Who is responsible
Beyond Brute Force Systems Limited, registered in England and Wales, company number 17495620. Registered office: 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE. BBF is the controller for its GLYX customer account, activation and support records. Ben Vivian is the initial business contact through hello@beyondbruteforce.com; this does not describe a separate data protection officer appointment.
What we handle
For sign-up and sign-in, your email and password go directly to Google Firebase Authentication. BBF validates the returned authentication and email-verification status and uses the account identifier. We also handle approved-device verification information, pairing and activation records, trial dates, original-input byte totals and integrity records needed to operate the trial. We do not need your archive contents or recovery key for account activation.
Your local archive
The current archive and recovery flow keeps archive contents and recovery keys on your device. The account service is not an archive-upload or cloud-backup service. Do not email passwords, recovery keys, authentication codes or links, or confidential file contents to support.
Why we use information
We use necessary account and device information to provide the trial you request, relying on performance of the agreement or steps taken at your request before it. We use proportionate security, trial-eligibility and misuse-prevention records for our legitimate interests in protecting the service and its users. Where a legal duty applies, we keep the necessary records to meet it. We use support correspondence to answer your request and resolve problems. Contact us if you wish to object to legitimate-interest processing or request a review of an access decision.
Hosting, authentication and support
The website and account service use ChatGPT Sites hosting on Cloudflare infrastructure, including the account ledger. BBF is based in the UK and offers this free Mac trial internationally. OpenAI OpCo LLC acts as hosting processor and uses subprocessors including Cloudflare. Google Firebase Authentication handles authentication. Messages to our support address are handled in the existing Microsoft Exchange Online business mailbox. These services process information for their respective roles; they do not become the owner of your local archive.
International processing
Google states that Firebase Authentication processes authentication data in US data centres. Hosting and support can also involve processing outside the UK; we do not promise UK-only storage. The published hosting data-processing terms provide international-transfer safeguards, including standard contractual clauses and the UK Addendum where applicable. Provider locations and retention arrangements vary. See the provider information linked below or contact us for information about the safeguards relevant to your data.
Provider retention
Google states that Firebase authentication data is removed from its live and backup systems within 180 days after the Firebase customer deletes the user, and that authentication IP logs are kept for a few weeks. This is a provider timetable, separate from BBF’s controlled-record targets. Account closure does not imply instant removal from every provider backup.
Account storage and optional features
The account page keeps sign-in tokens in page memory rather than browser persistent storage. Optional account-page analytics and marketing are off by default. BBF does not use customer archive contents, keys or support attachments for its generative-AI tools or model training by default. Provider security and abuse checks are separate. General website browsing has its own website privacy information.
Retention and account closure
We use the purpose-based targets below for records we control, with necessary active-account, legal and incident exceptions. A hash or device fingerprint can still be personal data. If you request erasure, we review the exact records and explain any necessary retained subset rather than claiming everything is anonymous or immediately erased. Our procedure includes dependency checks and suppression checks before a controlled restore so erased records are not silently reintroduced. Provider-managed backups follow their own arrangements.
Your choices and rights
Depending on the circumstances, you can request access, correction, erasure, restriction or portability, object to legitimate-interest processing, and withdraw consent where we rely on it. Contact hello@beyondbruteforce.com. We may make proportionate ownership checks. We handle requests without undue delay, normally within one calendar month; we explain an applicable exception or extension. You may complain to the Information Commissioner’s Office. Where applicable, you can also contact the data-protection authority for your country or region. Account closure does not delete your local archive or matching key.
Closing an account with an active paid plan? See how to stop renewal before account closure.
Provider information
Read the Sites hosted-data processing terms, hosting subprocessor information, Firebase privacy and retention information and Microsoft data-processing information. These links explain provider arrangements; they do not mean your archive contents are uploaded to those services.
Our retention targets and review periods
- Unverified sign-ups
- Delete after 7 days if still unverified, subject to necessary security or abuse exceptions and the provider’s deletion process.
- Unused expired pairing material
- Aim to remove within 24 hours of expiry where it does not support necessary usage or entitlement history. This is a review target, not a continuous cleanup guarantee.
- Active account and access records
- Keep the necessary subset while the account or access remains active, with purpose and dependency review.
- Inactive free accounts
- Review after 12 months without activity and give 30 days’ warning before closure; check any continuing access first.
- Verified closure and rights requests
- Handle without undue delay, normally within one calendar month, with applicable exceptions explained.
- BBF-controlled technical and security logs
- 30 days by default, subject to a necessary incident or legal hold. Provider logs have separate schedules.
- Closed support and private feedback
- 12 months after closure or final interaction; remove unnecessary sensitive attachments sooner.
- Minimal trial and eligibility markers
- Review for deletion 12 months after the relevant eligibility window ends. Keep only what has a justified continuing purpose.
- Published feedback and permission records
- Only with separate publication permission; review annually and act on withdrawal. Leaving feedback is not required for the trial or support.
- BBF-controlled rolling backups
- A 30-day rotation target where those controls apply, with suppression on restore. This does not override provider backup timetables.
- Legally required financial records
- Where relevant, generally six years after the end of the relevant company financial year, or longer where required. This does not justify keeping every profile or support field.