Privacy notice

The controller for the processing described in this notice is crue GmbH, a limited liability company under Swiss law with its registered seat in Ennetbaden, Canton of Aargau, UID CHE-305.303.337, Badstrasse 11, 5408 Ennetbaden, Switzerland. beform is a product of crue GmbH.

For all questions about data protection and to exercise your rights, write to hi@beform.ai with the subject “Data protection” or by post to the address above. You can also call us on +41 79 944 66 44.

This notice explains how we process personal data when you visit beform.ai, use the demo or the return calculator, send a form, request the playbook, subscribe to the newsletter or contact us by email or phone.

It does not cover personal data we process for companies that use beform under a contract, for example the photos and contact details their clients enter in the company’s own beform showroom. For that data the company is the controller, we act as its processor, and the company’s privacy notice applies.

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and its ordinance. Where the EU General Data Protection Regulation (GDPR) or the UK GDPR applies, we comply with it as well. Swiss law does not require a legal basis for lawful processing. For the GDPR, the legal basis is stated for each activity below.

This notice is written in English. Translations of the legal texts are provided for convenience only, and in case of discrepancies the English version prevails.

• Server logs. Our hosting provider records your IP address, the date and time of access, the requested address, the referring page, your browser and operating system, and status or error codes.
• Performance measurement. Vercel Web Analytics and Speed Insights show us pages viewed, referrers, country, device class and loading times. They work without cookies and without an identifier that lasts longer than one day.
• Language. The website reads the language setting your browser sends to show the site in one of 16 languages: English, German, French, Italian, Spanish, Portuguese, Dutch, Swedish, Danish, Russian, Bulgarian, Serbian, Croatian, Albanian, Arabic or Hebrew. The strictly necessary cookie NEXT_LOCALE remembers your language for one year.

Purpose. To deliver the website in your language, keep it secure and stable, detect and prevent abuse, fix errors and understand loading performance.

Legal basis. Our legitimate interest in a secure and functioning website in the language of our visitors (Art. 6 para. 1 lit. f GDPR).

We use Google Analytics 4 only if you choose “Accept all” in the cookie banner. Google Tag Manager, which we use to load and manage Google Analytics, also loads only after that choice. Until then, no request is sent to Google. When Tag Manager loads, Google receives your IP address and technical details of your browser. Tag Manager itself sets no cookies and does not analyze your use of the website.

• Data. Pages viewed, time on page, the source of your visit, approximate location (country and city), device, browser, screen size and language, a random identifier stored in cookies, and interactions such as clicks on “Book a call”, the demo or the playbook, clicks on our phone number or email address, the type of form sent and the industry selected, and in the demo whether a sample or your own photo was used, the area, the engine and the version number.
• Not sent. What you type into forms and your photos never reach Google. Google Analytics does not store your full IP address: location is derived from it and the address is then discarded. Google signals and ad personalization are switched off.

We also use Microsoft Clarity, likewise only if you choose “Accept all”, and it loads only after that choice. Clarity gives us heatmaps, which show where visitors click and how far they scroll, and session recordings, which replay how a visit moved through the pages. A recording is rebuilt from the structure of the page and your interactions with it; it is not a video of your screen. Until you accept, no request is sent to Microsoft. We tell Clarity that you consented to analytics storage and refused advertising storage.

• Data. Mouse movements, clicks, taps, scrolling and text selection, the pages you view with their addresses and the page you came from, the layout and content of those pages as you saw them apart from what is masked, approximate location derived from your IP address, device, browser, operating system, screen size and language, and a random identifier stored in cookies.
• Masked. What you type into forms is never recorded. Every form on this website, the whole demo with your photos, the visuals formed from them, their versions, your notes and your choices, and your conversation with the beform Assistant are masked in your browser before anything is sent: Clarity receives placeholders instead of their text and an empty frame instead of each image, so your photo cannot be replayed. Clarity does not start on the newsletter’s confirmation and unsubscribe pages.
• Microsoft as recipient. Microsoft (Microsoft Ireland Operations Limited, Ireland, and Microsoft Corporation, USA) receives this data as an independent controller, not as our processor. Under its Clarity terms, Microsoft may also use it for its own purposes, including improving its services and advertising, as described in the Microsoft Privacy Statement. The data is stored in Microsoft’s Azure cloud and may be transferred to Microsoft Corporation in the United States, which is certified under the Data Privacy Framework (see section 11).

Purpose. To understand how the website and the demo are used, to improve them and to see which pages lead to requests.

Legal basis. Your consent (Art. 6 para. 1 lit. a GDPR). You can withdraw it at any time under “Cookie settings” in the footer, with effect for the future: Google Analytics and Clarity then stop, and their cookies on this website are removed. Google (Google Ireland Limited and Google LLC) acts as our processor for Google Analytics and Tag Manager; Microsoft is an independent controller for Clarity. Data may be transferred to Google LLC and Microsoft Corporation in the United States (see section 11).

When you send a contact form, book a call, ask for the PDF estimate from the return calculator or ask for beform from the demo, we process:

• your name, email address, company and, where you give them, website, phone number, industry, company size and message,
• for a call, the date and time you choose,
• for an estimate, the figures you entered in the return calculator and the result. The calculator runs in your browser, and your figures only reach us when you request the PDF,
• for a request from the demo, a text summary of the version you chose, such as the style, materials, detected area and whether you used a sample or your own photo. The photo and the visuals are not sent,
• the page you sent the request from, the time of sending and the country derived from your IP address.

Your request reaches our team by email, you receive a confirmation by email, and the request is recorded in our internal system so we can follow it up. When you book a call, we enter it in our Google Calendar with your name and email address, and Google sends you the invitation with the video call link.

Purpose. To answer your request, prepare and hold the call, send the estimate and follow up on your interest in beform.

Legal basis. Steps prior to a contract taken at your request (Art. 6 para. 1 lit. b GDPR) and our legitimate interest in answering business inquiries and building customer relationships (Art. 6 para. 1 lit. f GDPR).

When you request The Visual Sales Playbook, we process your name, company and work email address, the page and time of the request, the country derived from your IP address and whether you asked for the newsletter. We send you the download link, inform our team and add your name and email address to a contact list of playbook requests in our email service.

We may contact you personally about your request. You receive the newsletter only if you tick the box for it and then confirm your subscription (section 7).

Purpose. To deliver the playbook and to follow up personally on your interest.

Legal basis. Carrying out your request (Art. 6 para. 1 lit. b GDPR) and our legitimate interest in following up on it (Art. 6 para. 1 lit. f GDPR). You can object at any time.

The newsletter Seen First is sent only with double opt-in.

• Sign-up. We send a confirmation link to the address you enter. The link carries your email address, and your name and the place of sign-up where given, in signed form. Until you confirm, we store nothing apart from a counter based on a one-way hash of your email address that limits repeated confirmation emails.
• Confirmation. We add your email address and, where given, your name to the newsletter list in our email service, send you a welcome email and inform our team.
• Sending. Our email service records delivery and bounces and, where enabled, opens and clicks. We use this only to deliver the newsletter and understand its reach.
• Unsubscribing. Every email has an unsubscribe link, and email programs can unsubscribe you with one click. Your address then stays marked as unsubscribed so that you are not written to again.

Purpose. To send the newsletter and to document your consent.

Legal basis. Your consent (Art. 6 para. 1 lit. a GDPR). Documenting the consent and honoring an unsubscribe rest on our legal obligations and legitimate interest (Art. 6 para. 1 lit. c and f GDPR).

The demo processes your photo only for as long as it takes to produce a result.

• Preparation. Your browser reduces the photo to at most 1,536 pixels on its long side and saves it as a new JPEG file. This also removes metadata embedded in the original file, such as the camera location.
• Processing. For the photo analysis, the suggestions and each render, the prepared photo is sent to our servers in Frankfurt, Germany, together with the area, style and materials you chose and your note. Our servers pass the photo and the instructions to the AI models of Google, of OpenAI or of both, depending on the step, the engine and availability. The result is watermarked on our servers and returned to your browser.
• Inspiration. A picture you add as an inspiration is prepared in your browser in the same way, reduced to at most 1,024 pixels on its long side, and sent to our servers to read its style, materials, colors and light, and with each render as a reference picture. Its colors are read on our servers; its style and materials are read by the AI models of Google or OpenAI, which also receive it with each render. We do not store it, never show it in a result and never publish it or use it for anything else. It stays in your browser tab until you remove it or close or reload the page. Please use only a picture you may use, and none that shows people.
• No storage by us. We do not store your photo, the visuals, the suggestions or your note in any database, file storage or log. They are held in working memory while a request runs and discarded when it is completed. Visuals stay in your browser tab until you close or reload it.
• View in 3D. The 3D view computes the depth of the picture on your device, with a model loaded from this website, and sends neither the picture nor its depth to us or anyone else; with your consent, Google Analytics only counts that the 3D view was opened and in which mode.
• AI providers. Google and OpenAI process the data on their own infrastructure, including in the United States. Under the API terms that apply to our paid accounts, they do not use it to train their models. They may retain inputs and outputs for a limited period to detect and prevent abuse and to meet legal obligations.
• Measurements and floor plans in Pro. For measurements, the prepared photo goes to our servers and on to the AI models of Google or OpenAI in the same way as for a render, together with any dimensions you enter. The quantities, the cost range and the sketch are then calculated on our servers without an AI model. A floor plan you upload, as an image or as a single page PDF, is sent to our servers and to the AI providers to be read and, where you ask for one, to produce a visual. Plans often show names, addresses or the layout of a home, so please remove what is not needed before you upload one.
• Limits. The cookie beform_demo holds a random identifier, a one-way fingerprint of each photo you used and the number of renders. The photo cannot be reconstructed from the fingerprint. Your IP address is counted for the per-connection limit.

Please upload only photos of spaces you are entitled to share, and no photos that show people or personal documents. A photo of your own home can itself be personal data. It is handled as described here. The sample photos contain no personal data of yours.

Purpose. To provide the demo you request, to apply its limits and to protect it against abuse.

Legal basis. Performance of the terms of use at your request (Art. 6 para. 1 lit. b GDPR) and our legitimate interest in a secure demo with fair limits (Art. 6 para. 1 lit. f GDPR).

The beform Assistant on this website is an AI, not a person. It answers questions about beform from the content of this website. Its answers are written automatically by an AI model, are not checked by a person before you see them, can be incomplete or wrong, and are not binding.

• What is sent. Each time you send a question, your browser sends the conversation so far, meaning your questions and the answers already given, and the language of the page to our servers in Frankfurt, Germany. Our servers add our instructions and the public content of this website and pass this on to the AI model. Nothing else about you or your visit is passed on: not the page you are reading, not your IP address, and not your name or email address unless you type them into the conversation. Please do not enter sensitive personal data.
• AI provider. The answers come from a model of Anthropic (Anthropic, PBC, USA) or, where we have not set up Anthropic, of OpenAI (OpenAI OpCo, LLC, USA) or, where we have set up neither, of Google (Google Cloud EMEA Limited, Ireland, with Google LLC, USA). Only one of them is in use at a time, and the note under the assistant’s input field names it. That provider processes the conversation as our processor on its own infrastructure, including in the United States. Under the API terms that apply to our paid account with it, it does not use the conversation to train its models. It may keep the conversation for a limited period to detect and prevent abuse and to meet legal obligations.
• No storage by us. We do not keep the conversation in any database, file storage or log. It is held in working memory while an answer is written and discarded when it is complete. It stays in your browser tab until you close or reload it. To apply the limit on questions per hour, a counter based on your IP address in pseudonymized form expires after one hour.

Purpose. To answer your questions about beform, and to protect the assistant against abuse with fair limits.

Legal basis. Our legitimate interest in answering questions about our offer and in a secure assistant (Art. 6 para. 1 lit. f GDPR) and, where your question concerns a possible order, steps prior to a contract taken at your request (Art. 6 para. 1 lit. b GDPR). Using the assistant is voluntary: you can also write to us or call us.

Within crue, only persons who need personal data for the purposes described have access to it, including persons who work on beform for crue under a duty of confidentiality. We also use the service providers below. Where they act as our processors, they process personal data only on our instructions and under data processing terms.

• Vercel Inc. (USA): hosting, content delivery, server functions in Frankfurt (Germany), server logs and cookieless performance measurement.
• Supabase (Supabase Inc., USA, with the database and the file storage in Zurich, Switzerland): the database behind our internal system, where requests sent from this website are recorded, and the short-lived counters behind our rate limits and demo limits.
• Google (Google Cloud EMEA Limited, Ireland, with Google LLC, USA): Google Workspace for our email inbox and our calendar, the Gemini models that analyze photos and produce renders in the demo, and the Gemini model that writes the answers of the beform Assistant when Google is the provider in use for it (section 9). Google Tag Manager and Google Analytics, only with your consent, are provided by Google Ireland Limited, Ireland, with Google LLC, USA.
• OpenAI (OpenAI OpCo, LLC, USA): models that analyze photos, suggest ideas and produce renders in the demo, and the model that writes the answers of the beform Assistant when OpenAI is the provider in use for it (section 9).
• Anthropic (Anthropic, PBC, USA): the model that writes the answers of the beform Assistant when Anthropic is the provider in use for it (section 9).
• Resend (Plus Five Five, Inc., USA, sending from Ireland, with the account and logs in the USA): confirmation emails, alerts to our team, the newsletter and the contact lists for the newsletter and playbook requests.
• Microsoft (Microsoft Ireland Operations Limited, Ireland, and Microsoft Corporation, USA): Microsoft Clarity, heatmaps and session recordings of this website, only with your consent. Microsoft receives this data as an independent controller under its own terms (section 4).
• Google Maps (Google LLC, USA): the map on the About page loads from Google only once you have accepted all cookies, or after you click “Show the map”. Google then receives your IP address and technical details of your browser and processes them as an independent controller under its own privacy policy.

We may also disclose personal data to our professional advisers, such as lawyers, auditors and fiduciaries, under a duty of confidentiality, to authorities and courts where the law requires it or where we need to establish or defend legal claims, and to a buyer or successor if the beform business is sold or restructured.

We do not sell personal data and do not share it with advertising networks. What Microsoft may do with Clarity data under its own terms is set out in section 4. Links to our profiles on LinkedIn, Instagram, Facebook and X are plain links, and no data is sent to these networks until you click one.

Our service providers process personal data in Switzerland, in the European Union and in the United States, and Google also in other countries where it runs its infrastructure. The Swiss Federal Council recognizes the EU and EEA states as providing adequate data protection, and the European Commission recognizes Switzerland as adequate.

For transfers to the United States, we rely on the Swiss-US and EU-US Data Privacy Framework for providers certified under it, which the Swiss Federal Council and the European Commission recognize as adequate. For other providers and countries, we use the Standard Contractual Clauses of the European Commission with the adaptations required under Swiss law and, where relevant, the UK International Data Transfer Addendum. In individual cases a transfer may rest on an exception provided by law, for example where it is necessary to carry out a request you made (Art. 17 FADP, Art. 49 GDPR).

You can ask us for a copy of the safeguards we use.

We keep personal data only as long as the purpose requires, unless the law requires or allows a longer period, for example to meet retention obligations or to establish or defend legal claims.

• Contact, call, estimate and demo requests: up to 24 months after our last exchange. If a contract follows, for its duration plus the statutory retention period for business records of ten years.
• Playbook contact list: up to 24 months after the request or our last exchange, or earlier if you ask us to delete it.
• Newsletter: until you unsubscribe. The unsubscribed status is kept so that you are not written to again.
• Demo photos, visuals, suggestions and notes: not stored by us and discarded when each request is completed. AI providers may keep them for a limited period under their terms (section 8).
• Inspirations added in the demo: not stored by us and discarded when each request is completed. AI providers may keep them for a limited period under their terms (section 8).
• Measurements, quantity lists, cost ranges, sketches and uploaded floor plans from the demo: not stored by us and discarded when each request is completed. Files you download stay on your own device.
• Demo cookie beform_demo: 30 days.
• Pro demo cookie beform_demo_pro: 30 days.
• Conversations with the beform Assistant: not stored by us and discarded when each answer is complete. The AI provider in use may keep them for a limited period under its terms (section 9).
• Rate-limit counters: counters based on your IP address expire after one hour or 24 hours, depending on the limit. Counters based on a hashed email address expire after 24 hours, or after 30 days for the newsletter confirmation.
• Server logs: up to 30 days.
• Performance measurement: kept in aggregated form only.
• Google Analytics: event data up to 14 months. Cookies up to 24 months or until you withdraw consent.
• Microsoft Clarity: in our Clarity project, as Microsoft states it, recordings for 30 days, and a random sample of recordings and those we mark as favorites for up to 9 months; heatmaps for up to 9 months. Cookies for up to one year or until you withdraw consent. What Microsoft uses for its own purposes it keeps under its own privacy statement.
• Language cookie NEXT_LOCALE: one year.
• Your choice in the cookie banner: in your browser until you clear it.

This website sets no advertising cookies. Without your consent, it stores only what it needs to work:

• beform_demo (cookie, set when you use the demo): records your demo usage to apply its limits, as described in section 8. Signed, not readable by scripts, 30 days.
• beform_demo_pro (cookie, set when you use the Pro capabilities of the demo): counts the photos measured, the plans read and the plan visuals formed, so their limits can be applied. Signed, not readable by scripts, 30 days.
• NEXT_LOCALE (cookie): remembers the language in which the website is shown, so it stays the same on your next visit. Strictly necessary, one year.
• beform.consent.v1 (local storage): your choice in the cookie banner, kept until you clear it.
• beform_currency (cookie): the currency you chose on the pricing pages, kept until you clear it.
• beform.film.watched (session storage): remembers that you watched the film. Deleted when you close the tab.

With your consent (“Accept all”), Google Tag Manager loads Google Analytics, which sets two first-party cookies:

• _ga: distinguishes visitors with a random identifier. Up to 24 months.
• _ga_<ID>: keeps the state of your current session. Up to 24 months.

With the same consent, Microsoft Clarity sets two first-party cookies and one entry in session storage:

• _clck: a random identifier that recognizes your browser on this website, and Clarity’s settings for it. One year.
• _clsk: joins the pages of one visit into one recording. One day.
• _cltk (session storage): tells the browser tabs of one visit apart. Deleted when you close the tab.

You can change your choice at any time under “Cookie settings” in the footer. Choosing “Essential only” switches Google Analytics and Clarity off and removes their cookies. The Google map on the About page loads only after you click “Show the map” and may then set Google cookies; you can block them in your browser settings.

We make no decisions based exclusively on automated processing that have legal effects on you or affect you significantly (Art. 21 FADP, Art. 22 GDPR). The AI models in the demo analyze photos of spaces and generate images and suggestions. They make no decisions about persons.

We carry out no profiling beyond the usage analysis with Google Analytics and Microsoft Clarity that you consent to, which evaluates the use of the website in pseudonymous form. We do not use it for advertising; what Microsoft may do with Clarity data under its own terms is set out in section 4.

We take appropriate technical and organizational measures to protect personal data against loss, misuse and unauthorized access. They include encryption in transit for every connection to the website and the demo, access to personal data only for those who need it, signed cookies and links, rate limits and protection of forms against automated abuse, and service providers with recognized security standards.

No transmission over the internet is completely secure. Email is not end-to-end encrypted, so please do not send sensitive data by email or through forms.

Subject to the conditions and limits of the applicable law, you have the right to:

• request information on whether and which personal data we process about you (Art. 25 FADP, Art. 15 GDPR),
• have inaccurate or incomplete data corrected (Art. 32 FADP, Art. 16 GDPR),
• have data deleted (Art. 32 FADP, Art. 17 GDPR) and have processing restricted (Art. 18 GDPR),
• receive the data you gave us in a common electronic format or have it transferred to another controller (Art. 28 FADP, Art. 20 GDPR),
• object to processing, in particular to processing based on our legitimate interest and to direct marketing (Art. 30 para. 2 lit. b FADP, Art. 21 GDPR),
• withdraw your consent at any time with effect for the future (Art. 7 para. 3 GDPR).

To exercise these rights, write to hi@beform.ai. We may ask you to confirm your identity. We answer within 30 days and let you know if we need longer. Rights can be limited where the law requires it, for example where data must be retained by law.

In Switzerland you can report a concern to the Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch. Where the GDPR applies, you can lodge a complaint with the supervisory authority of the EU or EEA state where you live or work or where the alleged infringement took place, and in the United Kingdom with the Information Commissioner’s Office (ICO).

You have no legal or contractual obligation to provide personal data. Browsing the website involves only the technical data described in section 3. Without the details marked as required in a form, we cannot answer your request, deliver the playbook or send the newsletter.

The website and our services are aimed at businesses and professionals and are not directed at children or young people. Persons under 18 should not submit personal data. If we learn that we have received such data, we delete it.

We update this notice when our processing or the law changes. The version published on this page applies, and the date at the top shows when it was last revised. Where a change requires your consent, we ask for it before it takes effect.