You're handing us the keys. Here's how we hold them.

BeeCMO connects to your WhatsApp number, ad account, social pages and Google profile. This page explains in plain language how that access is stored and who can use it. It also covers the rules the product follows so your accounts stay in good standing.

Read the privacy policy

Access tokens are encrypted

Every password, API key and access token you connect is encrypted with AES-256-GCM before it's stored. The encryption is bound to the business it belongs to, so an encrypted token cannot be moved to another business and decrypted there. Tokens are never shown back in the app or returned by our API, and they are never written to logs. The encryption key is held as a platform secret, separate from the database.

API keys you create for your own integrations are stored only as a hash and shown to you once.

Each business is walled off

Every business, or every agency client, is its own workspace. Every query on business data is filtered by that workspace, and files are stored under a path for that workspace. People see only the workspaces they've been given a role in: admin, editor, approver or viewer.

Nothing risky happens without a person

• Anything that publishes, spends money or messages customers can be set to ask first. That is the default.
• Ad activation, resumed campaigns, budget increases and WhatsApp broadcasts always need approval. This cannot be switched off.
• Approval links sent to WhatsApp or email are signed, expire after 7 days, and open a confirmation page. Opening a link never approves anything by itself, because chat apps open links to build previews.
• Unanswered approvals expire after 30 days.
• Every change made to your Meta ad account is recorded with the request, the response, who made it and why.

Your money has limits

Meta ads run under daily and monthly caps you set, with a conservative default if you haven't. An hourly kill switch pauses every live campaign when spend passes the cap and never restarts on its own. AI usage has a monthly budget: near the limit, work moves to cheaper models, and beyond it, AI work pauses until you raise it.

Your customers are respected

• WhatsApp templates go only to contacts with a recorded opt-in, and we keep the proof: where, when and what text they agreed to.
• STOP opts a contact out immediately. Imports never re-subscribe someone who opted out. People who stop marketing messages are excluded from marketing automatically.
• Our WhatsApp assistant does one business task, qualifying leads, and hands over to a person. It is not a general-purpose chatbot, which Meta does not allow on the WhatsApp Business Platform since 15 January 2026.
• Website forms record consent separately, with the page and a hashed IP address as proof.

No review gating

Google prohibits asking only happy customers for reviews. Guard Bee asks every customer the same way. There is no rating or sentiment filter in the product, and requests that try to add one are rejected.

Policy compliance built in

• Meta. BeeCMO uses only official Meta APIs for the WhatsApp Business Platform (our Meta Tech Provider onboarding is in progress), Embedded Signup and Facebook Login for Business. Ads follow Meta's special ad category rules: political ads are blocked, and housing, employment and financial ads get the required targeting limits.
• Google. Google data is used only to provide the features you see. See the Limited Use disclosure in our privacy policy.
• Platform limits. Posting limits, messaging tiers and rate limits are checked before anything is sent. You shouldn't find out about a limit from a ban.
• Reddit. We don't auto-post to Reddit unless Reddit approves our app. Until then, you post drafts yourself.

Where your data lives

BeeCMO runs on Cloudflare: Workers for the application, D1 for the database, R2 for files, and Queues for background jobs. Data is stored on Cloudflare's network, with the main database in Cloudflare's Asia-Pacific region. Email is sent through Resend.

Data retention

You can delete contacts, leads, media and posts at any time, and ask us to delete your whole workspace. See Data deletion.

Report a security issue

Email [email protected]. We'll acknowledge it within 3 working days.