Privacy policy
Last updated: 16 October 2026
This policy explains how Behavr (ABN 69 736 572 825), a registered business name in Sydney, Australia (“we”, “us”), handles personal information when you use behavr.ai and the Behavr application (“the Service”).
We are based in Australia. We comply with the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles, and with the Notifiable Data Breaches scheme.
If you are in the European Economic Area or the United Kingdom, additional rights apply and are set out in section 9. If you are in a country whose law gives you stronger rights than this policy describes, those rights apply.
Contact: hello@behavr.ai
1. The two kinds of data in Behavr
This distinction matters, so we make it first.
Your account data. Information about you as our customer: your name, email, billing details, and how you use the Service. We decide how this is handled, so we are the controller of it.
Your uploaded research. Interview transcripts, support tickets, survey responses, notes and other material you upload to build a persona. This material may contain personal information about other people, such as your own customers or research participants. You decide what to upload and why. You are the controller of that material and we process it on your instructions.
Section 6 sets out what that means for both of us.
2. What we collect
You give us: account details (name, email address, and password credentials handled by our authentication provider, we never see or store your password); billing details (handled by our payments provider; we store a customer reference, your plan, and the last four digits and card type, and never see or store full card numbers); content you create (personas, tasks, prototype and site URLs, questions you ask during or after a session, and any files or text you upload); and anything you send us by email or support request.
We collect automatically: usage data (sessions started and completed, credits consumed, features used, timestamps); technical data (IP address, browser and device type, referring page, error logs); and cookies and similar technologies, as described in our Cookie policy.
If you arrive at behavr.ai through a link with campaign parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term or ref), we pass them to the application when you follow a link to it. If there are none, we pass a note that you came from behavr.ai and which link you clicked instead. The application stores the first set it receives with your account, to understand where sign-ups come from. behavr.ai itself stores nothing on your device to do this.
We do not collect special category data (health, biometric, political, religious or similar) about you, and we ask that you do not upload research material containing it. See section 6.
3. Why we use it
| Purpose | Legal basis (EEA/UK) |
|---|---|
| Providing the Service, running sessions and producing reports | Performance of a contract |
| Billing, and preventing abuse of free credits | Performance of a contract; legitimate interests |
| Security, fraud prevention, and keeping the Service working | Legitimate interests |
| Support and responding to your messages | Performance of a contract; legitimate interests |
| Product analytics and improving the Service | Consent; legitimate interests |
| Marketing emails | Consent, withdrawable at any time |
| Complying with law | Legal obligation |
We do not sell your personal information.
We do not use your uploaded research to train AI models, our own or anyone else’s. Our AI provider’s commercial terms prohibit training on content submitted through their API, and they delete API inputs and outputs within 30 days. See section 5.
4. How a session works, and what leaves our systems
When you run a session, Behavr sends any task you set, the persona description and screenshots of the page being tested to a third-party AI provider, which returns the persona’s actions and reasoning. The page being tested is loaded in a browser we operate.
If you point Behavr at a live URL, that site will see traffic from our infrastructure, including an IP address and user agent. Do not point Behavr at a site you are not authorised to test.
Behavr does not support testing pages that require signing in. Do not give Behavr credentials for any account, and do not point it at a page behind a login expecting it to get through.
5. Who we share it with
We use these providers. Each is bound by contract to protect the data and use it only to provide their service to us.
| Provider | Purpose | Data location |
|---|---|---|
| Anthropic | AI model processing | United States |
| Clerk | Authentication | United States |
| Stripe | Payments | United States and other regions |
| Railway | Backend hosting and processing | United States |
| Neon | Database | United States |
| Cloudflare R2 | Screenshot and recording storage | United States and global edge locations |
| Vercel | Website hosting and cookieless site analytics | United States and global edge locations |
| PostHog | Product analytics in the application | United States (AWS us-east-1, Virginia) |
| Loops | Transactional and marketing email | United States |
| Formspree | The contact form on behavr.ai | United States |
| Sentry | Error monitoring | United States |
| Figma | Reading a prototype you ask us to test | United States |
PostHog measures how the application is used. It runs in the Behavr application at app.behavr.ai, not on this marketing site. It records product usage events, which are linked to your Behavr user ID and to nothing else: we do not give it advertising identifiers and we do not use it to follow you across other sites. It is configured to keep its data in memory for the length of a page visit, so it sets no cookie and writes nothing to local storage. We use PostHog Cloud US, which PostHog hosts on AWS in Virginia.
We will also disclose information where we are required to by law, and to a buyer if the business is sold, in which case we will tell you first.
The table above is our current list of subprocessors. We will give notice at least 30 days before adding a new one that processes customer content.
6. Your uploaded research, and your obligations
You choose what to upload. Because that material may contain other people’s personal information, you agree that: you have a lawful basis to collect it and to share it with us for this purpose; you have given the people it concerns any notice they are entitled to; you will not upload special category data, government identifiers, payment card numbers, health records, or information about children; and you will remove or mask direct identifiers where you reasonably can. Behavr does not need names or contact details to build a persona.
We process that material only to build and run personas for you, and on your instructions. We do not use it for any other purpose. You can delete it at any time from the application.
If you are subject to the GDPR and require a data processing agreement, see our Data processing agreement, which applies automatically.
7. How long we keep it
| Data | Retention |
|---|---|
| Account, personas, uploaded research, sessions and chats | Deleted immediately when you delete your account |
| Your sign-in account and mailing list contact | Removed from Clerk and Loops when you delete your account |
| Screenshots and recordings from sessions | Deleted within 30 days of account deletion |
| Billing records (customer record and invoices) | 7 years, as required by Australian tax law |
| Backups | Up to 30 days |
| Server logs and error reports | Up to 30 days |
| Support messages | Up to 2 years |
Deleted content is removed from backups within 30 days.
8. Security
We use encryption in transit and at rest, access controls, and separation between customer workspaces. Payment card details never touch our servers. Passwords are handled entirely by our authentication provider.
No system is perfectly secure. If a breach affects your personal information and is likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.
9. Your rights
Everyone can ask us to access, correct, or delete their personal information, or to stop sending marketing. Email hello@behavr.ai. We will respond within 30 days.
If you are in the EEA or UK, you also have the right to restrict or object to processing, to receive your data in a portable format, to withdraw consent at any time, and to lodge a complaint with your supervisory authority.
If you are in Australia and are unhappy with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Requests about someone else’s data. If you are a research participant or customer of one of our users and want your information removed, contact that organisation directly. They control it; we only process it for them. If you contact us, we will pass the request on.
10. Sending information overseas
We are in Australia. The providers listed in section 5 operate in the United States, and some of them in other locations worldwide, so personal information you give us is disclosed outside Australia.
Before disclosing personal information to an overseas recipient we take reasonable steps to ensure they handle it consistently with the Australian Privacy Principles, as APP 8 requires. In practice that means contractual protections with each provider and choosing providers that publish their own data protection commitments.
Where personal information is transferred out of the EEA or UK, we rely on standard contractual clauses. Australia does not have an EU adequacy decision.
11. Automated processing
Behavr is an automated system. AI models generate the persona’s actions, their reasoning, and the findings in your report. No human reviews a session before you see it.
We do not use automated processing to make decisions about you that have legal or similarly significant effects. Nothing in the Service decides your eligibility for anything, scores you, or profiles you.
The output is generated and can be wrong. Do not treat it as a statement of fact about any real person.
12. Children
Behavr is not for anyone under 16. We do not knowingly collect their information. If you believe a child has given us personal information, contact hello@behavr.ai and we will delete it.
13. Changes
We will post any change here and update the date at the top. If a change materially affects you, we will email you before it takes effect.
Questions: hello@behavr.ai