Menu

Privacy Policy

What we collect, why, and how you stay anonymous to the companies you verify

Last updated: October 9, 2026

Bektu exists so that a buyer abroad can verify a developer without the developer knowing who is asking. This policy explains exactly what we know about you, who else sees it, and what never leaves Bektu.

Read also: our Terms of Service.

1. Who is responsible for your data

Bektu Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, United States ("Bektu", "we", "us") is the controller of the personal data described in this policy. You can reach us at legal@bektu.com.

This policy explains what we collect, why, who we share it with, how long we keep it, and what rights you have. It covers bektu.com and its subdomains, the Bektu API and MCP servers, the Bektu agent, the embeddable badge, and the emails we send. It should be read with our Terms of Service.

Bektu is built around a specific promise: a buyer can verify a real estate company anonymously, without the company learning who they are. That promise shapes how we handle data, so we describe it first.

2. Two kinds of people, two kinds of data

Users are the people who read Bektu, create accounts, chat with the agent, buy verifications, or manage a company dashboard. We collect data from you directly and through your use of the Service.

People described on Bektu are founders, directors, and staff of real estate companies whose names and roles appear on company profiles. We collect this data about them from public sources, usually without them being users. Section 9 is written for them.

3. What we collect from users

Account data. Your email address, a username we generate, your sign-in method, and the time you joined. If you sign in with Google or LinkedIn we receive your name, email, and profile picture from the provider; we store the identifier they give us so we can recognize you next time. We do not receive your password from them, and we do not store passwords at all: sign-in by email uses a one-time code.

Things you do on the Service. Companies you track, articles you unlocked, agent conversations (your messages and the agent's replies), context the agent saves to answer you better (for example your target country or budget range, never your identity documents or financial account details), verifications and discoveries you start, research requests you file, and ratings or feedback you give.

Payment data. Payments are processed by Stripe. We receive the amount, a customer and subscription identifier, the last four digits and brand of the card, and the status of the payment. We never see or store your full card number.

Company dashboard data. If you claim a company, we collect the company legal name and registration number you enter, the DNS record or domain email you use to prove control, the projects, units, photos, and documents you publish, and notes you exchange with our review team. Documents you upload are stored on Vercel Blob.

Communications. Emails you send us, replies to our emails, information requests, and support threads.

Technical and usage data. IP address, browser and device type, the pages you view, how long you spend on them, how far you scroll, which buttons you click, referring page, and campaign parameters on the link that brought you here. See Section 6 for cookies and analytics.

4. Why we use it and on what legal basis

  • Provide the Service, keep you signed in, show your account, deliver purchases. Data: account, activity, payment. Legal basis: performance of our contract with you.
  • Run an anonymous verification on your behalf and tell you when something happens. Data: account, verification records. Legal basis: contract.
  • Give the agent memory of your stated preferences so it answers your market. Data: agent context. Legal basis: contract and your consent (you can ask us to clear it).
  • Email you about your account, purchases, verifications, claims, and the daily newsletter you subscribed to. Data: email, activity. Legal basis: contract, and consent for marketing emails.
  • Protect the Service: rate limiting, fraud and abuse detection, security logs. Data: technical data, IP address. Legal basis: legitimate interest in security.
  • Understand how the Service is used and improve it. Data: usage data, session recordings. Legal basis: legitimate interest, and consent where your law requires it.
  • Comply with law, tax, and accounting rules and defend legal claims. Data: account, payment, verification records. Legal basis: legal obligation and legitimate interest.

We do not sell your personal data, and we do not use your data to train AI models.

5. The anonymity promise in detail

When you ask Bektu to verify a company, Bektu is the sender. The email the company receives, the page it replies on, and every follow-up question refer only to "an anonymous buyer". They never contain your name, email, IP address, location, or any identifier. If a company needs to reach you, the reply goes to Bektu and we relay it to you.

Bektu itself does know who you are: you sign in before an inquiry starts, so that we can show you the result, prevent abuse, and keep a record. "Anonymous" means anonymous to the company, not anonymous to us.

Your verification tracker, discovery results, agent conversations, and lawyer engagements are private to your account. They are shown only to you after sign-in, are marked so search engines do not index them, and are never visible to other users or to the company.

Company replies and documents from an inquiry may become part of the company's public record (for example, "no reply within 7 days" or a document the company chose to make public). Your identity is never part of that record.

6. Cookies, analytics, and session recordings

We use these cookies and browser storage items:

  • Sign-in token in browser storage: keeps you signed in. Lifetime: until you sign out.
  • bektu_anonymous_session: counts property pages viewed before we suggest signing in; also used for soft rate limiting. Lifetime: 30 days.
  • bektu_property_visits, bektu_login_prompt_shown: remember which properties you viewed and whether we already showed the sign-in prompt. Lifetime: 30 days.
  • bektu_first_touch: remembers the campaign link that first brought you to Bektu, so we know what works. Lifetime: 365 days.
  • Guest agent and handoff entries in session storage: keep an unsigned-in agent conversation alive while you sign in. Lifetime: until you close the tab.
  • PostHog cookies (ph_*): product analytics and session recordings. Lifetime: up to 1 year.
  • Google Analytics cookies (_ga*): aggregate traffic measurement. Lifetime: up to 2 years.
  • TikTok pixel (_ttp): measures whether ads on TikTok led to a visit. Lifetime: up to 13 months.

Analytics. We use PostHog (primary) and Google Analytics 4 (secondary) to understand which pages are read, where readers drop off, and which features are used. Events include page views, time on page, scroll depth, searches, and conversion steps such as starting a checkout. We strip emailed tokens from the URLs we send to analytics.

Session recordings. PostHog may record how you interact with a page (mouse movement, clicks, scrolling, and the page content shown). Form inputs are masked by default. Recordings help us find usability problems. You can opt out of analytics and recordings by enabling "Do Not Track" or a tracker-blocking setting in your browser, or by emailing legal@bektu.com; where your law requires consent for these tools we will ask before enabling them.

Advertising measurement. The TikTok pixel tells us whether a TikTok ad led to a visit or purchase. It does not receive your name or email from us. You can opt out through your TikTok ad settings or a tracker blocker.

Essential cookies cannot be switched off because the site would not work without them (sign-in, security, rate limiting).

7. Who we share data with

We share personal data only with providers who process it for us under contract, and only what each needs:

  • Stripe: payments and subscriptions. Receives: email, payment details, purchase metadata.
  • Resend: sends our transactional emails and the newsletter. Receives: email address and email content.
  • MongoDB Atlas: hosts our database. Receives: all stored data, encrypted in transit and at rest.
  • Vercel: hosts the website; stores uploaded files (Vercel Blob). Receives: request logs, uploaded documents and photos.
  • Hetzner: hosts our API servers (Germany and Finland). Receives: request logs, database traffic.
  • OpenAI: powers the agent, question drafting, assessments, embeddings, and SEO text. Receives: your agent messages and the company evidence they are answered from; not your email or name.
  • Anthropic: powers document discovery and market exploration searches. Receives: the company name and public evidence being searched; not your identity.
  • PostHog: product analytics and session recordings. Receives: usage events, device data, recordings, and your user ID once signed in.
  • Google (Analytics, Maps, Sign-in): traffic measurement, maps on project pages, optional sign-in. Receives: device and usage data; for sign-in, the fact that you authenticated.
  • LinkedIn: optional sign-in. Receives: the fact that you authenticated.
  • HubSpot: our CRM for company relationships. Receives: company contact details; not buyer data.
  • Sanity: hosts our articles. Receives: no user data.
  • AirDNA: short-term rental market data. Receives: no user data.
  • TikTok: advertising measurement. Receives: pixel events, see Section 6.
  • Independent lawyers: lawyer review you request. Receives: the documents and questions you choose to send them, and the details they need to contact you.

We also disclose data when the law requires it, to protect our rights or users' safety, or to a successor if Bektu is acquired or merges (we will tell you before your data is governed by a different policy).

Real estate companies never receive buyer data. When you verify a company anonymously, the company receives Bektu's questions and nothing about you. When you file a research request, our research team receives it internally and may email you back; the company does not.

8. International transfers

Bektu is a United States company. Our database and most providers are in the United States; our API servers are in the European Union. If you are in the EU, the UK, or another region with transfer rules, your data may be transferred to the United States. We rely on our providers' standard contractual clauses and, where applicable, their participation in the EU-US Data Privacy Framework.

9. People described on company profiles

Bektu publishes the names, roles, and professional profile links of founders, directors, and senior staff of real estate companies, because knowing who is accountable for a project is central to verifying it. We collect this from public sources: company websites, public registries, professional networking profiles, press, and documents companies send us. We do not publish home addresses, personal phone numbers, personal emails, government ID numbers, or anything about a person's private life.

Our legal basis is our legitimate interest, and the public interest, in transparency about who is behind companies that sell property to buyers abroad. We weigh this against your interests by limiting what we publish to professional role information that is already public.

Your rights. You can ask us to correct your role, add context, or remove you from a profile. Write to legal@bektu.com with the profile, your name, and the reason. We will correct confirmed errors. We will remove an association where it is wrong, out of date, or where your interest clearly outweighs the public interest, for example if you are not in a leadership role, or if publication puts your safety at risk. We may keep a note that a correction was requested.

You can also claim your association yourself and confirm or dispute it; see the company dashboard.

10. How long we keep data

  • Account: while your account exists, then deleted within 30 days of your request to close it.
  • Agent conversations and saved context: while your account exists; guest conversations that are never claimed are deleted 7 days after their 24-hour token expires.
  • Verification and discovery records: the record is kept for the company's public history; your link to it is deleted or anonymized within 30 days of closing your account, and tracking links expire after 180 days.
  • Payment records: 7 years for tax and accounting law.
  • Email logs: 90 days at our email provider; our own record of what we sent you, while your account exists.
  • Analytics and recordings: per our analytics providers' retention, currently up to 1 year.
  • Anonymous visit counters: 30 days.
  • Company content you publish: while the claim is active and after, as part of the company's public record, unless we remove it under Section 9 of the Terms.

Where we no longer need personal data we delete it or anonymize it so it can no longer identify you.

11. Your rights

Depending on where you live (including the EU, UK, California, and other US states with privacy laws) you may have the right to:

  • access the personal data we hold about you and receive a copy;
  • correct inaccurate data;
  • delete your data, subject to records we must keep by law;
  • restrict or object to processing based on legitimate interest, including analytics;
  • port data you gave us in a machine-readable format;
  • withdraw consent at any time where we rely on it, without affecting past processing;
  • opt out of sale or sharing of personal data (we do not sell personal data; the only "sharing" in the California sense is the advertising pixel described in Section 6, which you can block);
  • not be discriminated against for exercising these rights;
  • complain to your data protection authority. In the EU, that is the authority in your country; in the UK, the Information Commissioner's Office.

To exercise a right, email legal@bektu.com from the address on your account, or tell us how to verify you. We answer within 30 days (45 days where California law allows). You can unsubscribe from the newsletter with the link in every edition, and from company alerts from your account page.

12. Security

We protect data with encryption in transit (TLS) and at rest, access controls and least-privilege roles for staff and automated systems, one-time codes instead of stored passwords, expiring tokens for every emailed link, rate limits on every public endpoint, and audit logs of changes to sensitive records. No system is perfectly secure. If we learn of a breach that affects your data we will tell you and the relevant authorities as the law requires.

13. Children

The Service is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, email legal@bektu.com and we will delete it.

14. Changes to this policy

We will post any change here with a new "last updated" date. If a change materially reduces your rights or expands what we collect, we will notify account holders by email or a notice on the site before it takes effect.

15. Contact

Bektu Inc.
131 Continental Dr, Suite 305
Newark, DE 19713, United States
legal@bektu.com