on the circumstances, you may ask us to:
- give you access to your personal data;
- correct inaccurate or incomplete data;
- delete data;
- restrict or object to processing;
- provide certain data in a portable format; or
- withdraw consent where processing relies on consent.
To exercise a right, use our verified contact form or write to the postal address above. Confirming control of the supplied email address helps us communicate securely; we will ask for further identity information only where reasonably necessary. You may also complain to the Data Protection Commission or, where applicable, your local supervisory authority.
11. Children
Accounts are for people aged 18 or over. The service is not directed at children and we do not knowingly allow a child to create an account.
12. Changes to this notice
We may update this notice as the service or law changes. We will publish the revised notice here and, where a change is material, provide an appropriate additional notice.