Privacy & GDPR
Your data stays yours.
We collect only what is needed for the service you request, and optional measurement is deliberately data-minimal.
Who we are
BehaviorSMART SA is a Behavioral Decision Intelligence company based in Lausanne, Switzerland, and a Certified B Corporation. For any privacy question contact privacy@behavior-smart.com.
What we collect on this website
- Contact and newsletter requests: only the information you choose to submit. HubSpot provides the optional embedded forms as a functional processor, not as our analytics provider. The embed loads only after you explicitly request it; that one-time functional choice is independent of analytics consent and is not stored. A direct-email fallback remains available without loading HubSpot.
- Strictly necessary storage: your theme and consent choice, stored locally so the site can remember them.
- BehaviorSMART First-Party Analytics: only after explicit analytics consent, we process a canonical event UUID, product, production environment, UTC timestamp, event type, a random per-tab anonymous session UUID, an optional validated source ref, and a fixed page or outcome identifier. The session UUID is hashed independently for this product at ingest.
What analytics never collects
Analytics does not collect raw URLs or paths, page titles, referrers, DOM text, links, form values, viewport details, arbitrary properties, names, emails, persistent user identifiers, or free-text feedback.
Consent and privacy signals
Analytics is off until you allow it. Do Not Track and Global Privacy Control override an allowed choice. You may revoke analytics from Cookie preferences at any time; revocation clears queued events and this tab’s anonymous analytics session state.
Operational data sovereignty
Your raw conversations and methodology stay in your environment — never sold, never used to train shared models. Only a derived problem-framing (never your transcript) reaches our cloud model under a signed Data Processing Agreement, and a local quote-scrubber blocks verbatim client wording above a set length before it leaves. A DPA is available on request. Client data is not used to train shared models; only our team's validated learnings expand our behavioral knowledge base.
Retention
Optional source refs are removed after seven days. Analytics rows are deleted after 90 days. Contact messages are kept only as long as needed to respond and for a reasonable follow-up window, then deleted on request.
Your GDPR rights
You may request access, correction, deletion, restriction, or portability of your personal data, and withdraw consent at any time. Email privacy@behavior-smart.com. You also have the right to lodge a complaint with your local supervisory authority.
Last updated: August 2026.