Privacy Notice

1. Who we are

This website, aimforbehavior.com, is operated by Aim For Behavior ("Aim For Behavior", "AFB", "we", "us"), based in Amsterdam, the Netherlands. We are the data controller for the personal data described in this notice.

• Contact location: Amsterdam, the Netherlands
• Privacy contact: privacy@aimforbehavior.com

2. Scope of this notice

This notice covers personal data we process across the aimforbehavior.com website: browsing, contact and consulting-inquiry forms, free tools, newsletter sign-up, course interest, and analytics. Where you use a third-party service we rely on (for example our course platform), that provider also processes your data under its own privacy policy. We name those providers in Sections 7 and 8. This notice is Aim For Behavior's policy for aimforbehavior.com; it is not replaced by any third-party provider's policy.

3. What personal data we collect

• Browsing / technical data: IP address, device and browser information, pages visited, approximate location, referring URLs, and security/server logs.
• Contact & inquiry data: when you complete a contact or consulting-inquiry form — your name, email address, organisation, role, and the description of the challenge you submit.
• Free-tool / diagnostic inputs: if you use a tool that captures responses, the answers you enter.
• Email subscription data: your email address, first name where provided, consent record, subscription status, source form, and engagement data when you join a waitlist, request a resource, or subscribe to email updates.
• Course-interest data: course interest and, if you buy, purchase and access data handled by our course platform (Section 8).
• Email correspondence: whatever you choose to send us by email.

4. How we collect it

Directly from you (forms, sign-ups, emails) and automatically (server logs, and cookies/analytics where applicable — see Section 9).

5. Why we use your data (purposes)

• To operate, secure, and maintain the website.
• To respond to contact and consulting inquiries.
• To provide free tools and the resources you request.
• To send our newsletter and related updates where you have subscribed.
• To process and give access to courses you buy.
• To understand, in aggregate, how the site is used and to improve it.
• To comply with our legal obligations.

6. Lawful bases

We rely on legitimate interests (operating and securing the site, keeping server logs, and responding to an inquiry you start), consent (analytics and marketing cookies where required (see Section 9), and email subscriptions, waitlists, and requested-resource sign-up), performance of a contract (providing a course you purchase), and legal obligation (where applicable).

7. Service providers / processors

We use the following providers to help run the site and related services. The table describes the main function for which we use each provider.

Some of these providers are based outside the EU/EEA — see Section 14.

8. Courses and payments (Podia and Stripe)

Courses are sold and delivered through Podia at courses.aimforbehavior.com. When you sign up for or buy a course, Podia processes your account, checkout, payment, and course-access data under its own privacy policy. Card and payment information within the Podia checkout is processed by Stripe.

Podia's privacy policy applies to your use of Podia's services. It does not replace this Aim For Behavior privacy notice, which covers aimforbehavior.com, our contact and consulting forms, analytics, newsletter sign-up, free tools, and direct communications with us.

• Podia privacy policy: https://www.podia.com/privacy
• Stripe processes payment card information within the Podia checkout under Stripe's own terms and privacy policy.

9. Analytics and cookies

Our website is currently migrating between two surfaces, and the analytics in use differs between them during the migration:

• Legacy pages (served by Squarespace) currently use Google Analytics (GA4) to measure site usage. Google Analytics sets analytics cookies and processes usage data (including your IP address) through Google, which is US-based (see Section 14). This applies to the parts of the site not yet migrated.
• New pages (served by Cloudflare Pages) will use Cloudflare Web Analytics as their analytics provider — a privacy-preserving, cookieless service that does not set analytics cookies, does not fingerprint visitors, and does not track visitors across websites; it reports only aggregate metrics such as page views, referrers, and approximate location. We are introducing it on the new surface as part of the migration; it is not yet active across the whole site.

This is a temporary, migration-state arrangement. Our intended end state is Cloudflare Web Analytics only, cookieless, across the whole site. Once the legacy Google Analytics surface is retired, we will remove Google Analytics and update this notice to drop the Google/GA4 references.

• The site also uses strictly-necessary cookies for security and core functionality (for example, Cloudflare's security/bot-management protections). Cookies that are genuinely strictly necessary do not, as a rule, require consent.
• Because Google Analytics is still in use on the legacy surface during the migration, analytics cookies are set on those pages. This notice explains the analytics and cookie position during the migration. It does not itself create a cookie-consent mechanism. Any consent requirements for analytics cookies on legacy pages remain a separate migration/compliance action until those pages are retired or updated.

This section describes our current and intended approach in good faith. It is not, by itself, a statement of legal compliance. We will keep this section aligned with the analytics actually running on each surface as the migration proceeds.

10. Newsletter and marketing

When you join a course waitlist, request an email resource, or opt in through one of our tools, we use Kit to record your consent, run double opt-in, and send the emails you requested. Our general newsletter currently uses Substack. You can unsubscribe at any time using the link in any email, or by contacting us. Unsubscribing stops future email delivery but does not by itself delete the subscriber record; you can ask us to delete it.

11. Contact forms and consulting inquiries

When you submit a contact or consulting-inquiry form, we use your details to respond and, if relevant, to discuss working together. Website inquiries are delivered to our Microsoft Teams workspace so we can review and respond. Please share only what is needed to start the conversation. Do not include confidential, sensitive, or employee-identifying information in these forms unless we have explicitly asked you to do so through an appropriate secure channel; if a discussion needs that level of detail, we will arrange a secure method.

12. Free tools and diagnostic inputs

Some tools may ask you to enter information (for example, to think through a change challenge). As with our forms, do not enter confidential, sensitive, or employee-identifying information unless we have explicitly asked you to through an appropriate secure channel.

13. Data retention

We keep personal data only as long as necessary for the purpose it was collected, and we delete or anonymize it when it is no longer needed. In practice: contact and inquiry data is kept for the duration of the conversation and a reasonable follow-up period; email subscription and waitlist data while needed to manage the subscription or waitlist; consent, suppression, and relevant email history as needed to document and honor your choices; analytics data according to the provider's retention settings; and course/account data according to our course platform's policy. (Specific retention periods may be refined with a specialist; the principle above governs in the meantime.)

14. International transfers

Some of our providers are US-based or process data outside the EU/EEA — for example Cloudflare (hosting, security, and analytics), Google (Google Analytics on the legacy Squarespace surface, during the migration window only — see Section 9), Podia and Stripe (course checkout and payments), Substack (newsletter), Kit (email subscriptions and delivery), and Microsoft 365 (business email). Where personal data is transferred internationally, we rely on appropriate safeguards, such as the EU-US Data Privacy Framework and/or Standard Contractual Clauses, depending on the provider. (The Google / Google Analytics transfer is transitional and will be removed from this notice once the legacy surface and Google Analytics are retired.)

15. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, or object to our processing of your data; the right to data portability; and the right to withdraw consent at any time where we rely on consent. To exercise any right, contact us at privacy@aimforbehavior.com.

16. Complaints

If you have a concern we cannot resolve, you can complain to your data-protection authority. As we are based in the Netherlands, the relevant authority is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority).

17. Automated decision-making

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you through this website. (Any future Aim For Behavior diagnostic platform that might process client data is a separate, non-public service and is out of scope for this website notice; this notice will be updated before any such processing occurs on the public site.)

18. Changes to this notice

We may update this notice. The current version and its effective date will always be on this page. Effective date: 25 July 2026.