Privacy Policy

Draft. This text is not in effect yet.

The Behavioral Scientist AI

Effective date: [the date it is published]

The Behavioral Scientist AI (the "Service") is the AI research assistant at ai.thebehavioralscientist.com. Haystack Group LLC ("we" or "us") owns and operates it. This policy explains what we collect when you use the Service, how we use and share it, and the choices you have. The website and newsletter at thebehavioralscientist.com have their own privacy policy.

What we collect

• Account information. Your email address. If you sign in with Google, we also receive your Google account ID and the email address that Google confirms. We do not receive your Google password, contacts, files or profile photo.
• Your content. Everything you enter in the Service, the answers it gives you, the sources it cites, the notes it keeps about your situation, and any ratings or comments you leave on answers.
• Usage and billing records. When you ask a question, which model answered, and what the answer cost. When paid plans start: your plan, payments, credit balance and spending limits. Stripe processes payments, and we do not receive or store your full card number.
• Sign-in and security records. The time and method of each sign-in, the network (IP) address of each sign-in and code request, and records of the sign-in codes we send. We store sign-in codes and session tokens only in a hashed form.
• Technical information. Our hosting and security providers process your IP address, browser type, the pages you request and the time of each request. Cloudflare Turnstile checks your browser to stop automated sign-in attempts.
• Messages to us. If you email us, we keep your message and our reply.

The Service uses cookies only to keep you signed in and to complete sign-in safely. It has no advertising cookies and no analytics trackers.

Do not enter identifiable information about patients, employees, research participants or other people unless you have the right to share it.

How we use information

We may use the information we collect for any lawful business purpose. This includes to:

• provide the Service: answer your questions, keep your chats, run your account, and apply plans and limits;
• improve the Service and develop new products, including to train, fine-tune, test and evaluate AI models and methods, whether we build them or others build them for us;
• research behavior change, decisions and the questions people bring to the Service, and publish what we learn (we publish only aggregated or de-identified findings, or examples with identifying details removed);
• communicate with you about your account and the Service, and send you news about our products (you can unsubscribe from marketing emails at any time);
• keep the Service secure, prevent fraud and abuse, and enforce our Terms of Use;
• comply with the law and protect our rights.

We may create aggregated or de-identified information from what we collect, and use and share it for any purpose.

Google sign-in. We use the information we receive from Google only to sign you in and to run your account. We do not use it to train AI models or for advertising, and we do not sell it. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

How we share information

• Service providers that run the Service for us: Render (hosting and backups), Cloudflare (delivery, security and Turnstile), Postmark (sign-in emails), Google (sign-in) and, when paid plans start, Stripe (payments). They may use the information only to provide their services to us.
• AI model providers. To answer a question, we send your question, your chat and related content to an AI model provider. Today that is OpenAI, through OpenRouter. With our current settings, they do not use your content to train their own models, and they may keep it for a limited time to monitor for abuse.
• Partners who help us build and evaluate models or do research, under agreements that limit their use of the information to that work.
• Business transfers. If we take part in a merger, acquisition, financing or sale of assets, information may transfer as part of that deal.
• Legal reasons. When we believe the law requires it, or to protect the rights, property or safety of anyone.
• With your consent or at your direction.

We do not sell your personal information, and we do not share it for targeted advertising.

How long we keep information

We keep your account information and content for as long as we have a business purpose for them, including the purposes above, unless the law requires us to delete them sooner. When you delete a chat, we remove it from your account and from our live database. Copies may stay in backups for a time, and information from the chat may stay in datasets, models and research that we made before you deleted it. Account, billing and security records may stay after you close your account.

Your choices and rights

• You can delete a chat at any time in the Service.
• To ask for a copy of your information, a correction, or the deletion of your account, email support@thebehavioralscientist.com. We may need to confirm that the request comes from you. If we keep some information, for example for security, billing or legal reasons, or where the law lets us keep it, we will tell you.
• Depending on where you live, you may have other rights, such as the right to object to some uses or to complain to a data protection authority. We will answer requests as the law where you live requires.

People in the European Economic Area, the United Kingdom and Switzerland

Haystack Group LLC is the controller of your personal data. We process it to perform our contract with you (to provide the Service), for our legitimate interests (to improve our products, train and evaluate models, do research and keep the Service secure), to meet legal obligations, and with your consent where the law requires it. You can object to processing based on our legitimate interests by emailing us. We store and process data in the United States, [with the transfer safeguards that counsel confirms].

Security

We protect information with measures such as encrypted connections, hashed sign-in codes and session tokens, and limited access. No method is perfectly secure.

Children

The Service is not for anyone under 18. If you believe that someone under 18 has given us information, contact us and we will delete it.

Changes to this policy

We may change this policy. We will post the new version here and update the effective date. If a change materially expands how we use information that we already hold, we will tell you before it applies, for example by email or in the Service.

Contact

Haystack Group LLC support@thebehavioralscientist.com 241 Burlington Place, Nashville, TN 37215