Privacy notice

partner.beform.ai, the portal you sign in to, and nothing else. The beform website has its own notice for the website and its demo.

Privacy notice on www.beform.ai

crue GmbH, the company named in the imprint, decides why and how everything described here is processed, which makes it the controller for it under the Swiss Federal Act on Data Protection and under the GDPR. Write to hi@beform.ai about anything on this page.

• Your account

  Your email address, the name and picture you add if you add them, the language you work in and the role you hold. Without it there is no sign-in, and no way for your colleagues to see who changed what.

• Signing in, and keeping the account safe

  The one-time codes beform sends you, a second factor if you set one up, and the sessions open in your browser. Sign-in attempts are counted for a short window so an account cannot be guessed at, and what is stored against that count is a keyed hash of the network address rather than the address.

• Your company

  The name your company is set up with, its legal name, its billing address and country, its VAT number, the language and currency it works in, and who belongs to it in which role.

• Your referrals

  The companies you referred, the code they arrived on, when that happened and how far they have got.

• Commission

  What is owed to you, what has been paid, and the figures it was worked out from.

• The demos you form

  A photo you send for a demo goes to the image model and comes back as a visual. It is not stored: what stays is the run and what it cost.

• What you signed

  For every agreement signed from your account: the exact text that was on the screen and its fingerprint, the name you typed, the signature you drew, your confirmed email address, the time, and a fingerprint of your address and browser. The address itself is never stored. This is what makes a signature provable afterwards.

• What you write to beform

  The messages you send from the support screen, and anything you attach to them, so that somebody can answer.

• The assistant panel

  If you type a question into the assistant, that question and the answer go to the model provider named below. Nothing is sent until you type something, and beform trains no model on it.

• Assistant use

  When you ask the assistant in beform, or an assistant you connected reads your account, beform records who it was, when, which assistant, which tool and whether it worked, and for the assistant in beform the token counts the model reported. Not your questions, not the answers and not what was searched for. The owners and admins of your organization can see this for everyone in it, by name; everyone else sees only their own. beform receives daily counts without names. When an assistant is connected, or beform disconnects one, the person who connected it and the owners and admins are told by email.

• Running the service

  A record of what happened in your organisation: who changed what and when, how much was rendered, and the faults the software ran into. This is what makes it possible to answer a question about the account and to notice something broken.

Most of this is processed because the contract between your company and beform needs it, or because answering you before there is one does. Some of it, such as the counters that stop an account being guessed at and the record of what happened, rests on beform's own legitimate interest in running a service that works and can be accounted for. Billing records are kept because accounting law requires them. Where something rests on your consent, you are asked for it and you can take it back.

beform sells nothing to anybody and shares nothing for advertising. These companies process data so that the product can run, each under a contract and only for beform:

• Supabase, Inc.: the database, the file storage and the sign-in behind the whole product. The database and the files are in Zurich.

• Cloudflare, Inc.: a weekly copy of the files, stored in the EU (Cloudflare R2) and locked against deletion for 30 days. The copy of a deleted file is removed within 90 days.

• GitHub, Inc.: runs that weekly copy on its own servers, including in the USA. The files pass through while they are copied and are not kept there.

• Vercel, Inc.: the hosting. The application and its server functions run in Frankfurt.

• Resend: the email beform sends you.

• OpenAI and Google: the image models that form a visual from a photograph. They receive the photograph and the instructions, and nothing about you.

• OpenAI (gpt-4o-mini): the model behind the assistant panel. It receives what you type there, and nothing else.

The database and the file storage run in Zurich, Switzerland. The application and its server functions run in Frankfurt, Germany. Email is sent from Ireland, and the email provider keeps its account and logs in the USA. The models of Google and OpenAI process what they receive on their own infrastructure, including in the USA. Files are also copied every week to a separate provider in the EU (Cloudflare R2), locked against deletion for 30 days. The copy of a deleted file is removed from there within 90 days.

Your account and your partner organisation's records are kept while the partnership is open. Referral and commission records are kept for as long as they can still be argued about or have to be accounted for.

You can ask what is held about you, have it corrected, have it deleted, have its processing restricted, object to processing that rests on a legitimate interest, and get a copy of what you gave in a form you can take elsewhere. Where something rests on your consent, you can take that back, which does not undo what was done before. Write to hi@beform.ai.

You can also complain to a data protection authority: in Switzerland the Federal Data Protection and Information Commissioner, and in the EU the authority where you live or work.

There is no analytics, no advertising and nothing that follows you around in this portal. What is kept in your browser is the product working:

• The sign-in cookies Supabase sets. Without them you would be signed out on every page.

• BEFORM_LOCALE, a cookie holding the language you chose, for a year.

• beform_ref, a cookie holding the referral code somebody arrived on while an account is being opened, for thirty days.

• beform.assistant.size, kept by your browser alone, remembering how large you left the assistant panel.

The date at the top of this page is the day the wording last changed.