Beside Privacy Policy
Version 1, of October 22, 2026.
Editorial revision of October 27, 2026: the product is now called Beside, and section 3 now states that the use of data received from Google follows Google's user data policy. Nothing changed in the data we process or in how we process it.
This is a translation for convenience. The Portuguese version of this policy is the one that prevails.
This policy explains what personal data Beside processes, what for, with whom, for how long and
how you exercise your rights. Beside is offered by KXP Tecnologia da Informação Ltda., CNPJ
43.866.781/0001-04, headquartered in Belo Horizonte, MG, Brazil ("KXP", "we"), at
app.beside.place and in the apps for Windows, macOS and Linux.
Privacy contact: contato@kxptech.com. KXP is a micro-enterprise, a small-scale processing agent, and has no appointed data protection officer; this address is the channel for any request or question about your data, and it is read by the partners.
1. In short
- We do not sell data, do not show advertising and do not use third-party trackers.
- Voice, video and screen go out live and are not recorded.
- Your content is not used to train artificial intelligence.
- Beside does not hand anyone's arrival and departure times to their employer.
- The data stays in Brazil, with the exceptions in section 6.
2. Who decides about each piece of data
There are two roles, as provided for in the Brazilian General Data Protection Law (LGPD):
- KXP is the controller of your account data (name, email, password, photo), of the company's registration, of the access log that the law requires us to keep and of our communication with you. We are the ones who decide about them and handle your requests. We are also the controller of the technical log and of the usage counts, which we use only to keep the service working and secure.
- Your company is the controller of its office usage data: presence, conversations, chat, files, team memory and administration logs. KXP is the processor of this data and processes it only to provide the service, under the Data Processing Agreement annexed to the Terms of Use. Requests about this data go to your company; if they reach us, we forward them to it.
3. What data we process
Account. Name, email, password (stored only as a cryptographic hash, never readable), profile photo, if you upload one, and the appearance of your character and your pets.
Company. Name, logo, offices, rooms and desks, members and roles.
Office usage. Where your character is, in which room, whether you are available, the desk you claimed and the last place you were in each office, so you can return to it. Who is close to whom is calculated live to open the conversation.
Voice, video and screen. Transmitted live through our server only to those close to you or in the same room. They are neither recorded nor stored. The camera background and the microphone noise reduction are processed on your own device.
Chat. Messages, files, reactions, mentions and the preview of links sent. To build the preview, our server opens the link; your device does not.
Team memory. What the company's people record in it.
Google Calendar, if you connect it. The email of the Google account and a read authorization, stored encrypted. Events are read on the spot to show up in Beside and are not stored. You can disconnect whenever you want. Beside's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Activity log. The company's administration actions (invitation, role change, removal, office created or deleted): who did it, to whom and when. The company's admins can see it.
Access log. On each sign-in and each entry into an office: date, time, IP address and the account's email, as required by the Brazilian Internet Civil Framework (Marco Civil da Internet, Law 12,965/2014, art. 15). It is not shown to the company.
Technical log. To investigate connection, audio and video failures, the server records technical events, including who was close to whom, the connection quality and the IP address of each request, identifying the person by their display name, never by email. Only KXP's technical team has access.
Usage counts. How many people are in each office over time, without identifying anyone, so KXP can size the service. They are not shown to the company.
What the admin sees about each person. Only a last-access range (in the last 30 days, more than 30 days ago or never), with no date or time. If the company ever gets usage figures, they will only appear when they cover 5 people or more.
On your device. Beside keeps your session and your preferences (language, devices, layout) in the local storage of the browser or the app. We do not use tracking cookies or third-party analytics tools.
4. What for and on what legal basis
| Purpose | Legal basis (LGPD, art. 7) |
|---|---|
| Create and maintain the account, provide the service, give support | Performance of a contract (V) |
| Keep the access log for 6 months | Legal obligation (II), Marco Civil, art. 15 |
| Security, abuse prevention and failure investigation | Legitimate interest (IX) |
| Connect Google Calendar | Consent (I), which you withdraw by disconnecting |
| Notices about the service and about these documents | Performance of a contract (V) |
For office usage data, the legal basis is chosen by your company, which is the controller.
5. Who we share with
- People in your company, as the product shows: those in the office see your character, those close to you hear and see you, those who take part in a conversation read its messages, and the admins see members, the activity log and each person's last-access range. When the company is closed, the admin exports all chat channels, including private and archived ones, with their files; direct messages are downloaded only by each participant, their own.
- Suppliers that operate the service for us (sub-processors):
- Akamai Technologies (Linode): servers, database and chat files, in São Paulo.
- Amazon Web Services: sending emails (invitations, password recovery), in São Paulo.
- TypeSafe: relevance assessment in the team memory search, only for KXP's own organization. It receives the search and excerpts of the candidate memories. The country where it processes them has not been confirmed yet.
- Google, only if you connect your calendar, to read your events in your own account.
- Authorities, when the law or a court order requires it.
No content from client companies is sent to third-party artificial intelligence services. TypeSafe, above, only receives content from KXP's own organization.
6. Where the data stays
In Brazil. The service runs in São Paulo, and backups leave the server encrypted for a computer under KXP's control, also in Brazil. The exceptions are Google, when you connect your calendar, and TypeSafe, only for KXP's organization. If this changes, we will let you know beforehand.
7. For how long
| Data | For how long |
|---|---|
| Account | While it exists. It is deleted at your request (section 9) or when the only company it belongs to is closed |
| Office usage data | While the company exists, or until deleted by whoever can delete it. On closing, 30 days to export and then deletion |
| Voice, video and screen | Not stored |
| Activity log | 1 year |
| Access log | 6 months, as the law requires, even after the account is deleted |
| Technical log | 14 days |
| Usage counts | 180 days |
| Backups | One a day; we keep the 30 most recent, and older ones are deleted automatically |
8. Security
Every connection to Beside is encrypted. One company's data is isolated from another's, access to the servers is restricted to KXP's technical team, the password is never stored in readable form and backups are encrypted before they leave the server. KXP, with access to the server, can technically read the stored content, as happens with most services of this kind; it only does so in the situations in section 6 of the Terms of Use.
If there is a security incident that may pose a risk to you, we will notify you and the Brazilian National Data Protection Authority (ANPD), as the law requires.
9. Your rights
Under the LGPD, you may request: confirmation that we process your data; access to it; correction; anonymization, blocking or deletion of what is unnecessary or excessive; portability, once the National Data Protection Authority regulates it; deletion of what was processed with your consent; information about whom we share it with; information about the possibility of not consenting and what that implies (without connecting the calendar, it simply does not show up in Beside); and review of automated decisions, which Beside does not make. You may also withdraw a consent and object to processing that breaks the law.
To do so, write to contato@kxptech.com from your account's email. We reply within 15 days. We handle directly what concerns your account; requests about a company's office usage data are forwarded to it, and we let you know.
Deleting your account. For now, the request is made by email. We delete your name, email, password, photo, appearance, sessions, links to companies and the calendar connection. What you wrote in a company's conversations and team memory is that company's data (section 2): it stays there, attributed to "deleted account", unless the company asks for it to be deleted. The company's activity log keeps the name of whoever performed each administration action until the entry turns 1 year old, and the access log is kept for the 6 months that the law requires.
You may also file a complaint with the National Data Protection Authority.
10. Minimum age
Beside is for people aged 18 and over. If we learn of an account belonging to a minor, we delete it.
11. Changes to this policy
When this policy changes in a relevant way, we will let you know at least 30 days in advance and ask for a new acceptance on sign-in. The version and date are at the top.