Privacy, Terms, Refunds & Data Security

1. Who we are and what this policy covers

Bearon (“Bearon”, “we”, “us”) is based in Indonesia. Our public address is Central Park Mall, LG Floor (Units LG-109–114, 164), Jl. Letjen S. Parman Kav. 28, Grogol Petamburan, Jakarta Barat 11470, Indonesia. Contact us at admin@bearon.studio for privacy questions or requests.

This policy covers our website and business software, operational tools, automation, customizable templates, AI assistants, integrations, and similar products and features (the “Services”). We primarily serve businesses in Indonesia and Southeast Asia. A feature being covered by this policy does not mean it is included in every subscription or available in every country.

When Bearon determines why and how account, billing, website, or service-administration personal data is processed, Bearon is responsible for that processing. When a business supplies customer, staff, or other personal data for its own purposes, that business is responsible for its purposes, notices, lawful authority, and instructions; Bearon processes that data to provide the requested Services. Applicable law and the actual processing determine each party’s legal role.

2. Information processed

Depending on the Services you use, information may include account and business contact details; subscription and billing records; customer and staff records; sales, inventory, bookings, and similar operational records; uploaded images, files, website content, and templates; communications and support requests; and AI prompts, conversations, outputs, and the business data made available to AI tools.

Technical information may include IP addresses, device and browser information, authentication events, access logs, errors, and service usage. Connected services can provide data within the access you authorize. The scope depends on the integration and permissions granted.

If you sign in with Google, basic profile information such as your name and email is used for authentication. Access to other Google data depends on the permissions separately requested and authorized for the relevant integration.

Job applications and referral-program enquiries sent by email include your email address, message, and any CV, portfolio, or other information you choose to attach. We use this information to assess your application, communicate with you, or discuss a potential referral relationship. Opening a prepared email does not submit an application; you choose whether to send it through your email provider.

3. Purposes and lawful authority

We process information to authenticate users; operate accounts and subscriptions; deliver requested business tools and automation; generate requested templates and AI responses; carry out authorized actions and integrations; handle billing and support; maintain service performance and security; keep audit records; resolve disputes; and meet applicable legal obligations.

Processing requires an applicable lawful basis. Depending on the activity and local law, this may be performance of a contract, a legal obligation, an appropriately assessed legitimate interest, or consent where required. Agreeing to these policies does not replace consent, notices, or other requirements that apply to a particular activity.

Businesses must have authority to provide data about other people, inform them where required, and limit submitted data to what is appropriate for the task. A business administrator’s authorization does not automatically replace an individual’s legally required consent.

4. AI processing and service providers

Bearon intelligently routes AI requests among providers. Current providers include Google Gemini, Anthropic Claude, Featherless AI, OpenRouter, and CommandCode. Routing may involve an intermediary and the model provider selected through that intermediary. Providers used can differ between requests.

AI processing can involve sending prompts, files, conversation context, and customer or business data retrieved through enabled tools to external providers. Enabling or requesting an AI workflow can therefore involve external processing of data beyond the text you manually enter. Only provide data that you are authorized to process and disclose for that workflow.

DigitalOcean hosts our server in Singapore. AWS S3 hosts images, AWS Cognito handles authentication, and Cloudflare provides rate limiting and DDoS protection. Providers process the information needed for their respective functions. Information may also be disclosed to integrations you authorize, or where legally required for a lawful request, dispute, or protection of rights.

For homepage language detection, your browser may contact FreeIPAPI to obtain an approximate country from your IP address. This sends your IP address and request information to that provider. We do not request precise device location or GPS access for this feature. You can choose Indonesian or English manually; a saved homepage language choice takes priority over detection.

Third-party retention, model-training settings, and processing locations depend on the provider, service, and configuration. This policy does not promise that every provider has zero retention, excludes model training, or processes data only in Singapore. Ask us about the applicable configuration before using AI with sensitive or regulated data. Changes involving new purposes or additional legal consent requirements require the corresponding notice or authorization.

5. International processing

Use of the Services can involve processing outside your country, including the DigitalOcean server in Singapore and processing by AWS, AI providers, routing intermediaries, and authorized integrations. Singapore server hosting does not mean all copies, images, authentication data, or AI requests remain in Singapore.

Cross-border processing remains subject to applicable transfer requirements. Customer authorization does not remove those requirements. Contact us before submitting information subject to a specific residency restriction or transfer requirement; this policy does not certify that a particular deployment satisfies it.

6. Retention and deletion

Bearon’s general retention policy is to retain all personal and business data for a minimum of three years for audit purposes, subject to applicable law. This is our business policy, not a statement that the law requires every category of data to be retained for three years. An audit purpose must still justify the scope and duration of personal-data retention.

You may request deletion. We assess your identity, authority, the relevant data, and the lawful basis for any continued retention. A three-year policy does not override a legally required earlier deletion, consent withdrawal, processing restriction, or data-minimization obligation. If data must be retained, we explain the applicable reason and scope when responding to the request.

Longer retention may be necessary where applicable law or a specific unresolved claim requires it. Cancellation does not itself submit a deletion request. Retention beyond the minimum requires a continuing lawful purpose; the minimum is not permission to keep data indefinitely. Provider-held copies can be subject to separate retention requirements, and this policy does not guarantee immediate erasure from every third-party system.

7. Your rights and requests

Depending on applicable law, you may request information about processing, access or a copy, correction, deletion, withdrawal of consent, restriction, portability, or review of relevant automated decisions. Submit requests to admin@bearon.studio. Include your account email, the business concerned, and the request; do not send passwords, tokens, or unnecessary identity documents.

We may need to verify identity and authority to prevent unauthorized disclosure or deletion. If a merchant controls the relevant customer or staff data, its involvement may be needed. Your request is assessed under applicable law; these policies do not waive your right to complain to a competent authority or seek a legal remedy.

8. Sensitive data and data about children

The Services are intended primarily for business use. Do not submit sensitive personal data, children’s data, authentication secrets, or other specially regulated information unless the relevant workflow is appropriate, you have the necessary authority and notices, and any legally required safeguards or consent are in place. AI tool access must be considered when deciding what data to submit.

9. Browser preferences and optional analytics

We store the homepage language choice and optional-analytics preference in your browser’s local storage. Other service authentication or security storage depends on the Services you use. Blocking browser storage can prevent preferences from being remembered.

The homepage offers Google Analytics through Google Tag Manager or, where configured separately, a direct Google tag. With JavaScript enabled, these scripts load only after you allow analytics. Analytics can process information about visits, devices, browsers, approximate location, and interactions, and may use cookies. Analytics permission does not authorize advertising tracking; advertising consent signals remain denied in our JavaScript loader.

When JavaScript is disabled, the homepage includes a Google Tag Manager fallback iframe that can contact Google without the JavaScript analytics choice being available. The stored browser preference cannot control that fallback. Information sent and any tags served depend on the container configuration and your browser’s controls.

Use Analytics preferences in the homepage footer to change your choice. Declining after allowing analytics reloads the page to stop the configured loader from running again. This does not erase information already sent to Google or automatically delete every existing provider cookie. Actual tags, data retention, and reporting depend on the configured container and property.

10. Security and policy changes

The Data Security Policy below describes confirmed controls and shared responsibilities. No electronic system guarantees absolute security or uninterrupted availability. This does not remove responsibilities imposed by applicable law.

Updated policies are published with a revision date. Where applicable law requires notice or consent for a change, publication or continued use alone does not replace that requirement. A broader definition of similar products or features does not authorize unrelated new uses of personal data.

1. Contracting party, scope, and acceptance

These terms govern Services provided by Bearon, Indonesia, at Central Park Mall, LG Floor (Units LG-109–114, 164), Jl. Letjen S. Parman Kav. 28, Grogol Petamburan, Jakarta Barat 11470, Indonesia. “You” means the customer and, where applicable, the business you are authorized to represent. You must have legal capacity and authority to enter the agreement and authorize users acting for that business.

By accepting these terms when subscribing or registering, you agree to them. A separately agreed written order or contract governs its specific commercial terms where it expressly differs. Mandatory legal rights take priority over inconsistent wording. The Refund and Cancellation Policy below forms part of these terms; the Privacy Policy explains personal-data processing rather than creating a blanket consent.

Services include business applications, operational dashboards, templates, websites, ordering or booking tools, AI assistance, automation, integrations, and similar products and features offered by Bearon. Access depends on your purchased plan, permissions, configuration, and availability. This definition does not include every future feature in your subscription or guarantee delivery of an announced feature.

2. Accounts, access, and customer responsibilities

Provide accurate account and billing information, protect credentials, assign appropriate permissions, and promptly report suspected unauthorized access. You are responsible for users and instructions you authorize, including integrations and automated workflows. This does not make you responsible for a failure that the law attributes to Bearon.

You remain responsible for running your business, checking records and transactions, maintaining records you are legally required to keep, and complying with rules applicable to your customers, staff, sales, promotions, websites, and similar activities. Obtain necessary notices, permissions, and rights before submitting or disclosing another person’s data or content.

3. Permitted use and restrictions

We grant a limited, non-exclusive, non-transferable right to use the purchased Services for your lawful business purposes during the applicable service period. You must respect plan limits, access permissions, and applicable law.

Do not use the Services for fraud, unlawful surveillance, unlawful content or data processing, infringement, credential theft, malicious software, or unauthorized access. Do not bypass usage limits or security controls, interfere with other customers, or resell the Services without written permission. Restrictions on reverse engineering apply only to the extent permitted by law.

4. AI outputs and authorized actions

AI may produce inaccurate, incomplete, biased, outdated, or unsuitable content, code, recommendations, or instructions. Outputs may resemble outputs supplied to other users and may implicate third-party rights. Bearon does not guarantee accuracy, originality, legal compliance, revenue, business growth, search rankings, or any particular outcome.

You must assess suitability and review outputs before relying on them, publishing them, or allowing them to affect customers, staff, finances, or business records. AI outputs are not a substitute for qualified legal, financial, medical, or other professional advice.

AI and automation may retrieve business data and execute actions through enabled tools within the access and settings you authorize. Do not assume every workflow includes a separate confirmation step. You are responsible for the permissions and automation you authorize, reviewing material actions, and supervising their business use. This allocation does not excuse Bearon from a failure to respect applicable access controls or obligations.

5. External providers and integrations

External providers support hosting, authentication, AI routing, model inference, security, and integrations. AI requests may include customer or business data as described in the Privacy Policy. Providers may change their availability, pricing, capabilities, or terms; dependent features can be interrupted or changed.

To the extent permitted by law, Bearon does not warrant independent third-party services and is not liable for losses caused solely by a third party’s independent conduct, your direct relationship with a third party, or your unauthorized or unlawful use of an integration. This is not a blanket exclusion for Bearon’s own handling of data, selection or use of providers, security obligations, or other liability that cannot lawfully be excluded.

Your use of a separately contracted third-party service is also subject to its terms. Required disclosures and authorization for service-provider processing cannot be replaced by accepting undisclosed third-party conditions.

6. Customer content and intellectual property

You retain rights you hold in your submitted data and content. You grant Bearon permission to host, process, transmit, and display that content as needed to provide the Services and carry out authorized instructions, including external AI processing described in the Privacy Policy. This does not grant unrestricted ownership of your business data or override personal-data rights.

Bearon and its licensors retain rights in their software, branding, interfaces, and proprietary materials. Rights in generated outputs depend on applicable law, provider terms, and any pre-existing third-party materials; we do not promise that every output is exclusive, copyrightable, or free from third-party rights.

7. Fees, cancellation, and service availability

Fees, purchased services, billing period, credit allowances, and any renewal arrangements are those disclosed in your subscription or agreed order. Additional products or features may require separate charges. The Refund and Cancellation Policy below governs cancellation, credit limits, and non-refundable payments.

Unless a separate written agreement provides otherwise, the Services are provided “as is” and “as available”, to the extent permitted by law. We do not guarantee uninterrupted, error-free service, fitness for a particular purpose, or compatibility with every external system. No uptime commitment or security certification is created by these terms.

8. Limitations of liability

To the fullest extent permitted by law, Bearon excludes liability for indirect, incidental, special, consequential, or punitive losses, including lost profits, revenue, anticipated savings, business opportunities, goodwill, and indirect loss or corruption of data arising from the Services, AI outputs, automation, or external services.

To the fullest extent permitted by law, Bearon’s total aggregate liability for claims arising out of or relating to the Services or these terms, under contract, negligence, or any other legal basis, will not exceed the fees you paid to Bearon for the Services during the 12 months immediately preceding the event giving rise to the claim. Related claims are treated together for this aggregate limit.

These exclusions and the cap apply only where lawful and enforceable. They do not limit liability for fraud, deliberate wrongdoing, or any liability or remedy that applicable law does not permit to be excluded or limited. They do not waive personal-data rights, statutory duties, regulatory powers, or mandatory consumer protections where applicable. Agreeing to use AI is not a waiver of a legally valid data-protection claim.

9. Customer indemnity

To the extent permitted by law, you will indemnify Bearon against third-party claims and reasonable associated costs caused by your unlawful content, lack of authority to supply or disclose data, infringement of third-party rights, or misuse of the Services in material breach of these terms. This obligation applies to conduct attributable to you and your authorized users; it does not cover Bearon’s own wrongful conduct or liability the law requires Bearon to bear.

Bearon must give reasonably prompt notice of the claim and reasonable cooperation. You may control the defense using competent counsel, but may not agree to a settlement that admits fault by Bearon or imposes non-monetary obligations on Bearon without its written consent. Bearon may participate at its own expense.

10. Suspension, termination, and data exit

We may restrict or suspend affected access for non-payment, unlawful use, material breach, or a genuine security or service-integrity risk. Where lawful and practical, we will explain the reason and provide an opportunity to resolve it. Immediate restriction may be necessary to prevent harm or meet a legal requirement.

Cancellation ordinarily leaves purchased access available until the end of the paid subscription period, subject to credit limits and valid suspension. Arrange any available exports before access ends. Do not assume every data type has a self-service export or that access will remain available after expiry. Deletion and continued retention are governed by the Privacy Policy and applicable law.

Provisions concerning accrued payments, intellectual property, lawful retention, indemnities, disputes, and limitations of liability survive termination to the extent necessary and lawful.

11. Disputes and mandatory local rights

Please first contact admin@bearon.studio with details of a dispute so that we can seek a resolution. This does not prevent urgent relief, a complaint to a regulator, or a remedy available under mandatory law.

These terms are governed by the laws of the Republic of Indonesia. Disputes are subject to the competent courts of Indonesia, except where mandatory applicable law requires another forum or provides a right that cannot be restricted by this clause.

Customers outside Indonesia may have mandatory local rights that still apply. Operating primarily as a B2B service does not remove statutory obligations toward individuals whose data is processed.

12. Changes and interpretation

We publish revisions with an updated date. Material changes require any notice or acceptance required by applicable law or the agreement; a posted revision does not automatically amend an existing fixed commitment or permit retroactive charges. If a clause is unenforceable, the remainder applies to the extent lawful. Failure to enforce a clause is not a waiver of later enforcement.

1. Payments and refunds

Subscription payments, purchased credits, and unused credits are non-refundable, except where a refund or other remedy is required by applicable law or expressly agreed by Bearon in writing. There is no automatic prorated refund because you cancel, stop using a feature, use fewer credits, or do not obtain an expected AI or business result.

This policy does not exclude mandatory remedies for a legally actionable failure to supply a purchased service. If you believe a charge is unauthorized, duplicated, or incorrect, contact us with the account and transaction reference for review. Do not send full card details or passwords.

2. Cancellation and access

Submit cancellation through the available subscription controls or contact admin@bearon.studio for assistance. Cancellation takes effect at the end of the current paid subscription period. It does not end access immediately or create a refund for the remaining period.

AI and other credit-based services remain subject to the available credit balance and applicable usage limits. They stop when the permitted credits are exhausted, even if time remains in the subscription period. Cancellation does not replenish credits or grant unlimited usage.

3. Credit expiry and account closure

Unused credits expire and are not refundable. The applicable expiry determines how long a balance remains usable; cancellation does not convert it into cash or a guaranteed entitlement to access after the paid subscription period.

Cancellation, account closure, and deletion are separate actions. Contact us for a data request and arrange available exports before access ends. The Privacy Policy governs retained information.

1. Confirmed measures and their scope

Bearon uses encryption as a security measure, AWS Cognito for authentication, and Cloudflare for rate limiting and DDoS protection. Business modules use authenticated access and the role permissions they provide. DigitalOcean hosts the server in Singapore, and AWS S3 hosts images.

These measures reduce particular risks; they are not a guarantee against every attack, unauthorized disclosure, loss, or service interruption. This policy does not claim a particular encryption algorithm, universal end-to-end encryption, certification, or security assessment.

2. Customer access and data handling

Protect passwords and devices, grant only necessary access, remove access when no longer required, and review integration and AI tool permissions. Do not share credentials or place secrets in prompts, files, or public website content. Review data and generated content before authorizing publication or external actions.

Customers are responsible for lawful data collection and authorized business use. Bearon remains responsible for its own obligations under applicable law. A customer’s mistake or an external provider’s involvement does not automatically determine legal responsibility for an incident.

3. External processing and risk

AI and integrations may transmit customer or business information to external providers as explained in the Privacy Policy. Controls applied within Bearon do not describe every provider’s infrastructure, retention, training practices, or processing location.

Before using sensitive or regulated information, ask about the relevant workflow and provider configuration. Do not treat this policy as approval for an industry-specific compliance requirement, a data-residency requirement, or an unrestricted transfer of personal information.

4. Reporting concerns

Report suspected unauthorized access, disclosure, or a vulnerability to admin@bearon.studio. Include the affected service, approximate time, and enough detail to identify the issue. Do not include other people’s exposed data, credentials, or unnecessary sensitive information.

Do not access other customers’ data or disrupt the Services when reporting an issue. This policy does not authorize penetration testing. Legally required security and notification obligations remain applicable; the service disclaimers and liability clauses do not remove them.