Privacy Policy

Last updated: September 28, 2026

This Privacy Policy explains how Petrus Labs Pty. Ltd., which operates BEHAVIQ, collects, uses, shares, and protects personal information when you use our website, our iPhone app, and our services.

Summary

We collect account data, security and session data, usage data, and billing data.
We process the messages, files, and audio you send to run the Service and return responses.
We use third-party providers for infrastructure, AI, payments, email, login, and error monitoring.
If your organisation turns on Team insights and you agree to take part, an AI model reads your messages to produce reports for your organisation about workplace topics. Reports never name you or quote you, and you can stop taking part at any time.
We do not sell your personal information.
We do not use your messages, uploads, or chat history to train our own general-purpose models.

Who we are

BEHAVIQ is operated by Petrus Labs Pty. Ltd., based in Australia. If you have privacy questions, requests, or complaints, contact us at support@behaviq.io.

What we collect

Account and authentication information

Email address, account ID, name, and basic profile information.
Password hashes if you use password login. We do not store your plaintext password.
Authentication and security records such as verification codes, two-factor authentication data, API key metadata, single sign-on (SSO) and SCIM metadata, and session records.
Provider identifiers and related metadata if you sign in with Apple, Google, or your organisation's SSO.

Workspace and usage information

Workspace settings, member roles, invitations, audit logs, and administrator actions.
Usage records, model settings, billing events, and credit balances.
Your preferences, including the name you'd like to be called and anything you add about yourself to personalise responses, and organisation instructions such as response guidance, terminology, and safety policies.
Details about members that workspace administrators add, import, or sync from their identity provider, such as department, division, cost centre, job title, and work city or country. Administrators can also add other details of their own choosing.

Chat, files, and voice information

Messages you send, files you upload, and the responses the Service generates.
Chat metadata such as timestamps, identifiers, and message previews used to display conversation history.
If you use voice features, the audio you record, which we send for transcription and do not keep, and the audio of replies read aloud, which we keep so they can be replayed.

Team insights information

If you take part in Team insights, your choice to take part, any conversations you leave out, and the notes the AI model writes about each of your messages (described under Team insights below).

Technical and security information

IP address, user agent, device and browser details, timestamps, and request metadata.
Error and performance data used to diagnose reliability or security issues. Browser session replay is disabled.

Billing and support information

Subscription records, invoice data, Stripe customer and payment identifiers, and credit purchase records.
Records of subscriptions and credits bought in the iPhone app, which Apple and RevenueCat report to us. We do not receive your card details.
If you buy a gift, the recipient's name and email address and any message you include, so we can deliver it.
Messages you send us for support, sales, feedback, or account administration.

Mobile and device information

The app asks for the microphone only when you use voice input, and for Face ID or Touch ID only if you turn on the app lock. It uses the file picker, downloads, and sharing only when you choose to.
The app keeps some data on your device, including your sign-in token in the device keychain, preferences, drafts, and recent conversations so they open quickly. Biometric checks are handled by your device; we do not receive your fingerprint or face data.

How we use personal information

To provide the Service and keep it working.
To authenticate users, administer workspaces, enforce permissions, and secure accounts.
To process payments, invoices, subscriptions, and credits.
To produce Team insights reports for organisations that turn the feature on, from the messages of members who agree to take part.
To investigate abuse, bugs, outages, and security incidents.
To comply with legal obligations and enforce our Terms.
To improve reliability, safety, and product operations.

AI and model providers

We use OpenAI to run the Service's AI features. We do not use your messages, uploads, or chat history to train our own general-purpose models. Your messages, uploaded files, retrieved knowledge base content, your preferences, organisation instructions, and safety guidance may be sent to OpenAI where needed to generate a response. We also send OpenAI the start of a conversation to write its title, and recent messages to suggest replies. Replies read aloud are generated by OpenAI from the reply text, and voice input is transcribed by OpenAI. If your workspace turns on web search, part of a request may be sent to a search service through OpenAI so the feature can work.

OpenAI keeps the state of each conversation so later replies can build on earlier ones, and may keep limited records for abuse monitoring, security, and legal compliance, under its own terms and retention settings. Workspace retention settings and account deletion in BEHAVIQ do not erase records held by OpenAI.

Team insights

Team insights gives an organisation monthly reports on the workplace topics its members raise with BEHAVIQ, without showing what any one person said. It is available to organisations on business plans, and it is off unless the organisation's administrators turn it on.

Taking part is your choice. Your organisation isn't told whether you take part, and only conversations you start after you agree are used.
Only the messages you write are used. The Service's replies, your files, and conversation titles are not. You can leave any conversation out.
OpenAI reads each message and writes short, general notes about the workplace topics it raises and its tone. We ask OpenAI not to store these requests.
We use the notes to build the month's report and then delete them. We never keep them for more than 90 days, or longer than your workspace keeps the conversation.
Reports show topics, how many people raised each one, their tone, and changes from month to month. A report is only produced when at least 20 people take part, and a topic only appears when at least 10 people raised it. Reports never name anyone or quote messages.
Reports can be broken down by member details such as department. You are told which details are used before you agree, and if administrators add one, everyone is asked again. A group only appears when at least 20 people in it take part.
Workspace owners and administrators, including billing administrators, and members given access to analytics can see reports. Published reports are kept for as long as the workspace exists.
You can stop taking part at any time. We then delete your participation and any notes not yet used in a published report. Reports already published are not changed. If your organisation turns Team insights off, we delete everyone's participation and any unused notes.

Workspace administrators and employer visibility

If you use BEHAVIQ through an organisation, workspace administrators can manage members, roles, member details, invitations, billing, usage limits, API keys, SSO, SCIM, knowledge-base files, workspace settings, and audit logs. They can see usage and administrative records needed to run the workspace.

Workspace administrator tools do not let an employer read individual chats. Team insights reports, described above, are aggregated and never name anyone. We may access limited content or metadata where needed to provide support, investigate abuse or security issues, comply with law, fix technical problems, or handle a request from the organisation under a written agreement.

Who we share information with

We share personal information with service providers where needed to run the Service. This currently includes:

Cloudflare for hosting, storage, and application infrastructure.
OpenAI for AI features, including chat, file search, voice, Team insights, and optional web search.
Stripe for billing and payments on the website.
Apple if you sign in with Apple, or buy a subscription or credits in the iPhone app. Apple processes those payments.
RevenueCat, which records purchases made in the iPhone app so we can apply them to your account.
Resend for email, such as verification codes, invitations, and billing notices.
Google if you sign in with Google.
Your organisation's identity provider if your organisation uses SSO or SCIM.
Sentry for error and performance monitoring of our website and servers. The iPhone app does not send crash reports.
Microsoft Forms if you open our feedback form.

We may also disclose information where required by law, to protect rights or safety, or as part of a sale, merger, restructure, or similar transaction.

International transfers

We are based in Australia, but some of our providers operate internationally. Personal information is likely to be processed in Australia and the United States, and may be processed in other countries where our infrastructure providers operate.

Cookies and similar technologies

We use cookies for session management, login state, and security, and your browser's local storage for preferences and unsent drafts. We do not use advertising or analytics cookies.

Retention

We keep personal information for as long as we reasonably need it to provide the Service, protect the platform, meet legal obligations, and resolve disputes.

Saved conversations do not expire automatically by default.
For eligible workspaces, administrators can leave conversation retention as indefinite, or choose 30, 90, 180, or 365 days. When the period ends for an inactive conversation, it is deleted from BEHAVIQ's database and message storage.
Replies read aloud are kept so they can be replayed, and are deleted when you delete your account.
Knowledge-base files stay available until an administrator removes them. Removing a file starts the deletion of the copies held by our AI provider for that feature.
Team insights notes are deleted once they have been used in a report, and within 90 days at most. Published reports are kept for as long as the workspace exists.
Audit logs are kept for the life of the workspace. Administrators can view and export the last 365 days.
Billing, tax, and accounting records may be retained longer where the law requires it.

Deletion can take additional time to finish in background jobs, backups, logs, and provider systems. Some provider records, audit records, billing records, security records, support records, and legal records may also be kept where needed for security, fraud prevention, legal compliance, dispute handling, backups, or the integrity of the Service.

Enterprise and pilot workspaces

For enterprise or pilot workspaces, a separate written agreement may set stricter rules for participant notice, subprocessor information, support, retention, export, deletion, incident notification, and offboarding. Where that agreement applies, it controls over this public policy to the extent of any inconsistency.

Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your personal information, and to object to or restrict some processing. To make a request, contact support@behaviq.io.

You can delete your account yourself, on the website or in the app, under Settings → Profile → Delete account. This deletes your account, your conversations and their stored messages in every workspace, replies read aloud, your Team insights participation, and your personal workspace, and cancels any subscription on that workspace straight away. Subscriptions bought in the iPhone or Android app are billed by Apple or Google, so cancel them in your App Store or Google Play account settings as well. Workspaces you belong to keep their own records, such as billing and audit history, and their audit log records that you deleted your account, with your email address. Records of gifts you bought or received, and messages you sent us, are also kept.

Privacy complaints

If you think we have mishandled your personal information, please email us at support@behaviq.io and describe the issue. We will review the complaint, investigate where appropriate, and respond in writing.

If you are not satisfied with our response, or we do not respond within a reasonable time, you can make a complaint to the Office of the Australian Information Commissioner (OAIC). Details are available at oaic.gov.au.

Data breaches

If we become aware of a data breach that must be notified under applicable law, we will assess it and notify affected people and regulators where required.

Security

We use administrative, technical, and organisational safeguards designed to protect personal information. No system is completely secure, so please use care when deciding what to upload or include in messages.

Children

The Service is not directed to children under 13. If you believe a child has provided personal information to us, contact us and we will review the issue.

Changes to this policy

We may update this Privacy Policy from time to time. If we do, we will post the updated version here and change the "Last updated" date.

Contact

Questions about privacy? Email support@behaviq.io.