Effective date: May 2026 · Behavry Inc.
The short version: we collect different information depending on whether you're filling out a form on this website, using the Behavry browser extension your employer deployed, or administering Behavry on behalf of your organization. We don't sell any of it, and we don't share it with advertisers.
Behavry Inc. is a US-based company. This policy applies to information collected through behavry.ai, the Behavry browser extension distributed through the Chrome Web Store and other extension stores, and the Behavry platform (the SaaS service that customer organizations use to govern AI usage in their environments). If you have questions, contact privacy@behavry.ai.
This policy covers three distinct data flows:
behavry.aiEach is covered in its own section below.
We collect information only when you voluntarily submit it — specifically through the access form on behavry.ai. That form collects:
We do not use cookies, tracking pixels, or analytics scripts on this site. We do not collect IP addresses, device identifiers, or general browsing behavior.
We use the information you submit for one purpose: to follow up with you about Behavry. Specifically:
We will not add you to a general marketing list, send unsolicited newsletters, or contact you about anything unrelated to Behavry without your explicit consent.
We use Formspree to process form submissions. Formspree receives the data you submit and forwards it to us by email. Their privacy policy is at formspree.io/legal/privacy-policy.
We do not sell, rent, trade, or otherwise share your information with any other third parties.
We retain your information for as long as there is an active conversation about an Access engagement. If you ask us to delete it, we will do so promptly.
The Behavry browser extension is installed by employees of organizations that have deployed Behavry as a customer. The extension is enrolled with a tenant-issued token and operates only on twelve declared AI service domains:
Host permissions are scoped to these domains. The extension cannot read or modify content on any other website.
Before any data leaves your browser, the extension processes prompt content locally. Local processing includes:
Prompt content itself is never transmitted to Behavry. Only metadata and redacted findings leave the browser.
For each prompt submitted to one of the twelve AI service domains, the extension transmits:
claude.ai, claude-opus-4-7)PERSON_NAME or EMAIL), severity, and confidence score. No raw text.| Permission | Use |
|---|---|
storage | Stores the enrollment token and tenant configuration locally in your browser |
tabs | Identifies when the active tab is on a declared AI service domain |
identity | Used only during one-time enrollment to bind the extension to your enterprise identity via your organization's identity provider |
offscreen | Runs the Privacy Filter machine learning model in a hidden offscreen document (required for WebGPU access in Manifest V3) |
idle | Throttles background activity when you are idle to reduce CPU and battery usage |
webRequest | Observes (does not block or modify) outbound requests to the twelve AI service domains so scan results can be correlated with submission events |
HuggingFace Hub (huggingface.co): the Privacy Filter machine learning model is downloaded from HuggingFace Hub on first activation and cached in your browser. The model files are binary weights, not executable code. No user data is sent to HuggingFace.
Your employer is the data controller for the information the extension transmits. Behavry processes that information on your employer's behalf. If you have questions about how your employer uses Behavry, including what is retained and for how long, please contact your employer's IT or privacy team. If you contact us directly, we will refer you to them.
When an organization deploys Behavry as a customer, the platform processes data on behalf of that organization. The organization, not Behavry, is the data controller for the data flowing through the platform. Behavry acts as a data processor.
Behavry does not route customer data to AI providers (Anthropic, OpenAI, Google, and others) unless the customer organization explicitly configures these as approved AI services in their tenant. Default-deny applies.
Customer organizations configure their own retention policies through the Behavry dashboard. Behavry's default retention for telemetry events is 90 days unless the customer extends it.
You have the right to:
For information collected through the Behavry platform on behalf of your employer, please direct requests to your employer's IT or privacy team first. They have direct control over their tenant's data.
For all other requests, email privacy@behavry.ai. We will respond within 5 business days.
All Behavry traffic is transmitted over HTTPS with TLS 1.2 or higher. Platform data is encrypted at rest. Extension data stored locally in your browser uses the browser's built-in chrome.storage.local encryption where available. Administrator access to the Behavry dashboard requires multi-factor authentication.
Behavry is intended for business and enterprise use. We do not knowingly collect information from anyone under 18 years of age.
If we make material changes to this policy, we will update the effective date at the top of this page and, where appropriate, notify customer organization administrators through the Behavry dashboard.
For any privacy-related questions or requests, email privacy@behavry.ai.