Privacy Policy

This Privacy Policy explains how Bentokai collects, uses, and protects personal data when you use this website and our platform at app.bentokai.com, including the optional bank-connection (open banking) features.

1. Who we are

Bentokai is operated by Umai Media, S.L. (VAT ESB26634485), Calle San Gerardo 50, 28035 Madrid, Spain ("Umai Media", "we", "us"). For the personal data described here, Umai Media, S.L. acts as the data controller. You can reach us at privacy@bentokai.com.

2. Information we collect

• Account & profile data: name, email, language and display preferences, and authentication data (passwords are stored only as salted hashes; passkeys where you enable them).
• Content you add: the accounts, brands, contacts, invoicing details and similar records you create in the platform.
• Bank account information: where you choose to connect a bank account, the balances and transaction history of that account (see section 3).
• Technical data: sign-in sessions, device and browser information, IP address and approximate location (country and internet provider, looked up at sign-in and shown on your Security page), and an activity log of actions taken in the panel, used for security and support.
• Email engagement: for the emails the platform sends you (invoice and support emails; security emails such as password resets are not tracked), we record delivery, whether the email was opened (a tracking pixel) and which of its links were clicked, with timestamps.

3. Bank account information and open banking

Bentokai's Treasury feature lets you connect your own bank accounts to view their balances and movements inside the platform. This access is:

• Explicitly authorised by you at your own bank. You authenticate directly on your bank's or provider's page; we never see or store your online banking credentials.
• Read-only. We retrieve account details, balances and transactions only. Bentokai does not initiate payments or move money.
• Provided through licensed account-information service providers (AISPs), Enable Banking and, where applicable, GoCardless Bank Account Data, which are regulated to provide open-banking access under PSD2. They facilitate the connection to your bank on your instruction.

The imported balances and transactions are used solely to display your financial information within your Bentokai workspace and are visible only to users you have granted access to that brand.

4. How we use your data and our legal bases

• To provide the service you have signed up for (performance of a contract).
• To connect and display your bank data (your explicit consent, which you can withdraw at any time by disconnecting the account).
• To keep the service secure: authentication, fraud prevention, and the activity log (our legitimate interest in operating a secure service).
• To read documents you import: when you import an invoice PDF and it cannot be read automatically, an extract of its text (up to the first ~12,000 characters) is sent to our AI provider (Anthropic) to identify the invoice fields, solely to complete the import you requested. The same provider powers optional interface translations.
• To measure email engagement: delivery, opens and link clicks on platform emails (our legitimate interest in confirming that transactional email reaches you).
• To comply with legal obligations where they apply.

5. Sharing and processors

We do not sell personal data. We share it only with service providers acting on our behalf under appropriate agreements, and only as needed to deliver the service:

• our hosting provider;
• the open-banking providers named in section 3, when you connect an account;
• Anthropic, PBC (United States): processes extracted invoice text when you use the PDF import described in section 4, and the text of catalog and help-content translations;
• ip-api.com: receives your IP address at sign-in to provide the country and internet-provider information shown on your Security page.

6. International transfers

Your data is primarily processed within the European Economic Area. The providers of AI document extraction and sign-in location lookups named in section 5 process data in the United States; for these and any other transfer outside the EEA we rely on appropriate safeguards such as the European Commission's standard contractual clauses.

7. Data retention

We keep your data for as long as your account is active and as needed to provide the service. When you disconnect a bank account, its stored balances and transactions are removed from that connection. You can ask us to delete your account and associated data as described below.

8. Your rights

Under the GDPR you have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent at any time. To exercise these rights, contact privacy@bentokai.com. You also have the right to lodge a complaint with your local data protection authority (in Spain, the Agencia Española de Protección de Datos).

9. Security

We protect data with encryption in transit, hashing of credentials, and encryption at rest for sensitive fields such as contact details and connected financial credentials. Access is gated by per-user permissions.

10. Children

Bentokai is a business tool intended for use by authorised representatives of companies. It is not directed at children, and we do not knowingly collect personal data from anyone under 18.

11. Cookies

We use only first-party cookies that are strictly necessary to provide the service or that store a preference you chose, and no advertising or third-party tracking cookies. Each cookie, its purpose and its lifetime are described in our Cookie Policy.

12. Changes to this policy

We may update this policy from time to time. Material changes will be reflected here with an updated effective date.

13. Contact

Questions about this policy or your data: privacy@bentokai.com, or by post to Umai Media, S.L., Calle San Gerardo 50, 28035 Madrid, Spain.