Last updated: July 2, 2026

Privacy Policy

Bellator Schedule Intelligence
Bellator Consulting Group LLC

Last Updated: July 2, 2026

1. Introduction and Scope

Bellator Consulting Group LLC ("Bellator", "we", "us", or "our") operates Bellator Schedule Intelligence, which provides schedule analysis and intelligence through two primary interfaces:

  • Our APIs (https://api.bellatorsi.com): Stateless REST APIs built for developers and SaaS builders who need to integrate schedule health scoring, critical path analysis, compliance checks (DCMA, GAO, AACE, PMBOK), risk simulation, and related capabilities into their own tools. These APIs follow a "pure intelligence, no storage" model — you send the complete schedule data with every request, and we return results without retaining your schedule.

  • Our Web Application (https://bellatorsi.com): An easy-to-use web interface for project managers, schedulers, and PMO teams. Upload schedules in common formats (MS Project XML, Primavera P6 XER, JSON, CSV), receive instant health scores and detailed reports, generate PDF or Excel exports, compare against baselines, and collaborate on paid plans. The Free tier requires consent to contribute anonymized schedule patterns for AI model improvement; paid plans offer optional participation and longer data retention.

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information and schedule data when you create an account, call our APIs, upload schedules through the web application, or subscribe to paid services.

Our guiding principle is privacy by design and data minimization. The stateless nature of our APIs and the ephemeral processing model used in the web application are intentional choices that keep your sensitive project data under your control.

2. Information We Collect

We collect information you provide directly and information generated automatically when you use our services.

2.1 Account and Identity Data

  • Name, email address, and company or organization name
  • Authentication credentials (hashed using strong algorithms; never stored in plaintext)
  • Payment and billing information (processed exclusively by Stripe — we never store raw credit card numbers, bank details, or sensitive payment card data)
  • Subscription tier and account status

2.2 API Request and Schedule Data

When you use our APIs or web application:

  • Request metadata: Endpoint, timestamp, HTTP status, response latency, IP address, and payload size (used for rate limiting, security, billing, and diagnostics)
  • Schedule data you submit:
    • Processed ephemerally in secure, short-lived compute environments.
    • Never persistently stored by Bellator unless you explicitly save or export results (for example, by downloading a PDF/Excel report or saving analysis output in your own systems).
    • In the web application, schedule data is retained only for the period associated with your plan so you can view reports and re-run analyses:
      • Free plan: 24 hours
      • Starter / Pro plan: 7 days
      • Enterprise / Government plan: As configured in your workspace (subject to deletion rules)
    • After the retention period ends, raw schedule data is securely deleted unless you have explicitly saved it or it is subject to a legal hold.

2.3 Anonymized Training Data (Web Application – AI Improvement)

We use consented, anonymized schedule data from the web application to train and improve our machine learning models for better health scoring, compliance detection, risk prediction, and simulation capabilities.

Free Plan (Required Consent)
To use the Free plan in the web application, you must explicitly opt in. By doing so, you consent to:

  • Irreversible anonymization of your uploaded schedule
  • Use of the anonymized data to train and improve our AI models

Anonymization process (designed to prevent re-identification where feasible):

  • Removed or replaced: Project name and description, task names (replaced with generic labels such as Task_001), resource names, actual calendar dates (converted to relative offsets), company identifiers, and free-text fields that could contain personal information.
  • Retained for learning only: Task durations, dependency structures, relationship types, float values, constraints, and other structural scheduling patterns.

Paid Plans (Starter, Pro, and Enterprise / Government – Optional Consent)
You can turn participation in anonymized training data contribution on or off at any time in your account settings. Opting out means your schedules are still fully processed but are never added to our training datasets.

Important: Once anonymized patterns are incorporated into our models, it is not technically possible to remove individual contributions. Opting out only stops future contributions.

Note: This training data flow applies only to users of the web application. Pure API users who never upload schedules through bellatorcg.com are not asked for this consent.

2.4 Technical and Analytics Data

  • Browser type and version, device type, operating system
  • Referring URLs, pages visited, and feature usage patterns
  • We use privacy-respecting analytics configured to minimize collection of personal data and avoid unnecessary cross-site tracking. We do not sell this data or use it for behavioral advertising.

3. How We Use Your Information

We use the information we collect only for the following purposes:

  • Provide, operate, and maintain our APIs and web application (authentication, request processing, analysis, reporting, rate limiting, and customer support)
  • Improve the accuracy and capabilities of our schedule intelligence features — using only anonymized, consented data from the web application
  • Detect, prevent, and respond to security issues, abuse, fraud, or technical problems
  • Comply with legal obligations and enforce our Terms of Service
  • Send service-related communications (account, billing, security, and support notices). We do not send marketing emails without your explicit consent
  • Support internal operations such as billing, accounting, and aggregated analytics

We do not:

  • Sell your personal information or schedule data
  • Use your raw (non-anonymized) schedule data for any purpose other than delivering the analysis you requested
  • Share your schedule content with other users or third parties except as you explicitly authorize or as required by law

Where GDPR, UK GDPR, or similar laws apply, our legal bases include:

  • Performance of a contract — When you create an account, use paid services, or call our APIs
  • Legitimate interests — Platform improvement, security, and fraud prevention (balanced against your rights)
  • Consent — Marketing communications and the required (Free plan) or optional (paid plans) contribution of anonymized schedule data for AI training
  • Legal obligation — Tax, accounting, and regulatory requirements, plus responses to valid legal requests

You can withdraw consent at any time for consent-based processing by updating your account settings or contacting us. Withdrawal does not affect processing that already occurred.

5. Data Sharing and Sub-processors

We do not sell your personal information or schedule data.

We share data only with trusted service providers who act as data processors under contracts that require them to protect your information to standards at least as protective as ours. A current list is available upon request at [email protected].

Current Sub-processors

Provider Purpose Data Involved Notes / Safeguards
Stripe Payment processing & subscriptions Billing metadata We never receive raw card data
Microsoft Azure Cloud hosting, compute, storage All categories (ephemeral + retained) Regional options available; enterprise security controls
Clerk or Auth0 Authentication & identity management Account and login data Strong encryption and access controls
SendGrid (or equivalent) Transactional email delivery Email address + service notices Used only for account and billing emails
Privacy-focused analytics Aggregated usage metrics Technical & usage data (minimized) Configured to limit personal data

We may disclose information when required by law or valid legal process, or to protect the rights and safety of Bellator, our users, or others. In a corporate transaction (merger, acquisition, or asset sale), information may transfer subject to the same privacy protections.

6. Data Retention

We retain information only as long as necessary and in line with data minimization principles.

Data Category Typical Retention Notes
Account and identity data While account is active + up to 3 years after closure Legal, tax, accounting, and abuse prevention
API request metadata and logs 90 days Security, rate limiting, diagnostics; longer only under legal hold
Raw schedule data (APIs) Ephemeral (processing window only) Deleted immediately after analysis unless you explicitly save results
Raw schedule data (web application) Free: 24 hours
Starter and Pro: 7 days
Enterprise / Government: Workspace-configurable		 Deleted after retention period unless you save or export it
Anonymized training data Indefinite once incorporated De-identified and aggregated; cannot be linked back to you or your projects
Encrypted backups Rolling schedule Subject to the same retention logic as primary data

You may request deletion of your account and associated personal data (subject to legal retention requirements) by emailing [email protected]. Anonymized training data contributions cannot be individually removed once incorporated into models.

7. Your Rights

Subject to applicable law, you may have rights to:

  • Access the personal data we hold about you
  • Correct or update inaccurate personal data
  • Request deletion of your personal data (with the limitations noted for anonymized training data)
  • Restrict or object to certain processing
  • Receive a portable copy of your data (where technically feasible)
  • Withdraw consent for consent-based processing (including future training data contributions)
  • Lodge a complaint with your local data protection authority

How to exercise your rights
Email [email protected] with the subject "Data Rights Request." We will verify your identity and respond within legal timeframes (typically 30 days). Because our APIs are stateless and we do not retain raw schedule data long-term, requests related to schedule content will usually confirm that no persistent schedule data exists beyond operational logs and consented anonymized training patterns.

Web application users can manage their training data consent toggle directly in account settings.

8. Security

We take the protection of your project schedule data seriously, especially for clients in defense, government, construction, and engineering.

Core protections include:

  • Stateless API design: Schedule data sent to our APIs is processed in isolated, short-lived environments and purged immediately after the response is returned. This greatly reduces data exposure.
  • Ephemeral web processing: Raw schedules in the web application are held only for the minimum time required by your plan and then securely deleted.
  • Encryption: TLS 1.3 in transit; strong encryption for any temporarily stored data.
  • Access controls: Least-privilege principles, multi-factor authentication for internal systems, and regular reviews.
  • Infrastructure: Microsoft Azure with enterprise-grade physical and network security. We are pursuing relevant attestations (SOC 2 and others) as the platform matures.
  • Secure development practices: Code reviews, vulnerability scanning, and penetration testing.

Data sovereignty options
For organizations with strict requirements (air-gapped environments, FedRAMP, ITAR, IL5, CMMC, etc.), we offer self-hosted and managed deployment models where your schedule data never leaves your controlled infrastructure. Contact us for details.

No system is 100% secure, but our architecture (stateless APIs + ephemeral processing + minimal retention) provides strong protection for sensitive scheduling work. Report any suspected security incident immediately to [email protected].

9. International Data Transfers

Your information may be processed in the United States and other countries where our sub-processors (primarily Microsoft Azure and Stripe) operate.

When transferring personal data from the EEA, UK, or other regions with restrictions, we use appropriate safeguards such as Standard Contractual Clauses, Data Processing Agreements, and available regional data residency options in Azure. You may request details of these safeguards by contacting [email protected].

10. Children's Privacy

Our services are not directed to individuals under 16 (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal information from children. If you believe we have done so, contact us immediately at [email protected] so we can delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top will always show the current version. For material changes, we will provide notice by email, in-product message, or prominent notice on our websites at least 30 days in advance where practicable. Your continued use of the services after the effective date means you accept the updated policy.

12. Contact Us

Privacy questions or data rights requests
[email protected]

Security incidents
[email protected]

Mailing address
Bellator Consulting Group LLC
Principal Office (on file with Maryland SDAT)
1200 Agora Drive Suite C #223
Bel Air, Maryland 21014
United States

For EEA or UK data protection inquiries, you may also contact our designated representative (details available on request) or your local supervisory authority.

Thank you for trusting Bellator Schedule Intelligence with your project schedules.

Our commitment to privacy by design — stateless APIs, ephemeral processing, transparent consent for any AI training use, and aggressive data minimization — is fundamental to delivering reliable schedule intelligence for demanding professional environments.

If you have questions about this policy or how we handle data, we welcome your feedback.

© 2026 Bellator Consulting Group LLC. All rights reserved.
Bellator Schedule Intelligence — Pure schedule intelligence. Stateless where it matters. Built for developers and project teams.