Privacy Policy

This Privacy Policy explains what personal information Behavior Access collects, how we use it, who we share it with, and the choices and rights you have. It applies together with our Terms and Conditions.

1. Who we are

Behavior Access Inc. (“Behavior Access”, “we”, “us” or “our”) operates the Behavior Access website, web application and mobile applications (together, the “Services”). For the purposes of data protection law, we are the controller of the personal information described in this policy, except where section 7 says that a conference Organizer is.

2. What this policy covers

Behavior Access is a platform for conferences and continuing education in behavior analysis. Organizations host their conferences on it (“Organizers”), and people register for and attend those conferences through it (“Attendees”). Parts of the Services are still being built. This policy describes how we handle information on the website today and in the web and mobile applications as they become available. If a part of the Services does something that is not described here, we will update this policy before it does.

3. Information we collect

Information you give us

• When you contact us. The contact form asks for your name, your email address, the format of the event you are planning and your message. A phone number is optional.
• When you create an account. Your name, email address and password. You can also add a phone number, your country, your degree, your professional certification and a profile photo. We store passwords only in a hashed form that we cannot read.
• When you register for a conference. The details the registration asks for, such as your professional certification, the sessions and extras you choose, any accommodation you book and notes you add about it, and the name and email address a receipt should go to.
• When you pay. Payments are handled by our payment processor. We receive confirmation of the payment, its amount, and the payment records the processor sends us, which can include the type and last four digits of the card. We never receive or store your full card number.
• When you host a conference. Information about your organization, the people who manage your events, and the content you publish, such as schedules, speaker details and recordings.

Information collected when you use the Services

• Server logs. Like most websites, our servers record each request: IP address, date and time, the page requested, and the browser and device type. We use this to keep the Services running and secure.
• Attendance records. When you check in to or out of a session with the code shown at the door, or join an online session, we record that you did and when. These records are what continuing education credit and certificates are based on.
• Sign-in and security information. The devices you have signed in from and verification codes we have sent, so that we can protect your account.
• In the mobile application. The camera is used only to scan check-in codes; images are not stored or sent to us. If you unlock the app with your face or fingerprint, that check is done by your device, and we never receive biometric information. The app keeps your sign-in and any check-ins made without a connection in secure storage on your device until they can be sent. Notifications are sent only if you allow them.

Information we receive from others

• From Organizers, for example when an organization registers a group of its staff, or imports attendance from the video meeting tool it used for an online session.
• From our payment processor, the status of a payment, a refund or a dispute.

4. Cookies and similar technologies

This website does not set cookies and does not use analytics or advertising tools. It loads nothing from other companies’ servers; the only outside service it talks to is the one that delivers the contact form, and only when you press Send.

The web application uses only the cookies and device storage it needs in order to work, such as keeping you signed in, remembering your language, and recognizing a device you have already verified. We do not use advertising cookies and we do not track you across other websites.

5. How we use information

• To reply to you when you contact us.
• To create and secure your account, including verifying that it is you when you sign in.
• To register you for conferences, take payment, send receipts and tickets, and give you access to sessions and recordings you are entitled to.
• To record attendance, so that the Organizer or provider can issue continuing education credit and certificates.
• To send messages about a conference you registered for or about your account. These are service messages, not marketing.
• To send news about Behavior Access, only if you asked for it. You can unsubscribe at any time.
• To keep the Services working and secure, to prevent fraud and abuse, and to fix problems.
• To meet our legal obligations, such as keeping accounting and tax records, and to establish or defend legal claims.

We do not sell personal information, and we do not use it for advertising.

6. Legal bases

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases: performing our contract with you, for accounts, registrations, payments and attendance records; our legitimate interests, for replying to inquiries, keeping server logs, securing the Services and preventing fraud, where those interests are not overridden by your rights; legal obligation, for accounting and tax records; and your consent, for notifications and for news you asked to receive. You can withdraw consent at any time, which does not affect what was done before you withdrew it.

7. How we share information

• With the Organizer of a conference you register for. The Organizer receives your registration and attendance information in order to run the event and to issue credit and certificates. The Organizer is responsible for its own use of that information and may have its own privacy policy.
• With other people, where you choose to. For example, when you download or share a certificate.
• With service providers that work for us under contracts that limit what they may do with the information: Google Cloud, which hosts the Services; Formspree, which delivers the contact form; Microsoft, which provides our email; Stripe, which processes payments; and Zoom, where an Organizer uses it to run an online session.
• Where the law requires it, or where it is necessary to protect the rights, property or safety of Behavior Access, our users or others, including in response to an enforceable court order, subpoena or other lawful request.
• In a business transfer. If we are involved in a merger, acquisition or sale of assets, information may be transferred as part of it, and this policy will continue to apply to it.

8. International transfers

We are based in the United States, and the Services are hosted there. If you use the Services from another country, your information will be transferred to and processed in the United States, and in other countries where our service providers operate. Where the law requires it, we rely on recognized safeguards for those transfers, such as the European Commission’s standard contractual clauses. You can ask us for more information about them.

9. How long we keep information

• Messages sent through the contact form, for as long as we need in order to answer and follow up with you.
• Server logs, for approximately 30 days.
• Account information, for as long as you have an account. You can ask us to close it at any time.
• Orders, payments and receipts, for as long as accounting and tax law requires.
• Attendance records and issued certificates, for as long as they may be needed to show that continuing education credit was validly issued. Certifying boards can audit credit years after the event, so these are kept after an account is closed.

When we no longer need information we delete it or make it anonymous.

10. Your rights and choices

Depending on where you live, you may have the right to ask us for a copy of your personal information, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. You can exercise any of these rights by writing to info@behavioraccess.com. We will answer within the time the law allows, and we may need to confirm your identity first. We will not treat you differently for exercising a right.

If you are in the European Economic Area, the United Kingdom or Switzerland, you also have the right to complain to your local data protection authority. We would appreciate the chance to address your concern first.

11. Security

We protect personal information with measures appropriate to its sensitivity. Connections to the Services are encrypted, passwords are stored only in hashed form, every account requires a second verification step on a new device, and access to personal information inside Behavior Access is limited to people who need it. No system is perfectly secure. If a breach affects your information, we will tell you and the authorities as the law requires.

12. Children

The Services are intended for adults and are not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

13. Third-party sites

The Services may link to websites and services that we do not operate, such as an Organizer’s own website or a video meeting tool. This policy does not apply to them. Please read their privacy policies.

14. California residents

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not disclose personal information to third parties for their own direct marketing. California residents may ask us what personal information we have collected about them, ask us to correct or delete it, and will not be discriminated against for doing so. Section 10 explains how.

15. Changes to this policy

We may update this policy. When we do, we will post the new version here and change the effective date. If a change is material, we will give you reasonable notice, for example by email or by a notice in the Services.

16. Contact us

If you have questions about this policy or about your personal information, contact us at: