Privacy policy.

The short version: we collect different information depending on whether you're filling out a form on this website, using the Behavry browser extension your employer deployed, or administering Behavry on behalf of your organization. We don't sell any of it, and we don't share it with advertisers.

Who we are

Behavry Inc. is a US-based company. This policy applies to information collected through behavry.ai, the Behavry browser extension distributed through the Chrome Web Store and other extension stores, and the Behavry platform (the SaaS service that customer organizations use to govern AI usage in their environments). If you have questions, contact privacy@behavry.ai.

This policy covers three distinct data flows:

1. Website · the demo and partner pilot forms at behavry.ai, and the Ask Behavry assistant
2. Browser extension · the Behavry extension installed by employees of customer organizations
3. Platform · the Behavry SaaS service that processes data on behalf of customer organizations

Each is covered in its own section below.

1. Website

What we collect

We collect information only when you voluntarily submit it, through one of two forms on behavry.ai.

The demo form at /access collects:

• First and last name
• Work email address
• Organization name
• Your role or job title
• The workflow you intend to govern
• Your deployment preference (optional)
• The type of AI agents you are deploying
• A description of your authorization challenges (optional, free-text)

The partner pilot form at /mssp, for managed service providers, collects:

• Provider name and work email address
• Your name (optional)
• Approximately how many customers you manage
• Whether the pilot concerns your own agents, your customers' agents, or both
• A candidate workflow
• The customer you have in mind for the pilot (optional)
• Whether you allow us to contact that customer, with you copied (optional, unticked by default)

If you name a customer and leave that box unticked, we do not contact them. We reply to you, and we do not add a customer you name to any sales outreach.

Attribution sent with a form

Each submission also carries a few fields you do not type, so we can route your request and know which link brought it to us:

• Which form you used (demo or partner) and, where it applies, the request type, such as an Earned Autonomy pilot
• The path of the page you submitted from, for example /mssp
• Referral parameters, only if the link you followed contained them: partner, ref, and utm_source, utm_medium, utm_campaign, utm_content, utm_term

So that a partner's link still counts if you browse a few pages before submitting, those referral parameters are held in your browser's session storage for the current tab. They are never sent anywhere unless you submit a form, and the browser discards them when you close the tab. We do not record the referring website, your other page views, or anything about your device.

We do not use cookies, tracking pixels, or analytics scripts on this site. We do not collect IP addresses, device identifiers, or general browsing behavior.

How we use it

We use the information you submit for one purpose: to follow up with you about Behavry. Specifically:

• To respond to your request and send a brief questionnaire about your deployment
• To schedule a conversation if there is a mutual fit
• To keep you informed about Behavry's availability and access program

We will not add you to a general marketing list, send unsolicited newsletters, or contact you about anything unrelated to Behavry without your explicit consent.

Who we share it with

We use Formspree to process form submissions. Formspree receives the data you submit and forwards it to us by email. Their privacy policy is at formspree.io/legal/privacy-policy.

We do not sell, rent, trade, or otherwise share your information with any other third parties.

How long we keep it

We retain your information, including any attribution fields, for as long as there is an active conversation about an engagement. If you ask us to delete it, we will do so promptly.

Briefing Agent

The Ask Behavry launcher on this site opens an AI assistant that answers questions about Behavry from our published pages. It is an AI, not a person, and it is itself governed by Behavry: every source it reads and every action it takes is authorized by policy and recorded in a Decision Trace you can open from inside the conversation.

You can use it without identifying yourself. If you do not give us your name and email, the conversation is anonymous and is deleted after 90 days. If you book a meeting through it, we keep your name, email, the conversation, and the notes we generate from it for two years so we can follow up, and we use them only for that. A booking also carries the referral parameters described above (partner, ref, utm_*), if the link you followed contained them, so a partner who referred you is credited. They go into our internal meeting notes, not the calendar invite.

We do not train AI models on your conversation, and our model provider does not retain it for training. If you paste something that looks like a password, API key, or other secret, the assistant redacts it before storing the message. We do not attempt to identify you from your IP address or browsing history, and we do not record your keystrokes or replay your session. Ask us at privacy@behavry.ai to delete a conversation at any time.

Messages are checked for abusive content. If a message is flagged, its text is withheld from the internal notifications we generate, and a conversation that produces repeated flagged messages is closed. Blunt criticism of Behavry is not treated as abuse.

The assistant is served from briefing.behavry.ai and loads only after the page renders. If it fails to load, the rest of this site is unaffected.

2. Browser extension

The Behavry browser extension is installed by employees of organizations that have deployed Behavry as a customer. The extension is enrolled with a tenant-issued token and operates only on twelve declared AI service domains:

• chatgpt.com, chat.openai.com
• claude.ai
• gemini.google.com
• copilot.microsoft.com
• perplexity.ai
• chat.mistral.ai
• chat.deepseek.com
• grok.x.ai
• you.com
• poe.com
• github.com/copilot
• huggingface.co/chat

Host permissions are scoped to these domains. The extension cannot read or modify content on any other website.

What the extension processes locally

Before any data leaves your browser, the extension processes prompt content locally. Local processing includes:

• Regex pattern scanning for sensitive data such as credit card numbers, government IDs, and API keys, using a built-in 26-pattern library
• Optional context-aware PII detection using an on-device machine learning model (the Privacy Filter), which runs entirely in the browser using WebGPU or WebAssembly
• Prompt injection pattern detection

Prompt content itself is never transmitted to Behavry. Only metadata and redacted findings leave the browser.

What the extension sends to Behavry

For each prompt submitted to one of the twelve AI service domains, the extension transmits:

• Tenant identifier and enrolled user identifier
• AI service domain and model name (for example: claude.ai, claude-opus-4-7)
• Submission timestamp
• Token counts when available
• DLP findings: pattern name, severity, and a redacted excerpt of the match. Critical patterns are fully redacted. Non-critical findings may include a short anonymized snippet.
• Privacy Filter findings: label (for example, PERSON_NAME or EMAIL), severity, and confidence score. No raw text.
• Prompt injection findings: rule name and severity. No raw text.
• Coarse device status: active, inactive, last heartbeat timestamp

What the extension does not collect

• Browsing history outside the twelve declared AI service domains
• Form data, passwords, or autofill content
• The contents of files uploaded to AI services (filename only is logged for audit; file content is not)
• Cookies, local storage, or session tokens from any website
• Screen content, screenshots, or keystrokes
• Microphone, camera, or geolocation

Chrome permissions and why we use each

Sub-processors

HuggingFace Hub (huggingface.co): the Privacy Filter machine learning model is downloaded from HuggingFace Hub on first activation and cached in your browser. The model files are binary weights, not executable code. No user data is sent to HuggingFace.

If you are an employee of an organization that deployed Behavry

Your employer is the data controller for the information the extension transmits. Behavry processes that information on your employer's behalf. If you have questions about how your employer uses Behavry, including what is retained and for how long, please contact your employer's IT or privacy team. If you contact us directly, we will refer you to them.

3. Behavry platform

When an organization deploys Behavry as a customer, the platform processes data on behalf of that organization. The organization, not Behavry, is the data controller for the data flowing through the platform. Behavry acts as a data processor.

What the platform receives

• The metadata and findings described in the Browser extension section above
• API proxy telemetry from agents and integrations that the organization has explicitly configured to route through Behavry
• Administrative data created by the organization's administrators using the Behavry dashboard (policies, user accounts, audit records)

Sub-processors

• Amazon Web Services: hosting and database storage (US regions)
• Clerk: authentication for administrator access to the Behavry dashboard
• Stripe: billing and subscription management (limited to organization billing contacts)

Behavry does not route customer data to AI providers (Anthropic, OpenAI, Google, and others) unless the customer organization explicitly configures these as approved AI services in their tenant. Default-deny applies.

Retention

Customer organizations configure their own retention policies through the Behavry dashboard. Behavry's default retention for telemetry events is 90 days unless the customer extends it.

Your rights

You have the right to:

• Request a copy of the information we hold about you
• Ask us to correct inaccurate information
• Ask us to delete your information
• Withdraw from further communication at any time

For information collected through the Behavry platform on behalf of your employer, please direct requests to your employer's IT or privacy team first. They have direct control over their tenant's data.

For all other requests, email privacy@behavry.ai. We will respond within 5 business days.

Security

All Behavry traffic is transmitted over HTTPS with TLS 1.2 or higher. Platform data is encrypted at rest. Extension data stored locally in your browser uses the browser's built-in chrome.storage.local encryption where available. Administrator access to the Behavry dashboard requires multi-factor authentication.

Children

Behavry is intended for business and enterprise use. We do not knowingly collect information from anyone under 18 years of age.

Changes to this policy

If we make material changes to this policy, we will update the effective date at the top of this page and, where appropriate, notify customer organization administrators through the Behavry dashboard.

Contact

For any privacy-related questions or requests, email privacy@behavry.ai.