Privacy Policy

Who is responsible for your data

Benchley is used by businesses (our customers) for their staff. Who is responsible for data depends on what kind of data it is:

• Workspace data is what a customer and its team enter into Benchley. The customer is the controller of that data and Benchley is the processor, acting on the customer’s instructions. If your employer added you to a workspace, your employer is your first contact for questions about that data.
• Account and sign-in data is the data we need to run your account. For this data, Benchley is the controller.

Contact details are at the bottom of this page.

What we collect

• Account details: your name, your email address and your password. The password is stored only as a salted scrypt hash, so we cannot read it.
• Two-factor secret (optional): if you turn on two-factor sign-in, the secret is stored encrypted.
• Workspace data: whatever customers enter, such as people, projects, schedules, time logs, time off, rates and costs, notes and custom fields.
• Sessions: a record for each signed-in device, with a description of the device and browser and the time it was last seen.
• Audit log: a record of changes made in a workspace.
• API tokens: stored only as hashes, so we cannot show you a token again after it is created.
• IP address: the sign-up rate limit keeps the requester’s IP address for up to about a day. We do not otherwise store IP addresses.

Why we use it

We use your data to provide Benchley to you and your business under our contract with the customer. We also use it to keep the service secure and to prevent abuse, such as limiting repeated sign-up and sign-in attempts. That is our legitimate interest in running a safe service.

Cookies

We use only strictly necessary cookies: the sign-in session cookie, and a short-lived cookie used during two-factor sign-in. We do not use analytics, advertising or tracking cookies, so there is no consent banner. Before we ever add a non-essential cookie, we will update this policy and ask for your consent.

Selling, advertising and AI

We do not sell personal data, and we do not share it for advertising. Customer data is never used to train AI models.

Customers can connect their own AI assistants to Benchley through its MCP server or API, using their own tokens. That is the customer’s choice: the data flows only to where the customer sends it, and the assistant provider’s own terms apply once it gets there.

Who else handles your data

We use a small number of service providers to host Benchley. They are listed, with what they do, on the subprocessors page. Apart from them, we share personal data only if the law requires it.

How long we keep data

• Audit log: kept according to the workspace’s setting. The default is 1 year.
• Change events: 90 days.
• Webhook delivery logs: 30 days.
• Sessions: expire after 30 days.
• Sign-in attempt records: about a day.
• Everything else: for as long as the account or workspace exists.

When an account or workspace is deleted, its data is removed from the live database immediately. Copies in backups are removed when those backups expire under our database provider’s retention.

Your rights

You can ask for access to your data, correction of it, a copy of it (export), and deletion of it.

• Export and delete are self-serve on the Account page. Workspace owners can also export or delete a whole workspace in Settings.
• For anything else, email our contact address (coming soon). We reply within 30 days.

For workspace data, the customer is the controller, so we may pass your request to them. You also have the right to complain to your local data protection authority.

Security

Benchley is served over HTTPS. Passwords are hashed, two-factor sign-in is available, secrets are stored encrypted, sign-in and sign-up are rate limited, changes are recorded in an audit log, and access is controlled by roles. See the security page for more.

Children

Benchley is for business users aged 18 or over. We do not knowingly collect data from children. If you think a child has given us data, email us and we will delete it.

International transfers

Benchley is hosted on Vercel and Neon, which may process data outside your country.

Changes to this policy

If we make a material change, we will tell you in the app or by email before it takes effect. The date at the top of this page shows when the policy last changed.

Contact us

Questions, requests and complaints about privacy go to: