Privacy Policy

At Behest Inc., doing business as Behest AI ("Behest AI," "Company," "we," "us," or "our"), a corporation incorporated under the laws of the State of Delaware and registered to do business in the State of California, we help enterprises take control of their AI — giving them visibility into how their teams and AI agents use AI, enforceable budgets and governance over AI spend, and the security controls that keep their data their own. Protecting the privacy and security of the information entrusted to us is fundamental to that mission.

Definitions
Scope and Applicability
Personal Information We Collect
How We Collect Personal Information
How We Use Your Personal Information
Legal Bases for Processing Personal Information
Disclosure and Sharing of Personal Information
Cookies and Similar Tracking Technologies
Data Retention
Data Security Measures
Data Breach Notification
Your Privacy Rights and Choices
Controls for Do-Not-Track Features
Specific Rights for California Residents
Specific Rights for EU/EEA and UK Data Subjects
Rights Under Other Jurisdictions
International Data Transfers
Third-Party Websites and Services
Children's Privacy
Changes to This Policy
Governing Law and Dispute Resolution
Contact Us
How to Review, Update, or Delete Your Personal Information

1. Definitions

For purposes of this Policy, the following terms shall have the meanings ascribed below, unless otherwise required by applicable law:

Personal Information: Any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household.
Sensitive Personal Information: Personal Information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, health data, or data concerning sex life or sexual orientation.
Services: Our Website, our AI governance and spend-control platform (including the Behest AI backend, related APIs and dashboards, and self-hosted deployments), and any related products, features, tools, or interactions provided by Behest AI.
Processing: Any operation or set of operations performed on Personal Information, whether automated or not.
Controller: The entity that determines the purposes and means of Processing Personal Information.
Processor: An entity that Processes Personal Information on behalf of a controller.
Data Subject: An identified or identifiable natural person to whom Personal Information relates.

2. Scope and Applicability

This Policy applies to the Personal Information we collect and process for our own purposes, including through our Website. It does not cover information we process on behalf of customers in Behest Control or our other services for customers, on paid or free plans: the customer's agreement with us, including any data processing agreement, governs that information, and the customer's own privacy notice explains it to the people concerned. In the event of a conflict between this Policy and applicable law, the more stringent requirement shall prevail to the extent of the conflict.

We design our Services with privacy-by-design and privacy-by-default principles, ensuring data minimization, pseudonymization where feasible, and encryption of data in transit (TLS/HTTPS).

3. Personal Information We Collect

We collect only the Personal Information necessary to provide our Services, respond to inquiries, and comply with legal obligations.

a. Personal Information You Provide to Us

Identifiers: Real name, postal address, email address, full IP address (Internet Protocol address), or other similar identifiers.
Customer Records Information: Name, address, telephone number, education, employment, financial information.
Professional or Employment-Related Information: Company name, job title, industry, business needs.
Commercial Information: Records of products or services considered, requested (including software downloads), or purchased.
Other Provided Information: Any additional data you voluntarily submit.

b. Personal Information Collected Automatically

Internet Activity Information: Browsing history, search history, interactions with our Website.
IP Address Information: Full IP addresses are collected automatically when you visit our Website. We use IP addresses for analytics, security, fraud prevention, and to derive approximate geolocation data (country, region, city). We also use your IP address, based on our legitimate interest in keeping our Website and forms secure, to rate-limit and block abusive or automated requests (counts are held in memory for about 15 minutes), to check form submissions for spam with Google reCAPTCHA, and to determine your region so we can apply the correct cookie and advertising defaults.
Geolocation Data: Approximate location derived from IP address, including country, region, and city-level data.
Inferences: Drawn to create profiles reflecting preferences or behavior.

c. Personal Information from Third Parties

From business partners, public databases, or professional networks to enhance client understanding.

4. How We Collect Personal Information

Directly from You: Via Website forms, emails, phone calls, events.
Automatically: Through cookies, web beacons, pixels.
From Third Parties: As noted above, in compliance with applicable laws.
Passive Collection: Log files and server logs capture usage data.
Incomplete Form Submissions: On certain demo or contact forms, if you enter your email address and have accepted our marketing cookies, we may save the information you have entered (such as your email, name, and company) before you complete and submit the form, so that we can follow up with you or help you resume. We do not capture this information if you decline marketing cookies, and you can ask us to delete it at any time (see “How to Review, Update, or Delete Your Personal Information” below).

5. How We Use Your Personal Information

We Process Personal Information solely for the following legitimate business purposes:

To provide, maintain, and improve our Services.
To communicate with you, including administrative notices and marketing.
For internal analytics, research, and development.
To detect, prevent, and address security incidents or fraud.
To comply with legal obligations and enforce our terms.
To deliver software you request from our Website, such as the Behest Radar installer, including verifying your email address and sending you a time-limited download link.
For other purposes disclosed at collection or with your consent.

Behest Radar Downloads

To download the Behest Radar installer, we ask for your email address and company name. We use your email address to verify it and send you a time-limited download link; this is necessary to provide the download you asked for (contract performance). We also share your request (email, company, and whether you verified and downloaded) with our sales team so they can follow up about Behest, based on our legitimate interest in responding to people who show interest in our products. You can object to this at any time by replying to any of our emails or writing to info@behest.ai. We send you marketing emails only if you tick the separate, optional box on the form; the download never depends on it, and you can unsubscribe at any time. We record when you verified your email and which version and operating system you downloaded. Behest Radar itself runs on your device and makes no network connections of its own: no telemetry, update checks, or crash reports. It sends data to Behest only if you or your organization connect it to Behest Control. Once connected, it sends the data for the sharing level your organization chooses: discovery (apps, AI hosts, connection counts, and bytes), metadata (adds per-request model, token counts, tool-call categories, and folder and repository names), or full (adds Git branch names, session titles, and redacted prompt excerpts, which may contain whatever people typed). Usage data carries no name, email, or account name of its own. Behest Control attributes it to the device: if your organization enrolls the device, it is registered with its serial number and hostname and, if your organization chooses, the user's email; if you connect Radar yourself, it is linked to the Behest account you approve the connection with.

6. Legal Bases for Processing Personal Information

Our Processing relies on the following legal bases:

Consent: Where you have provided explicit, informed consent.
Contract Performance: Necessary to enter into or perform a contract.
Legitimate Interests: For our or third parties' interests, balanced against your rights.
Legal Obligation: To comply with laws or regulatory requirements.
Vital Interests: To protect life or safety.

7. Disclosure and Sharing of Personal Information

We do not sell, rent, or trade Personal Information. Disclosures are limited to:

Service Providers and Processors: Trusted vendors that process Personal Information on our behalf under binding contracts, limited to what is necessary to provide our Services. Our key sub-processors are listed below.
Affiliates and Subsidiaries: For internal operations.
Business Partners: With consent, for joint offerings.
In Business Transfers: During mergers or acquisitions.
Legal Requirements: To comply with laws, subpoenas, or government requests.
With Consent: For any other disclosed purpose.

Key Sub-Processors

We rely on the following categories of service providers to operate our Website and business. Each processes Personal Information only as needed for the purpose described and under contractual confidentiality and data-protection obligations:

Google LLC / Google Cloud: Website and application hosting, infrastructure, database storage (including our lead, contact, and download-request records), storage and delivery of software downloads (Google Cloud Storage), bot/spam protection (reCAPTCHA), and website analytics (Google Analytics 4).
PostHog, Inc.: Product and website analytics, including session recordings in our Services, in which form inputs are masked and email addresses are redacted, to help us understand usage and improve the Website and our Services.
Calendly LLC: Scheduling of demos and meetings you request.
Resend (Plus Five Five, Inc.): Sending transactional and notification emails (for example, responses to your form submissions, and email-verification and download-link emails).
Payload CMS: Content management for our Website and blog.

This list may change as our Services evolve. To request the current list of sub-processors, contact us at info@behest.ai.

Advertising Partners (Independent Controllers)

The following advertising platforms receive limited website-interaction data through advertising tags that load only after you accept marketing cookies. Each acts as an independent data controller (not our processor) and uses the data for its own advertising and measurement purposes under its own privacy policy and terms:

LinkedIn Corporation — LinkedIn Insight Tag; ad delivery and conversion measurement for our LinkedIn campaigns (see Section 8). LinkedIn's role is governed by LinkedIn's Independent Controller Addendum.
OpenAI OpCo, LLC — OpenAI Ads conversion pixel; conversion measurement for ads shown in ChatGPT (see Section 8). Except for limited “restricted processing” (which does not apply to our anonymous conversion measurement), OpenAI acts as an independent controller under OpenAI's Ad Tools Terms and Ad Tools Data Processing Addendum. For transfers to the United States, OpenAI relies on the EU Standard Contractual Clauses (Module One).

Advertising Partner (Joint Controller) — Meta

Meta Platforms Ireland Limited — Meta Pixel and Meta Conversions API; ad delivery and conversion measurement on Facebook and Instagram (see Section 8). For the collection of website-event data through these tools and its transmission to Meta, Behest and Meta Platforms Ireland act as joint controllers under Article 26 GDPR, as set out in Meta's Controller Addendum. Each party is responsible for providing you with transparency information and for the lawful basis (for visitors in the EU, EEA, and UK, your consent to marketing cookies) covering that step. Meta's subsequent use of the data for its own purposes is carried out by Meta as an independent controller under Meta's Privacy Policy. The essence of the joint-controller arrangement is set out in Meta's Controller Addendum. For transfers to the United States, Meta relies on the EU-US Data Privacy Framework and, as a safeguard, the EU Standard Contractual Clauses.

8. Cookies and Similar Tracking Technologies

We use cookies, pixels, and similar technologies for essential functionality, performance analytics, and targeted marketing. You may manage preferences via browser settings or our cookie banner. We honor opt-out signals and do not track across third-party sites without consent.

Google Analytics: When you accept analytics cookies, we use Google Analytics 4 (GA4) to collect and analyze website usage data. Google Analytics collects full IP addresses along with other information such as page views, user interactions, device information, and approximate geolocation data derived from IP addresses. This data helps us understand how visitors use our Website and improve user experience. Google Analytics may also collect information through cookies and similar technologies. For more information about how Google uses data, please visit Google's Privacy Policy.

PostHog (Product Analytics): When you accept analytics cookies, we use PostHog to understand how visitors navigate and interact with our Website — such as pages viewed, clicks, and feature usage — so we can improve it. PostHog requests are routed through our own domain, and we configure PostHog so that it does not set tracking cookies until you accept analytics cookies. For more information, see PostHog's Privacy Policy.

Meta Pixel and Conversions API (Advertising): We use Meta advertising technologies to measure the effectiveness of our advertising on Meta platforms (Facebook and Instagram) and to reach relevant audiences. This works in two ways:

Browser-based Meta Pixel. The Pixel records actions on our Website (such as page views and form submissions) and Meta cookie identifiers (the _fbp and _fbc cookies).
Server-side Conversions API. When you submit a demo or contact request, we also send a server-side “Lead” event to Meta Platforms, Inc. so we can measure that conversion. This event contains a hashed (pseudonymized) version of the details you submitted (your email address and name are hashed using SHA-256) together with technical identifiers (your IP address, browser user-agent, and any Meta cookie identifiers). We send only hashed or pseudonymized identifiers — never your details in plain text.

When these fire depends on your region and your choices. For visitors in the US and other non-GDPR regions, the Meta Pixel may load and send a page-view event when you first arrive on our advertising landing pages, before you have made a cookie choice, and the Pixel and the server-side Conversions API may likewise send a conversion event (such as a Lead) without marketing-cookie acceptance — in each case under Meta's Limited Data Use (LDU) framework, a mechanism that restricts how Meta may use the data, designed for compliance with the CCPA and similar US state laws. This pre-consent page-view shares Meta cookie identifiers, your IP address, and browser user-agent with Meta — but not your name or email. If you decline marketing cookies, enable Global Privacy Control (GPC), or otherwise opt out (see below), the Pixel does not load and no page-view or conversion event is sent. For visitors in the EU, EEA, and UK, the Pixel and the server-side Conversions API fire only with your explicit marketing-cookie consent; if you decline, or have not yet made a choice, neither loads.

Regardless of your region, when we detect a Global Privacy Control (“GPC”) signal in your browser (see Section 13), we suppress both the browser-based Pixel and the server-side conversion event entirely. To opt out of this advertising measurement — including the server-side Lead event — you can use our ad-measurement opt-out form, enable GPC, decline marketing cookies in our cookie banner, or email us at info@behest.ai and we will exclude you. For California residents, this advertising activity is “sharing” for cross-context behavioral advertising; see Section 14 for how to exercise your opt-out right. For more information about Meta's practices, see Meta's Privacy Policy. For the collection and transmission of this event data, Behest and Meta Platforms Ireland Limited act as joint controllers under Article 26 GDPR (see Meta's Controller Addendum); Meta's later use of the data is as an independent controller.

OpenAI Ads (Advertising): We use the OpenAI Ads measurement pixel to measure the effectiveness of ads we run in ChatGPT. The pixel loads only after you accept marketing cookies. When you submit a demo request or book a call, it sends a conversion event (such as a lead or a scheduled appointment), together with an ad-click identifier stored in a first-party __oppref cookie, to OpenAI, L.L.C. We do not send your name or email address through this pixel. If you decline marketing cookies, the pixel does not load. OpenAI acts as an independent data controller (not our processor) for the conversion data collected through this pixel, under OpenAI's Ad Tools Data Processing Addendum, and relies on the EU Standard Contractual Clauses for transfers to the United States. For California residents, this activity is “sharing” for cross-context behavioral advertising; see Section 14 to exercise your opt-out right. For more information, see OpenAI's Privacy Policy.

LinkedIn Insight Tag (Advertising): We use the LinkedIn Insight Tag to deliver our LinkedIn campaigns and measure their effectiveness. The tag loads only after you accept marketing cookies, in all regions. When it loads, and when you submit a demo request or contact form, it sends to LinkedIn Corporation LinkedIn cookie identifiers, your IP address, browser user-agent, and the page URL, along with a conversion event. We do not send your name or email address through this tag. LinkedIn acts as an independent data controller (not our processor) for information collected through the Insight Tag, under LinkedIn's Independent Controller Addendum, and processes it for its own advertising and analytics purposes as described in LinkedIn's Privacy Policy. Where this information is transferred from the EEA, UK or Switzerland to the United States, LinkedIn relies on the EU Standard Contractual Clauses (and the UK International Data Transfer Addendum). If you decline marketing cookies, the tag does not load. For California residents, this activity is “sharing” for cross-context behavioral advertising; see Section 14 to exercise your opt-out right. You can also manage LinkedIn's use of your data through your LinkedIn ad settings. For more information, see LinkedIn's Privacy Policy.

Behest Radar downloads: We do not send any advertising conversion event (to Meta, OpenAI, or LinkedIn) when you request or download Behest Radar, and our advertising tags do not load on the Radar download page.

Calendly (Scheduling): If you book a demo or meeting with us, we use Calendly to schedule it. Calendly processes the name, email address, and scheduling details you provide in order to set up and manage the meeting. For more information, see Calendly's Privacy Policy.

9. Data Retention

We retain Personal Information only as long as necessary. Specific periods:

Marketing and inquiry data: Up to 2 years from last interaction.
Account or contract data: Duration of relationship plus 7 years for legal/tax purposes.
Requests submitted through our Website forms (including demo, contact, and trial requests, and Behest Radar download requests): automatically deleted from our website lead database 1 year after submission, unless you ask us to delete them sooner. Incomplete form submissions are deleted after 90 days, and Behest Radar download requests whose email address is never verified are deleted after 90 days.
Copies of those requests in our sales records (our CRM and sales inbox) are kept for the marketing and inquiry period above, and for the account period if you become a customer.
Log data: security and server logs (which include your IP address, browser user-agent, and the pages requested) are kept for up to 30 days; our application logs record only a truncated IP address. We keep logs longer only when needed to investigate a specific security incident.

10. Data Security Measures

We implement robust technical, administrative, and organizational measures to protect Personal Information:

Encryption: Data in transit (TLS/HTTPS) and at rest.
Access Controls: Role-based access, multi-factor authentication.
Network Security: Firewalls, intrusion detection/prevention systems.
Physical Security: Secure data centers with access restrictions.
Employee Training: Mandatory privacy and security awareness programs.
Incident Response: Comprehensive plan for detecting and mitigating breaches.
Audits: Regular internal security reviews and assessments.

11. Data Breach Notification

In the event of a Personal Information breach, we shall notify affected individuals and relevant authorities without undue delay, typically within 72 hours of awareness. Notifications will include breach details, impacted data, mitigation steps, and protective advice.

12. Your Privacy Rights and Choices

You have rights over your Personal Information, exercisable by contacting us at info@behest.ai. Rights include:

Access/Know: Obtain details of your Personal Information.
Correction/Rectification: Amend inaccuracies.
Deletion/Erasure: Request deletion, subject to exceptions.
Restriction: Limit Processing in certain cases.
Portability: Receive data in a structured format.
Objection: Object to Processing based on legitimate interests.
Withdraw Consent: At any time.

13. Controls for Do-Not-Track Features and Global Privacy Signals

We honor Do-Not-Track ("DNT") signals, Global Privacy Control ("GPC"), and other universal opt-out mechanisms. When we detect a GPC signal, we suppress our advertising pixels and our server-side advertising conversion events (including the Meta Conversions API Lead — see Section 8) regardless of your region, opting you out of cookie-, pixel-, and server-based sale/sharing and targeted advertising on our Website. You can also opt out by declining marketing cookies or by emailing us at info@behest.ai.

14. Specific Rights for California Residents Under CCPA/CPRA

As a Delaware-incorporated entity doing business in California, we comply with the CCPA as amended by the CPRA. California residents have the right to:

Know what Personal Information we collect, use, and disclose
Delete Personal Information, subject to exceptions
Correct inaccurate Personal Information
Opt out of the “sharing” of Personal Information for cross-context behavioral advertising
Limit the use of Sensitive Personal Information
Non-discrimination for exercising these rights

We do not “sell” your Personal Information for money. However, our use of advertising technologies such as the Meta Pixel and Meta Conversions API (see Section 8) may constitute “sharing” of Personal Information for cross-context behavioral advertising under the CPRA.

Your California Privacy Choices. To opt out of this sharing, you can (1) enable the Global Privacy Control (“GPC”) signal in your browser, which we honor by suppressing both pixel-based and server-side conversion sharing; (2) decline marketing cookies in our cookie banner; (3) email us at info@behest.ai to opt out of all advertising-related sharing, including server-side conversion measurement; or (4) use our ad-measurement opt-out form. We will not discriminate against you for exercising these rights.

16. Rights Under Other Jurisdictions

For users in the Middle East (e.g., UAE) or Asia (e.g., Singapore), we comply with local laws, providing equivalent rights to access, correction, and withdrawal. Contact us for jurisdiction-specific details.

17. International Data Transfers

Personal Information is primarily processed in the United States. For transfers from EU/EEA, UK, or other regions, we use approved mechanisms:

Standard Contractual Clauses (SCCs)
UK International Data Transfer Agreements
Binding Corporate Rules (if applicable)
Consent or other derogations where necessary

18. Third-Party Websites and Services

Our Website may link to third-party sites. We are not responsible for their privacy practices; review their policies independently.

19. Children's Privacy

Our Website and our own services are intended for business professionals and do not target individuals under 16. We do not knowingly collect Personal Information from minors for our own purposes, and if we learn we have, we will promptly delete it. Customers who build applications on Behest are responsible for the people who use those applications, as described in our Terms of Service.

20. Changes to This Policy

We may amend this Policy to reflect changes in practices, technology, or law. Material changes will be notified via email or Website posting, with a revised "Last Updated" date. Continued use post-update constitutes acceptance.

21. Governing Law and Dispute Resolution

This Policy is governed by Delaware law. Disputes arising hereunder shall be resolved through binding arbitration in Delaware under American Arbitration Association rules.

22. Contact Us

Behest Inc. d/b/a Behest AI

Email: info@behest.ai

23. How to Review, Update, or Delete Your Personal Information

As detailed in Section 12, email info@behest.ai to exercise rights. We facilitate prompt compliance.

At Behest AI, control over your AI is not merely a commitment—it is the foundation of what we build, ensuring your data stays yours, your AI spend stays visible and governed, and control stays unequivocally in your hands.

Table of Contents