Privacy Policy

1. Who is the controller

The data controller is:

• BEHIO LLC
• registered office: 30 N Gould St, Suite 66310, Sheridan, WY 82801, United States
• a limited liability company organized under the laws of the State of Wyoming, USA
• data protection contact e-mail: [email protected]

We have not appointed a Data Protection Officer, as we are not legally required to. For all data protection matters, contact us at the e-mail above.

2. What data we process

Data you provide to us

• Identification and contact data: name, e-mail, phone, company name, company ID and VAT ID.
• Billing data: address, details needed to issue a tax document, payment history.
• Content you create in the platform: products, orders, customers, invoices and other data of your eshop.

Data generated by using the service

• Technical data: IP address, browser and device type, date and time of access.
• Operational logs and feature-usage data, to keep the service running and secure.
• Website visit data: pages visited, time on page, clicks on marked buttons, referring website, campaign parameters and device type (see the Cookies and traffic measurement section).
• Cookies and similar technologies (see the Cookies and traffic measurement section).

3. Purposes and legal bases

We process personal data only for specific purposes and always on one of the legal bases under the GDPR:

• Providing the service and performing the contract (Art. 6(1)(b) GDPR): account management, eshop operation, payment and subscription processing.
• Compliance with legal obligations (Art. 6(1)(c) GDPR): accounting, taxes, archiving of documents.
• Legitimate interest (Art. 6(1)(f) GDPR): security and stability of the service, abuse prevention, handling enquiries, basic product development and website traffic statistics.
• Consent (Art. 6(1)(a) GDPR): sending commercial messages, the cookie for more accurate traffic measurement and remembering where you came to the website from. You can withdraw consent at any time.

4. How long we keep data

• Account data and eshop content: for the duration of the contract and afterwards for as long as necessary to settle mutual claims.
• Billing and accounting documents: for the period required by law (typically 10 years).
• Data processed on the basis of consent: until consent is withdrawn.
• Operational logs: for a limited period necessary for security and diagnostics.
• IP address for queries in our AI assistant: at most 90 days for abuse prevention, then deleted.
• IP address and browser details of a chat conversation: for as long as the conversation is kept, for abuse prevention and to verify who we are talking to. Only Behio platform administrators can see them, and we delete them together with the conversation or at your request.
• Text you are typing into the chat: Behio platform administrators can see it while you type so that we can reply faster. Unsent text is not stored.
• Security visit log (visited pages, IP): at most 90 days for abuse prevention, then deleted.
• Records of individual website visits in Behio Analytics: 90 days, after which only aggregated daily statistics without visitor identifiers remain.
• The returning-visitor fingerprint and the record of a visitor with the behio_aid cookie in Behio Analytics: deleted after 13 months without a visit.

After these periods we erase or anonymise the data.

5. Recipients and sub-processors

We do not sell personal data. We share it only with vetted providers that help us run the service, to the extent necessary for the given purpose and under data processing agreements. Our sub-processors are:

• Hetzner Online GmbH (Germany, EU, no transfer): Application servers, database and backups, our own Behio Mail server and the Behio Analytics tool.
• Cloudflare, Inc. (USA; file storage in the EU, content delivery worldwide, DPF): Content delivery (CDN), file and image storage, DNS, attack protection and cookieless website speed measurement.
• Amazon Web Services, Inc. (USA; processing in the EU (Frankfurt), DPF): Sending system and shop e-mails (Amazon SES) and processing their delivery status.
• Google LLC (USA, DPF): Firebase: sign-in and account verification, delivery of notifications to the mobile app. Google Places: address suggestions at checkout, where the merchant enables them.
• Stripe, LLC (USA, DPF): Payments for Behio subscriptions and AI credits.
• OpenRouter, Inc. (USA, SCC): Routing AI requests (the assistant Tom, chat replies, text generation) to the selected model, for example from OpenAI, Anthropic or Google.
• OpenAI, L.L.C. (USA, SCC): AI models, the voice assistant Tom, translations and search in the chat knowledge base.
• Anthropic, PBC (USA, SCC): Claude AI models for the assistant Tom and content generation, accessed through OpenRouter.
• Groq, Inc. (USA, SCC): Speech-to-text for voice input. The audio is not stored.
• NexusAI Services LLC (kie.ai) (USA, SCC): Image generation and editing in AI Photo Studio.
• Enable Banking Oy (Finland, EU, no transfer): Bank account connection (PSD2) for matching payments in invoicing, where you enable it.
• GitHub, Inc. (USA, DPF): Storage of the source code of websites and shops built on Behio.
• Salesforce, Inc. (Slack) (USA, DPF): Internal notifications to the Behio team about new registrations, enquiries and support requests.
• Plus Five Five, Inc. (Resend) (USA, DPF): Fallback sending of shop e-mails.
• Apple Inc. (USA, SCC): Delivery of notifications to the Behio app on iPhone and iPad.

The current list, with the purpose, processing location and transfer safeguard of each, is at behio.com/subprocessors. Payment gateways, carriers and other services a merchant connects with their own account are not our sub-processors; we pass data to them only on the merchant's instruction.

6. Transfers outside the EU

BEHIO LLC is a company based in the United States. We store data on servers in Germany. Some sub-processors (for example payment or AI providers) process it in the United States or other countries outside the European Economic Area. Each such transfer relies on one of these legal bases:

• Adequacy decision (Art. 45 GDPR): the US recipient is certified under the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795). We check the certification at dataprivacyframework.gov/list.
• Standard contractual clauses (Art. 46(2)(c) GDPR) approved by Commission Implementing Decision (EU) 2021/914, for recipients without DPF certification and in other third countries.

The safeguard used for each sub-processor is listed at behio.com/subprocessors. We will provide a copy of the standard contractual clauses on request at the e-mail above.

7. Behio as a processor for eshop operators

If you run your own eshop on the Behio platform, you are the controller of your customers' personal data. In this role Behio is a processor and processes your end customers' personal data only on your instructions and for the purpose of providing the service.

• We process it only to the extent necessary to run your eshop.
• We use the same sub-processors listed above and bind them to the same level of protection.
• On termination we erase or return the data at your request, unless a legal obligation prevents it.

The details are set out in the data processing agreement (DPA) at behio.com/dpa, including transfers to third countries and notice of sub-processor changes 30 days in advance. If you need a signed copy, contact us.

8. Cookies and traffic measurement

On behio.com we store in your browser and measure only what is described below. We do not use Google Analytics or any advertising tools. Besides our own Behio Analytics, a single third-party tool measures the website, without cookies or browser storage (section Website speed).

Necessary, without consent

• Sign-in: when you sign in or register, we set a sign-in cookie so that you stay signed in on the website and in the admin.
• Your choice in the banner: the behio_consent cookie remembers for 13 months whether you accepted or declined measurement.
• Security: a random visit identifier, behio_vid, in browser storage that is cleared when you close the tab. Together with the pages visited and your IP address we keep it for at most 90 days so that we can investigate abuse.

We store these without consent because without them you could not sign in, we could not remember your choice and we could not protect the website (Section 89(3) of Czech Act No. 127/2005 Coll.). The processing is based on our legitimate interest.

Chat

The Behio chat stores a chat visitor identifier and your chosen language in browser storage, so that a conversation continues on other pages, and the number of your visits, which it uses to decide when to offer help.

Traffic measurement with Behio Analytics

Behio Analytics is our own tool. It measures which pages you visit, how long you stay on them, which marked buttons you click, which website or campaign brought you here (the referring page and the utm, gclid and fbclid parameters) and what type of device you use. The data is stored in our own database on servers in Germany, and we do not share or sell it to anyone.

Without consent the tool stores nothing in your browser. Visits are counted by a one-way fingerprint the server derives from the IP address and browser details. One fingerprint changes every day, the other stays the same so that we can tell you are coming back. Neither the IP address nor the browser details are stored, only the fingerprint, which cannot be reversed. The legal basis is our legitimate interest in traffic statistics (Art. 6(1)(f) GDPR), and you can object at any time at the e-mail below.

If you click Accept in the banner, we store the behio_aid cookie with a random identifier for 13 months to recognise you more accurately, and we remember in browser storage where you first came to the website from (the referring page, the landing page and campaign parameters). We send that only together with a registration, so that we know where a customer came from. Without consent we keep it only in the memory of the open page. The legal basis is your consent (Art. 6(1)(a) GDPR and Section 89(3) of Czech Act No. 127/2005 Coll.). You withdraw consent by deleting cookies in your browser, after which the banner appears again.

Records of individual visits are deleted after 90 days, after which only aggregated daily statistics without visitor identifiers remain. The returning-visitor fingerprint and the record of a visitor with the behio_aid cookie (first and last visit, number of visits and first source) are deleted after 13 months without a visit.

Website speed

Cloudflare Web Analytics also measures page load speed and aggregated traffic. It uses no cookies and no browser storage.

9. Artificial intelligence: the assistant Tom and chat

We use artificial intelligence (AI) in these features:

• The assistant Tom in the admin and in the mobile app, including voice control.
• Replies in the chat on behio.com and in the chat a merchant embeds on their own website.
• Texts, translations and images you ask the admin to create.

When you write to Tom or an AI replies to you in the chat, you are communicating with artificial intelligence, not with a person. In the chat we say so right in the conversation. To reach a person on our team, use behio.com/contact or e-mail.

What data the AI processes and who receives it

• The text of your message and the data needed to answer it, for example the products or orders you want to work with.
• For voice input, the audio recording, which we convert to text. We do not store the recording used for the conversion.
• We pass the data to the AI model providers on our list of sub-processors (OpenRouter, OpenAI, Anthropic, Groq, kie.ai), only to process the specific request. Transfers to the US are protected by the safeguards in section 6.
• We do not use the data of your account or shop to train AI models ourselves.

Legal basis and your rights

For Tom and the admin features the legal basis is performance of the contract (Art. 6(1)(b) GDPR); for replies in the chat on behio.com it is our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). In the chat on a merchant's website the merchant is the controller and Behio its processor. Retention periods are in section 4.

AI replies can contain mistakes, so check them before you rely on them. We do not take decisions based on AI output that produce legal effects for you or similarly significantly affect you (Art. 22 GDPR).

10. Your rights

Regarding your personal data, you have the following rights under the GDPR:

• Right of access to your data and to a copy of it.
• Right to rectification of inaccurate and completion of incomplete data.
• Right to erasure (right to be forgotten), where the data is no longer needed.
• Right to restriction of processing.
• Right to data portability.
• Right to object to processing based on legitimate interest.
• Right to withdraw consent at any time, where processing is based on consent.
• Right to lodge a complaint with a supervisory authority.

To exercise your rights, contact us at [email protected]. We will handle them without undue delay, at the latest within one month.

11. Security

We protect data with appropriate technical and organisational measures. Communication is encrypted over HTTPS, access is controlled, and sensitive data (such as access keys to integrations) is stored encrypted.

12. Google user data (sending invoices through Gmail)

In invoicing you can connect your Gmail account so that invoices, reminders and other document emails are sent from your own address. Connecting is optional; without it we send emails from our address.

What Google lets us access

• Sending email on your behalf (the gmail.send scope). Behio uses it only to send an email you create or enable in Behio: an invoice, a payment reminder, a payment thank-you, a quote or a test email.
• Your email address (the userinfo.email scope), to show which mailbox is connected and to use it as the sender.
• We do not request access to read, modify or delete your mail, and we never see your emails.

How we handle the data

• Access tokens from Google are stored encrypted (AES-256-GCM) and used only to send the emails above.
• We do not share data from Google APIs with third parties, do not use it for advertising, and do not use it to develop, improve or train generalized artificial intelligence or machine learning models.
• No one at Behio reads it, except for security or legal reasons or with your explicit consent.

Behio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

You can disconnect at any time in Invoicing settings, Email integration, Disconnect. We then delete the tokens and revoke the access at Google as well. You can also remove the access in your Google Account at myaccount.google.com/connections.

13. Changes to this policy

We may update this policy, for example when features or legislation change. The current version is always available on this page with the effective date shown. We will inform you appropriately of any material changes.

14. Contact and supervisory authority

For any data protection question, contact us at [email protected].

You also have the right to lodge a complaint with the supervisory authority: the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.