Privacy notice

The controller for the processing described in this notice is crue GmbH, a limited liability company under Swiss law with its registered seat in Ennetbaden, Canton of Aargau, UID CHE-305.303.337, Bahnhofstrasse 44, 8001 Zurich, Switzerland. beform is a product of crue GmbH.

For all questions about data protection and to exercise your rights, write to hi@beform.ai with the subject “Data protection” or by post to the address above. You can also call us on +41 79 944 66 44.

This notice explains how we process personal data when you visit beform.ai, use the demo or the return calculator, send a form, request the playbook, subscribe to the newsletter or contact us by email or phone.

It does not cover personal data we process for companies that use beform under a contract, for example the photos and contact details their clients enter in the company’s own beform showroom. For that data the company is the controller, we act as its processor, and the company’s privacy notice applies.

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and its ordinance. Where the EU General Data Protection Regulation (GDPR) or the UK GDPR applies, we comply with it as well. Swiss law does not require a legal basis for lawful processing. For the GDPR, the legal basis is stated for each activity below.

• Server logs. Our hosting provider records your IP address, the date and time of access, the requested address, the referring page, your browser and operating system, and status or error codes.
• Performance measurement. Vercel Web Analytics and Speed Insights show us pages viewed, referrers, country, device class and loading times. They work without cookies and without an identifier that lasts longer than one day.

Purpose. To deliver the website, keep it secure and stable, detect and prevent abuse, fix errors and understand loading performance.

Legal basis. Our legitimate interest in a secure and functioning website (Art. 6 para. 1 lit. f GDPR).

We use Google Analytics 4 only if you choose “Accept all” in the cookie banner. Until then, no request is sent to Google.

• Data. Pages viewed, time on page, the source of your visit, approximate location (country and city), device, browser, screen size and language, a random identifier stored in cookies, and interactions such as clicks on “Book a call”, the demo or the playbook, clicks on our phone number or email address, the type of form sent and the industry selected, and in the demo whether a sample or your own photo was used, the area, the engine and the version number.
• Not sent. What you type into forms and your photos never reach Google. Google Analytics does not store your full IP address: location is derived from it and the address is then discarded. Google signals and ad personalisation are switched off.

Purpose. To understand how the website and the demo are used, to improve them and to see which pages lead to requests.

Legal basis. Your consent (Art. 6 para. 1 lit. a GDPR). You can withdraw it at any time under “Cookie settings” in the footer, with effect for the future. Google acts as our processor. Data may be transferred to Google LLC in the United States (see section 10).

When you send a contact form, book a call, ask for the PDF estimate from the return calculator or ask for beform from the demo, we process:

• your name, email address, company and, where you give them, website, phone number, industry, company size and message,
• for a call, the date and time you choose,
• for an estimate, the figures you entered in the return calculator and the result. The calculator runs in your browser, and your figures only reach us when you request the PDF,
• for a request from the demo, a text summary of the version you chose, such as the style, materials, detected area and whether you used a sample or your own photo. The photo and the visuals are not sent,
• the page you sent the request from, the time of sending and the country derived from your IP address.

Your request reaches our team by email and you receive a confirmation by email.

Purpose. To answer your request, prepare and hold the call, send the estimate and follow up on your interest in beform.

Legal basis. Steps prior to a contract taken at your request (Art. 6 para. 1 lit. b GDPR) and our legitimate interest in answering business inquiries and building customer relationships (Art. 6 para. 1 lit. f GDPR).

When you request The Visual Sales Playbook, we process your name, company and work email address, the page and time of the request, the country derived from your IP address and whether you asked for the newsletter. We send you the download link, inform our team and add your name and email address to a contact list of playbook requests in our email service.

We may contact you personally about your request. You receive the newsletter only if you tick the box for it and then confirm your subscription (section 7).

Purpose. To deliver the playbook and to follow up personally on your interest.

Legal basis. Carrying out your request (Art. 6 para. 1 lit. b GDPR) and our legitimate interest in following up on it (Art. 6 para. 1 lit. f GDPR). You can object at any time.

The newsletter Seen First is sent only with double opt-in.

• Sign-up. We send a confirmation link to the address you enter. The link carries your email address, and your name and the place of sign-up where given, in signed form. Until you confirm, we store nothing apart from a counter based on a one-way hash of your email address that limits repeated confirmation emails.
• Confirmation. We add your email address and, where given, your name to the newsletter list in our email service, send you a welcome email and inform our team.
• Sending. Our email service records delivery and bounces and, where enabled, opens and clicks. We use this only to deliver the newsletter and understand its reach.
• Unsubscribing. Every email has an unsubscribe link, and email programs can unsubscribe you with one click. Your address then stays marked as unsubscribed so that you are not written to again.

Purpose. To send the newsletter and to document your consent.

Legal basis. Your consent (Art. 6 para. 1 lit. a GDPR). Documenting the consent and honouring an unsubscribe rest on our legal obligations and legitimate interest (Art. 6 para. 1 lit. c and f GDPR).

The demo processes your photo only for as long as it takes to produce a result.

• Preparation. Your browser reduces the photo to at most 1,536 pixels on its long side and saves it as a new JPEG file. This also removes metadata embedded in the original file, such as the camera location.
• Processing. For the photo analysis, the suggestions and each render, the prepared photo is sent to our servers in Frankfurt, Germany, together with the area, style and materials you chose and your note. Our servers pass the photo and the instructions to the AI models of Google, of OpenAI or of both, depending on the step, the engine and availability. The result is watermarked on our servers and returned to your browser.
• No storage by us. We do not store your photo, the visuals, the suggestions or your note in any database, file storage or log. They are held in working memory while a request runs and discarded when it is completed. Visuals stay in your browser tab until you close or reload it.
• AI providers. Google and OpenAI process the data on their own infrastructure, including in the United States. Under the API terms that apply to our paid accounts, they do not use it to train their models. They may retain inputs and outputs for a limited period to detect and prevent abuse and to meet legal obligations.
• Limits. The cookie beform_demo holds a random identifier, a one-way fingerprint of each photo you used and the number of renders. The photo cannot be reconstructed from the fingerprint. Your IP address is counted for the per-connection limit.

Please upload only photos of spaces you are entitled to share, and no photos that show people or personal documents. A photo of your own home can itself be personal data. It is handled as described here. The sample photos contain no personal data of yours.

Purpose. To provide the demo you request, to apply its limits and to protect it against abuse.

Legal basis. Performance of the terms of use at your request (Art. 6 para. 1 lit. b GDPR) and our legitimate interest in a secure demo with fair limits (Art. 6 para. 1 lit. f GDPR).

Within crue, only persons who need personal data for the purposes described have access to it, including persons who work on beform for crue under a duty of confidentiality. We also use the service providers below. Where they act as our processors, they process personal data only on our instructions and under data processing terms.

• Vercel Inc. (USA): hosting, content delivery, server functions in Frankfurt (Germany), server logs and cookieless performance measurement.
• Google (Google Ireland Limited and Google Cloud EMEA Limited, Ireland, and Google LLC, USA): Google Workspace for our email inbox, Google Analytics with your consent, and the Gemini models that analyse photos and produce renders in the demo.
• OpenAI (OpenAI, L.L.C. and its affiliates, USA): models that analyse photos, suggest ideas and produce renders in the demo.
• Resend (USA, sending from its EU region in Ireland): confirmation emails, alerts to our team, the newsletter and the contact lists for the newsletter and playbook requests.
• Upstash, Inc. (USA): short-lived counters for rate limits and demo limits.
• Google Maps (Google LLC, USA): the map on the About page loads from Google when you scroll to it. Google then receives your IP address and technical details of your browser and processes them as an independent controller under its own privacy policy.

We may also disclose personal data to our professional advisers, such as lawyers, auditors and fiduciaries, under a duty of confidentiality, to authorities and courts where the law requires it or where we need to establish or defend legal claims, and to a buyer or successor if the beform business is sold or restructured.

We do not sell personal data and do not share it with advertising networks. Links to our profiles on LinkedIn, Instagram, Facebook and X are plain links, and no data is sent to these networks until you click one.

Our service providers process personal data in Switzerland, in the European Union and in the United States. The Swiss Federal Council recognises the EU and EEA states as providing adequate data protection, and the European Commission recognises Switzerland as adequate.

For transfers to the United States, we rely on the Swiss-US and EU-US Data Privacy Framework for providers certified under it, which the Swiss Federal Council and the European Commission recognise as adequate. For other providers and countries, we use the Standard Contractual Clauses of the European Commission with the adaptations required under Swiss law and, where relevant, the UK International Data Transfer Addendum. In individual cases a transfer may rest on an exception provided by law, for example where it is necessary to carry out a request you made (Art. 17 FADP, Art. 49 GDPR).

You can ask us for a copy of the safeguards we use.

We keep personal data only as long as the purpose requires, unless the law requires or allows a longer period, for example to meet retention obligations or to establish or defend legal claims.

• Contact, call, estimate and demo requests: up to 24 months after our last exchange. If a contract follows, for its duration plus the statutory retention period for business records of ten years.
• Playbook contact list: up to 24 months after the request or our last exchange, or earlier if you ask us to delete it.
• Newsletter: until you unsubscribe. The unsubscribed status is kept so that you are not written to again.
• Demo photos, visuals, suggestions and notes: not stored by us and discarded when each request is completed. AI providers may keep them for a limited period under their terms (section 8).
• Demo cookie beform_demo: 30 days.
• Rate-limit counters: counters based on your IP address expire after one hour or 24 hours, depending on the limit. Counters based on a hashed email address expire after 24 hours, or after 30 days for the newsletter confirmation.
• Server logs: up to 30 days.
• Performance measurement: kept in aggregated form only.
• Google Analytics: event data up to 14 months. Cookies up to 24 months or until you withdraw consent.
• Your choice in the cookie banner: in your browser until you clear it.

This website sets no advertising cookies. Without your consent, it stores only what it needs to work:

• beform_demo (cookie, set when you use the demo): records your demo usage to apply its limits, as described in section 8. Signed, not readable by scripts, 30 days.
• beform.consent.v1 (local storage): your choice in the cookie banner, kept until you clear it.
• beform.pricing (local storage): the currency you chose on the pricing pages, kept until you clear it.
• beform.film.watched (session storage): remembers that you watched the film. Deleted when you close the tab.

With your consent (“Accept all”), Google Analytics sets two first-party cookies:

• _ga: distinguishes visitors with a random identifier. Up to 24 months.
• _ga_<ID>: keeps the state of your current session. Up to 24 months.

You can change your choice at any time under “Cookie settings” in the footer. Choosing “Essential only” switches analytics off and removes its cookies. The embedded Google map on the About page may set Google cookies when it loads; you can block them in your browser settings.

We make no decisions based exclusively on automated processing that have legal effects on you or affect you significantly (Art. 21 FADP, Art. 22 GDPR). The AI models in the demo analyse photos of spaces and generate images and suggestions. They make no decisions about persons.

We carry out no profiling beyond the usage analysis with Google Analytics that you consent to, which evaluates the use of the website in pseudonymous form and is not used for advertising.

We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. They include encryption in transit for every connection to the website and the demo, access to personal data only for those who need it, signed cookies and links, rate limits and protection of forms against automated abuse, and service providers with recognised security standards.

No transmission over the internet is completely secure. Email is not end-to-end encrypted, so please do not send sensitive data by email or through forms.

Subject to the conditions and limits of the applicable law, you have the right to:

• request information on whether and which personal data we process about you (Art. 25 FADP, Art. 15 GDPR),
• have inaccurate or incomplete data corrected (Art. 32 FADP, Art. 16 GDPR),
• have data deleted (Art. 32 FADP, Art. 17 GDPR) and have processing restricted (Art. 18 GDPR),
• receive the data you gave us in a common electronic format or have it transferred to another controller (Art. 28 FADP, Art. 20 GDPR),
• object to processing, in particular to processing based on our legitimate interest and to direct marketing (Art. 30 para. 2 lit. b FADP, Art. 21 GDPR),
• withdraw your consent at any time with effect for the future (Art. 7 para. 3 GDPR).

To exercise these rights, write to hi@beform.ai. We may ask you to confirm your identity. We answer within 30 days and let you know if we need longer. Rights can be limited where the law requires it, for example where data must be retained by law.

In Switzerland you can report a concern to the Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch. Where the GDPR applies, you can lodge a complaint with the supervisory authority of the EU or EEA state where you live or work or where the alleged infringement took place, and in the United Kingdom with the Information Commissioner’s Office (ICO).

You have no legal or contractual obligation to provide personal data. Browsing the website involves only the technical data described in section 3. Without the details marked as required in a form, we cannot answer your request, deliver the playbook or send the newsletter.

The website and our services are aimed at businesses and professionals and are not directed at children or young people. Persons under 18 should not submit personal data. If we learn that we have received such data, we delete it.

We update this notice when our processing or the law changes. The version published on this page applies, and the date at the top shows when it was last revised. Where a change requires your consent, we ask for it before it takes effect.