Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that all users globally are granted rights to access, rectify, erase, restrict, object to, and port their personal data, as well as to withdraw consent, with some rights (rectification, deletion, consent withdrawal) exercisable directly in the app and all rights exercisable by contacting dpo@bere.al. French users are additionally granted a post-mortem data instruction right.
This analysis describes what BeReal's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that BeReal extends GDPR-equivalent data subject rights to all users globally, not only those in jurisdictions where such rights are legally mandated. The policy identifies dpo@bere.al as the contact for rights requests and states a 45-day response window for access, deletion, correction, and portability requests under U.S. law, with California opt-out requests processed within 15 business days.
The updated policy now requires email address in addition to phone number, full name, and date of birth to create an account. BeReal discloses that it derives likely gender from your username, first name, and biography using AI, and uses this classification for internal targeting purposes. The policy also reveals that a randomized sample of 0.001% of users will have their interface interactions (touches and swipes) recorded through an analytics partner for up to 90 days to understand how users navigate the app; this practice does not apply in all geographic regions. You can review your app settings or contact BeReal to inquire about your data collection status.
View change record →Under this provision, all BeReal users may submit requests to access, correct, delete, or port their personal data, or to object to or restrict processing, regardless of their jurisdiction, by contacting dpo@bere.al or using in-app controls in the settings section. The agreement states that BeReal will respond to access, deletion, correction, and portability requests within 45 days, with extensions permitted where applicable law allows.
Cross-platform context
See how other platforms handle User Data Rights (Global and U.S.-Specific) and similar clauses.
Compare across platforms →Monitoring
BeReal has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Privacy is a fundamental human right. That means every person that uses our App, irrespective of where they reside, can expect the same things from us. Whether you are in Europe, one of the 50 U.S. States, Latin America, the Middle East, Africa, Japan, Asia Pacific, or anywhere in between, you can: Right to access and obtain a copy of your data... Right of rectification... Right to erasure/deletion... Right to restrict processing... Right to withdraw your consent... Right to object... Right to portability... Right to set instructions for how your data is processed post-mortem...Excerpt from BeReal's Privacy Policy
REGULATORY LANDSCAPE: This provision reflects commitments under GDPR (Articles 15-21), CCPA/CPRA, and analogous U.S. state consumer privacy laws. CNIL is identified as the lead supervisory authority for EU/EEA users. The global extension of these rights beyond jurisdictions where they are legally mandated is a policy election rather than a legal requirement in all covered geographies. GOVERNANCE EXPOSURE: Low. The rights framework described is consistent with applicable legal requirements in the EU and California, and the global extension reduces the compliance complexity of jurisdiction-differentiated rights management. The 45-day response window and 15-business-day California opt-out timeline are consistent with applicable legal requirements. JURISDICTION FLAGS: EU/EEA users retain the right to lodge complaints with CNIL or their local supervisory authority. California residents have the right to appeal denied requests by contacting dpo@bere.al with 'Privacy Appeal' in the subject line. The post-mortem data instruction right is described as applicable to French users only. CONTRACT AND VENDOR IMPLICATIONS: Data processing agreements with service providers should address the obligation to support data subject rights requests, including deletion and portability workflows, within the timelines established by this policy and applicable law. COMPLIANCE CONSIDERATIONS: Compliance teams should verify that the in-app controls for rectification, deletion, and consent withdrawal are operationally functional and that requests submitted to dpo@bere.al are tracked and responded to within the committed timelines. The identity verification process for rights requests should be assessed for proportionality under GDPR and applicable U.S. state law.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes that BeReal extends GDPR-equivalent data subject rights to all users globally, not only those in jurisdictions where such rights are legally mandated. The policy identifies dpo@bere.al as the contact for rights requests and states a 45-day response window for access, deletion, correction, and portability requests under U.S. law, with California opt-out requests processed within 15 business days.
Under this provision, all BeReal users may submit requests to access, correct, delete, or port their personal data, or to object to or restrict processing, regardless of their jurisdiction, by contacting dpo@bere.al or using in-app controls in the settings section. The agreement states that BeReal will respond to access, deletion, correction, and portability requests within 45 days, with extensions permitted …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by BeReal.