Privacy Notice
Product: AI Adoption Pulse (the "Service") Provider: Behaviture ("we", "us"). The provider is Behaviture s.r.o., a company registered in the Czech Republic (IČO 30057965), with its registered office at Roháčova 145/14, 130 00 Prague 3, Czech Republic. Privacy contact: privacy@behaviture.com Version: 1.1 · Effective: 26 October 2026
1. Who this notice is for
Two audiences read this notice, and different rules apply to each because our role differs by data category — see section 3.
- Customer administrators — people at a customer organization who hold an account, configure a campaign, and view aggregate reports.
- Respondents — employees of a customer who complete a survey through a single-purpose link. Respondents hold no account.
2. The core privacy design — read this first
AI Adoption Pulse is built so that an employer never sees an individual employee's answers or scores. That is enforced in the software, not merely promised:
- Identity and answers are separated. An invitation stores a Respondent's work email so the employer can track completion. The submitted answers are written separately, with no name, email, account identifier, or invitation reference attached.
- The link is severed at completion. When a Respondent submits, the connection between "who was invited" and "what was answered" is broken by design and is not retained anywhere.
- Small groups are suppressed. Aggregate results appear only for groups at or above a minimum size — 8 by default, with a hard floor of 5. Smaller groups are withheld, and filter combinations that could isolate an individual are blocked.
- AI models never receive identities. Where a large language model helps phrase report prose, it receives only minimized data: above-threshold aggregate data for organization reports, and for a Respondent's private report that Respondent's own scores and selected answers, shown back only to them. Never names, emails, tokens, IP addresses, or small-group data.
- Your private report stays yours. A Respondent can download their private report as a PDF, made on request and not stored, or open it on one more device with a one-time code that expires after 10 minutes (at most three extra devices). No email address, IP address, or device details are collected for either.
A consequence we disclose openly: because the link is severed, we are generally unable to find or delete an individual Respondent's answers by that person's identity after submission. The answers are no longer associated with it. See section 7.
3. What data we process, and our role
| Data | Whose data | Our role | Purpose | Lawful basis |
|---|---|---|---|---|
| Account data — name, work email, password hash or sign-in provider identifier, organization membership, acceptance of these documents | Customer administrators | Controller | Provide the account, authenticate, secure the Service, evidence agreement to our terms | Contract; legitimate interests; legal obligation |
| Billing data — plan, subscription, payment-processor references | Customer administrators | Controller | Bill and administer subscriptions | Contract; legal obligation |
| Organization configuration — departments, roles, approved-tool inventory, AI-policy status | Customer | Processor for the customer | Configure and run the customer's campaign | Determined by the customer as controller |
| Invitation roster — Respondent work email, optional department, role, job title, manager status | Customer's employees | Processor for the customer | Send invitations, track completion, prefill the survey | Determined by the customer as controller |
| Survey responses — answers and optional free text | Respondents | Processor for the customer | Deterministic scoring, private individual coaching report, aggregate reporting | Determined by the customer as controller |
| Operational data — structured request logs, audit events, and reports of errors in your browser (page name, error type, browser type, with email addresses and tokens removed) | Mixed | Controller | Security, debugging, abuse prevention | Legitimate interests |
| Product-analytics and feedback events | Respondents and administrators | Processor for the customer | Improve the Service; deleted automatically after 90 days | Determined by the customer as controller |
Where we act as processor, the customer is the controller and the processing is governed by the Data Processing Addendum, which forms part of our agreement with them.
Special-category data is not requested. The survey asks about tools, practices, confidence, and working conditions. Respondents are asked not to put identifying or sensitive details in free-text answers.
Signing in with Google, Microsoft, or company single sign-on. An account holder may choose to sign in through Google, Microsoft, or their organization's identity provider instead of a password. We then receive, through Google Cloud Identity Platform, your name, your email address, whether the provider has verified that address, and the provider's identifier for you. We use them only to sign you in, to match you to your account or create it at your request, and to keep that sign-in secure. We store the provider identifier linked to your account; the name and email from a sign-in attempt are deleted about a day after the attempt expires. This information is not sold, not used for advertising, and not shared with anyone except the sub-processors listed in section 5 that host the Service. You can disconnect a sign-in provider under Settings at any time, and the link is deleted with your account. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
4. What company administrators can and cannot see
- Can see: invitation completion status; aggregate results for groups at or above the minimum size; privacy-protected role and department findings.
- Cannot see: any individual's survey answers, any individual's scores, any individual coaching report, or the link between an invitation and a response.
If you are an employee being asked to take a survey and someone tells you your manager will see your answers, they are mistaken. The product cannot show them.
5. Where data is processed
The Service runs on Google Cloud, europe-west1 (Belgium).
Current sub-processors are listed in the Data Processing Addendum and include, at minimum: Google Cloud Platform for hosting, database, storage, background-task queues, and sign-in (Google Cloud Identity Platform); Google's Gemini API for optional report-prose generation on minimized data only (see section 2); Resend for sending invitations and notifications; and Stripe for payments where online payment is enabled.
If you allow analytics on our public website (section 9), Google and LinkedIn also receive the technical data your browser sends them. For that measurement each acts as an independent controller under its own privacy policy.
International transfers. Some providers, including Resend (United States), may process data outside the European Economic Area. Any such transfer relies on an appropriate safeguard under Article 46 GDPR — Standard Contractual Clauses or an adequacy decision. The large-language-model path is limited to the minimized data described in section 2, and never includes identities.
6. How long we keep data
| Data | Retention |
|---|---|
| Account and billing | For the life of the account, plus the period we are required to keep records after closure |
| Records of acceptance of our terms | For the life of the account. They are the evidence that the agreement was made, and are deleted with the account |
| Survey responses and scores | For the retention period configured for the campaign, or until the customer's data is deleted under the DPA |
| Private-report device handover | An unused one-time code is deleted within a day of its 10-minute expiry; a used code keeps only a hashed key for the extra device, deleted with the survey response |
| Product-analytics and report-feedback comments | Deleted automatically 90 days after creation, by a scheduled purge |
| Operational logs | Up to 90 days |
| Backups | Automated database backups with point-in-time recovery, on the provider's standard retention window |
7. Your rights
Subject to applicable law you may request access, rectification, erasure, restriction, portability, and objection, and you may lodge a complaint with a supervisory authority — in our case the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ).
Where we rely on your consent, as for optional analytics, you may withdraw it at any time through Cookie settings; withdrawing does not affect processing that took place before. We make no decision about any person solely by automated means that produces legal or similarly significant effects: scores are calculated deterministically, and a language model only helps phrase report text.
How to exercise them:
- Customer administrators, for data where we are the controller: write to privacy@behaviture.com. We respond within one month.
- Respondents: because we are a processor for survey data, and because the identity-to-answer link is severed at completion, direct requests about survey answers to your employer, who is the controller. We assist them as the DPA requires. Please note the limitation in section 2: once submitted, an individual's answers generally cannot be located or deleted by that individual's identity.
8. Security
Transport encryption throughout; hashed and keyed storage of session, invitation, and result tokens; role-based access control with server-side tenant isolation; secrets held in a managed secret store and never in the database or logs; audit logging of privileged actions; rate limiting; minimum-group suppression and anti-differencing on every aggregate output, export, and model payload; and the identity-to-response severance described above. A fuller description is available to customers on request.
Support staff may, with an audited and time-limited session, view a customer workspace to diagnose a problem. Such sessions are read-only, are recorded, and can never reveal individual Respondent answers — the same suppression applies.
9. Cookies
The Service uses a strictly necessary session cookie and a CSRF-protection cookie for authenticated areas. The public website offers optional Google Analytics and the LinkedIn Insight Tag (which we use to measure our LinkedIn advertising). One choice covers both. Analytics is denied by default: neither script is loaded until a visitor explicitly allows it, and the choice is stored in local browser storage. Advertising storage, advertising user data, and advertising personalization remain denied at all times. Analytics is limited to public marketing pages and is disabled on surveys, private reports, authentication pages, customer workspaces, and the support console. Reported page locations omit query strings and fragments. The LinkedIn tag cannot be switched off once loaded, so withdrawing consent reloads the page to remove it. A visitor may reject analytics, or change the choice later, through Cookie settings in the public-site footer.
10. Changes to this notice
We may update this notice. When we do we publish a new version with its own effective date and, where the change is material, ask account holders to review and accept it in the Service. The version you accepted is recorded against your account.
Privacy questions: privacy@behaviture.com · https://behaviture.com