Privacy Policy

Version 1.4 · Effective 13 July 2026 · View revision history

This policy describes how PACE(a product of Becloudsmart) collects, uses and protects your information when you use our website, apps, and API (together, the “Service”).

1. Who we are

PACE is operated by Becloudsmart Pty Ltd. Where this policy refers to “we”, “us”, or “our”, it means Becloudsmart Pty Ltd. You can reach our privacy team at hello@pacemos.ai or via the contact form at becloudsmart.com.

2. Information we collect

We collect information in three categories:

• Account identity. When you or your administrator sign in via Microsoft Entra ID, we receive your display name, email address, Entra object identifier (oid) and Entra tenant identifier (tid). We do not receive your password.
• Workspace content. Actions, decisions, risks, meetings, reports, scorecards, nominations, readiness gates, uploaded knowledge-base documents, and any other data you or your users enter. This is stored in your dedicated database and blob container.
• Operational telemetry. Technical logs such as request paths, response codes, latencies, error traces, and AI call metadata (token counts, model name, duration). We do not log request bodies or response contents.

3. How we use it

We use your information only to operate the Service and to comply with law. Specifically:

• To authenticate you and route requests to the correct workspace
• To render your workspace content back to you and other authorised members
• To ground AI-generated outputs (plans, reports, meeting packs) in your uploaded documents
• To bill you via Stripe for paid plans
• To send transactional email (invitations, billing failures, report notifications) via Resend
• To investigate incidents, debug failures, and prevent abuse

We do notuse your workspace content to train any machine-learning model, ours or a third party’s.

4. Third-party processors

We rely on the following sub-processors. Each is bound by an enterprise agreement with appropriate data protection terms:

• Microsoft Azure — hosting, database, blob storage, managed identity, Key Vault, Application Insights telemetry. Hosted in Australia (Azure Australia East).
• Microsoft Entra ID — sign-in. We never see your password.
• Anthropic— Claude AI API for grounded generation. Per Anthropic’s terms, API data is not used to train their models.
• Voyage AI— embedding API used to index knowledge-base documents for retrieval. Per Voyage’s terms, API content is not used to train their models.
• Stripe — payment processing. We never see your full card number.
• Resend — transactional email delivery.

5. Data residency and workspace isolation

All customer data is stored at rest in Australia, in Microsoft’s Azure Australia East region. There is no per-customer region selection — every workspace resides in the same Australian region. When you use AI features, the relevant workspace content is processed transiently by our AI sub-processors (Anthropic and Voyage AI, listed in section 4) to generate the response; it is not retained by them and not used for training.

Each paying customer’s workspace data — including the knowledge-base documents, actions, decisions and reports — resides in a dedicated PostgreSQL database and a dedicated Azure Blob Storage container, logically and physically isolated from other customers. Control plane data (your account identity, billing state, audit log) lives in a separate database shared across workspaces but never mixed with workspace data.

6. How long we keep it

• While your account is active: we retain your workspace data so you can use it.
• After cancellation: workspace data stays available in a read-only state for 30 days. After that, the database and blob container are permanently deleted.
• Billing records: retained for 7 years to satisfy tax law.
• Operational logs: retained for up to 90 days.

7. Your rights

Under the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles, you may request access to, or correction of, the personal information we hold about you, and may ask us to export or delete it. You can also lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

To exercise these rights, email hello@pacemos.ai. We respond within 30 days.

8. Security

We use industry-standard safeguards including TLS 1.2+ for all data in transit, encryption at rest on all Azure storage, per-workspace database passwords stored in Azure Key Vault, managed-identity access control for every backend call, Entra multi-factor authentication, and short-lived SAS URLs for all blob downloads. No system is perfectly secure — report suspected issues to hello@pacemos.ai.

If a data breach occurs that is likely to result in serious harm, we will notify affected customers and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme.

9. Cookies

We use a single Auth.js session cookie (authjs.session-token, prefixed __Secure- on HTTPS) to keep you signed in. It is HTTP-only, same-site lax, and expires after 8 hours of inactivity. We do not use advertising or analytics cookies.

10. Children

The Service is not directed at children under 16. We do not knowingly collect information from children.

11. Changes

If we change this policy materially we’ll email account administrators and update the “last updated” date at the top. Continued use after the change means you accept the updated policy.

12. Contact

For privacy questions, security reports, or anything else, reach us at hello@pacemos.ai.