Privacy Policy

This Privacy Policy explains how Bentokai collects, uses, and protects personal data when you use this website and our platform at app.bentokai.com, including the optional bank-connection (open banking) and social media features, the connector for AI apps and the API (at api.bentokai.com), and when you visit a website or use a page that one of our customers runs with Bentokai.

1. Who we are

Bentokai is operated by Umai Media, S.L. (VAT ESB26634485), Calle San Gerardo 50, 28035 Madrid, Spain ("Umai Media", "we", "us"). You can reach us at privacy@bentokai.com.

Where we are the controller. Umai Media, S.L. is the data controller for the personal data of the people who have a Bentokai account and use it (their account, profile and authentication data), for the security and technical data described in section 2, and for the data processed through this website. This policy mainly describes that processing.

Where we process data for our customers. The business data our customers put into Bentokai, such as their contacts, the clients and suppliers in their invoices and other records, the people who appear in the bank transactions they import, and the personal data of other people in the social media profiles they connect (such as the names and content in comments, reviews and messages), is processed by Umai Media on the customer's behalf, under the data processing agreement in section 12 of our Terms of Service. So is the data about the people our customers serve through Bentokai: the visitors to their websites, the people who search on them, and the people who subscribe to their status pages or use their support and project portals (see section 2). For that data, the customer is the controller and decides why and how it is used; we act only on its instructions.

2. Information we collect

• Account & profile data: name, email, language and display preferences, and authentication data (passwords are stored only as salted hashes; passkeys where you enable them).
• Content you add: the accounts, brands, contacts, invoicing details and similar records you create in the platform, and the supplier bills delivered by the integrations and email mailboxes a brand connects (to find bills in a mailbox, Bentokai reads the sender, subject and attachment details of its messages, and never changes the mailbox). The personal data of other people in these records, such as contacts, clients and suppliers, is business data we process on the customer's behalf (see section 1).
• Bank account information: where you choose to connect a bank account, the balances and transaction history of that account (see section 3). The people who appear in those transactions are part of the customer's business data (see section 1).
• Social media data: where a brand connects its social media profiles, the authorisation for each one, the profiles' public details, the content published through Bentokai, the performance statistics of the profiles and their posts and, if the brand switches on the inbox, the comments, reviews and messages they receive (see section 4, which also explains which of this data we process on the customer's behalf).
• Connected AI apps: where you connect an AI app to Bentokai through the connector described in section 7 of our Terms of Service, the details the app gives about itself (such as its name, its website, the addresses it returns to after you approve it and, for an app that registers itself with Bentokai, the IP address it registered from); a record of each connection (who made it, with which app, whether the app may make changes, where it returns to, when it was made and when it expires, and when it was last used and from which IP address), shown on your Security page, where you can end the connection; and the codes and tokens the app uses to reach Bentokai, which we store only as a one-way hash (SHA-256), from which they cannot be recovered. The IP address from which an app registers or asks for tokens is also used briefly to prevent abuse (rate limiting). What a connected app reads from Bentokai or changes in it, such as a brand's contacts or the reports of its web analytics, is the customer's business data (see section 1).
• API keys: for each API key created for a brand (see section 7 of our Terms of Service), its name, its access (read, or read and change), its brand, the person who created it (their name and email address, which stay with the key after they leave), when it was created, its expiry if one was chosen, and when and from which IP address it was last used. The key itself is kept only as a one-way hash (SHA-256) and its first 16 characters, from which it cannot be recovered, not even by us. The IP address from which each change is made with a key is recorded with that change in the activity log (section 8). When a request made with a key carries an idempotency key, a value that lets the customer's software repeat a request without creating the same contact or note twice, we keep a record that the request created that contact or note (identifiers and a hash of the request only, never its content), which is used for 24 hours and deleted within the following day. What the customer's software reads or changes through a key, such as a brand's contacts or the reports of its web analytics, is the customer's business data (see section 1).
• Technical data: sign-in sessions, device and browser information, IP address and approximate location (country and internet provider, looked up at sign-in and shown on your Security page), and an activity log of actions taken in the panel, used for security and support. Our web servers also log each request they receive, including those made by the visitors to our customers' websites and public pages (IP address, browser user agent, the address requested, the referring page and the time), for security and troubleshooting.
• Email engagement: for the emails the platform sends (such as invoice emails, support replies and scheduled reports; security emails such as password resets are not tracked), we record delivery, whether the email was opened (a tracking pixel) and which of its links were clicked, with timestamps. We also keep a record of every email the platform sends, including security emails: its recipient, subject and content, and whether it was sent. For the emails a customer sends to its own clients through Bentokai, such as invoices, these records are part of that customer's business data (see section 1).
• Data about the people our customers serve: where a customer uses the features below, we process, on that customer's behalf (see section 1), data about the visitors to its websites and the people who use its public pages. If you visited or used one of them, the customer that runs it is the controller and the first one to contact. On all of these pages and endpoints, the IP address is also used briefly to prevent abuse (rate limiting).
  • Web analytics: a script (the "tag") on the customer's website sends us, for each page viewed, the page's address and title, the referring page, any campaign parameters in the link (such as utm_source), the browser's language, the screen and window size and the time spent on the page and, where the customer enables it, the addresses of the links clicked. From the request we work out the type of device, the browser and operating system, whether the visit comes from an automated crawler, and the country, region and city. To count visitors without identifying them, we derive a visitor code from the IP address and the browser's user agent with a secret key that changes every day; each day's key is destroyed after two days, and from then on no one, including us, can link that day's codes to an IP address. The IP address itself is not stored with the analytics data. For the location, only the network part of the address (the first three of the four numbers of an IPv4 address, or the first 48 bits of an IPv6 address) is sent to ip-api.com. The tag sets no cookies and stores nothing on the visitor's device and, unless the customer has switched this off, a browser that sends the Global Privacy Control signal sends only an empty signal, which is counted without any other data. The data is stored in a database on our own servers (section 6).
  • Crawler detection: to count visits from automated crawlers, such as search engines and AI crawlers, the customer may also add an image to its pages or have its own server report the crawler visits it receives, with the page, the user agent and the IP address. We check each report against our own list of crawlers, and a crawler's claimed identity against the address ranges its operator publishes, and discard reports about people.
  • Page speed: a script the customer can add to its pages reports how quickly they load and respond for its visitors, and the type of device. It is kept only as counts per range of values and per day, with no page address, IP address, user agent or other identifier; visits from crawlers are discarded.
  • Site search: the terms that visitors typed into the search on the customer's website and how many times each was searched, read from the customer's own search server. We receive terms and counts, not who searched, although a term can contain personal data if a visitor typed it.
  • Search performance: the Google Search queries and pages through which the customer's website was found, with click and impression totals, as Google Search Console provides them; Google does not tell us who searched.
  • Status pages: the email address of anyone who subscribes to a customer's status page to be told about incidents (stored encrypted), whether they have confirmed the subscription, and the emails sent to them. Every notification includes a link to unsubscribe.
  • Support portal: when someone opens a ticket on a customer's support portal (at portal.bentokai.com) or through a form on the customer's website that sends it to Bentokai, their name, email address and, if given, phone number, the ticket's subject, the messages and attached images and, for a ticket sent from the customer's website, the technical details that website sends with it (such as the IP address, the browser's user agent and the referring page).
  • Project client portal: when a customer invites one of its contacts to follow a project on its portal, the invitation, when the portal was last used, and the comments and files the contact adds there.

3. Bank account information and open banking

Bentokai's Treasury feature lets you connect your own bank accounts to view their balances and movements inside the platform. This access is:

• Explicitly authorised by you at your own bank. You authenticate directly on your bank's or provider's page; we never see or store your online banking credentials.
• Read-only. We retrieve account details, balances and transactions only. Bentokai does not initiate payments or move money.
• Provided through licensed account-information service providers (AISPs), Enable Banking and, where applicable, GoCardless Bank Account Data, which are regulated to provide open-banking access under PSD2. They facilitate the connection to your bank on your instruction.

Accounts at Wise and Qonto can instead be connected directly through those providers' own interfaces, by signing in at the provider or with an API key you create there, which we store encrypted; this access is read-only too.

The imported balances and transactions are used solely to display your financial information within your Bentokai workspace and are visible only to users you have granted access to that brand.

4. Social media accounts

Bentokai's Social feature lets a business connect the social media profiles it manages so that it can publish and schedule posts, see how its profiles and posts perform and, when it switches on the inbox, read and answer comments, reviews and messages in one place.

How connection works. A user with permission on a brand connects a Facebook Page, an Instagram professional account, a LinkedIn company page or a Google Business Profile location through that platform's own authorisation screen, which shows what Bentokai is asking to access. We never see or store your password for that platform. The access can be revoked at any time, in Bentokai or at the platform (see "Disconnecting and deleting" below).

What we receive and store.

• The authorisation: the access and refresh tokens the platform issues (encrypted at rest), the permissions granted and when they expire, and the platform user id and name of the person who connected the profile.
• The connected profiles: each profile's id, name, username, web address, profile picture and follower count, refreshed daily while the profile is connected.
• Content to publish: the text, links, images and videos users create in Bentokai for publication, which are sent to the platform when the post is published, and afterwards the published post's id and link. Some platforms fetch images and videos from a web address instead of accepting an upload, so while a post is being published a temporary public copy of the file exists at an unguessable address, for at most 48 hours.
• Performance statistics: daily figures for each connected profile, such as views, reach, engagements, clicks and followers gained and lost (and, for Google Business Profile, figures such as calls, website clicks and direction requests), and figures for each post and Instagram story, such as views, reach, reactions, comments and shares. For each post we also keep its type, date and link, the first 280 characters of its text and, for Facebook and Instagram posts of the last 90 days, a small copy of its image. This includes posts made directly on the platform rather than through Bentokai. A background job copies these figures from the platforms, and Bentokai's pages and reports read that copy. The figures are totals: we do not receive the identities of the people counted in them, nor any breakdown of the audience by age, gender or location.
• Comments, reviews and messages, only for a brand whose manager has switched on the inbox, which is off by default (until then, none of them is read): the comments on the brand's Facebook, Instagram and LinkedIn posts, the direct messages sent to its Facebook Page and Instagram account (at most the 20 most recent messages of each conversation, which is all the platforms make available), and the reviews of its Google Business Profile locations, with their star rating. With each one we keep its text, when it was written or last edited, whether it has been hidden, and the author's public name or username as the platform provides it: for a Google review, the reviewer's name unless the review is anonymous; for LinkedIn, no name at all (the author appears as "a LinkedIn member"). For a direct-message conversation we also keep the platform identifier of the person writing, which is needed to answer them. We never store profile pictures, photos or other attachments, nor, for Google, a location's average rating or number of reviews. We also keep the replies that the brand's users write in Bentokai, which are sent to the platform, with who sent each one, when, and its status, as well as each conversation's status, the user it is assigned to and whether it has been read.

Scheduled statistics emails. If whoever manages a brand switches them on, Bentokai emails a weekly or monthly summary of the brand's statistics, with its top posts, to the users who have access to those statistics. Each recipient can stop receiving it at any time, on the statistics page or through the link in every email, which works without signing in. For LinkedIn posts the email shows only the figures, the type of post and its date, never its text or link. These emails are sent and recorded like the platform's other emails (section 2).

The inbox. The inbox exists only so that the brand's team can read and answer what people write to its profiles, hide or show comments on Facebook and Instagram, and keep track of which conversations have been dealt with. Replies are sent only when a user writes and sends them: Bentokai never replies automatically and does not use artificial intelligence to read, sort or answer what it receives. A direct message can be answered only within 24 hours of the person's last message. Inbox content cannot be exported and is not linked to the brand's contacts or other records. New comments, reviews and messages are announced to the brand's team by an in-app notification that gives only their number. The activity log records who replied to, hid or deleted which item and when, but never the text of a comment, review, message or reply.

Purpose. We use this data only to provide the features the brand's users asked for: publishing and scheduling posts, showing the performance of the profiles and their posts, including in scheduled emails, and reading and answering comments, reviews and messages. We do not sell it, use it for advertising, use it to build profiles of individuals or use it to train artificial intelligence models. We share it only with the platform itself, when a user publishes or replies, and, as needed to deliver the service, with the service providers named in section 6, such as our hosting provider. Within Bentokai, each part of it, such as the statistics or the inbox, is visible only to the users who have been given access to that part on that brand, to the account's owner, and to Umai Media's own platform administrators, who have access to every brand in order to operate and support the service.

Our role. For the account data of the person who connects a profile (their platform user id and name, and the authorisation itself), Umai Media acts as controller. For the personal data of other people that reaches Bentokai through a connected profile, such as the names and content in comments, reviews and messages from members of the public, or the people named or shown in the profile's posts, Umai Media acts as a processor on behalf of the business customer that connected the profile, under the data processing agreement in section 12 of our Terms of Service; that customer decides why and how the data is used.

If you commented on, reviewed or wrote to a business that uses Bentokai. The business that manages the profile you wrote to is the controller of your data and is responsible for having a legal basis for this processing, such as its legitimate interest in managing its social media presence and answering the people who contact it. If it has switched on Bentokai's inbox, we receive your comment, review or message from the platform where you wrote it (Facebook, Instagram, LinkedIn or Google), with the public name or username shown with it there, solely so that the business's team can read and answer it. We keep it only for the periods described below, and if you delete it on the platform, its text and your name are also removed from Bentokai once Bentokai detects the deletion (see below). To exercise your rights, contact that business, or write to privacy@bentokai.com and we will pass your request on to it and help it respond.

Data received from Google. Bentokai's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Our staff do not read this data unless the user has given permission (for example, to resolve a support request), it is necessary for security purposes, or it is required to comply with the law.

How long we keep it.

• Access tokens, profile details and statistics are kept while the profile is connected. When a profile is disconnected, its profile details, its statistics (with the copies of its posts kept for them) and its inbox data are deleted, and so are its access tokens once no other connected profile uses them. When a brand is deleted, all of its social media data is deleted.
• When access is revoked at Facebook or Instagram, Meta notifies us and we delete the tokens straight away. On any platform, a profile whose access has been revoked or has expired can no longer be used and stays marked for reconnection until it is reconnected or disconnected.
• A post's day-by-day figures for its first four weeks are deleted once the post is 35 days old; its latest figures are kept.
• Data received from LinkedIn: a post's text excerpt and link are removed once the post is 6 months old, and posts and statistics are deleted once they are 12 months old; images of LinkedIn posts are never copied. Where a platform's terms set a shorter limit for any data, we apply it.
• Inbox data. These periods run from the last time we received the item or, for a Facebook or Instagram conversation, from its last activity, so a conversation that becomes active again is kept for longer:
  • from Facebook and Instagram, each conversation is deleted, with its comments or messages, the names shown with them, the identifier of the person writing and the replies, 90 days after its last activity;
  • from LinkedIn, the text of each comment, including the brand's own replies, is deleted at most 48 hours after we receive it, and members' names are never stored;
  • from Google, each review's text, the reviewer's name and the star rating, and the brand's reply, are deleted at most 30 days after we receive them;
  • what is left of a LinkedIn or Google conversation once its texts have gone (identifiers, times and status) is deleted shortly after, once it has had no activity for about two weeks (LinkedIn) or about a month (Google);
  • when the author deletes a comment, review or message on the platform, its text and the author's name are removed from Bentokai as soon as Bentokai detects the deletion, usually the next time it reads that post; some deletions, such as that of a direct message, cannot be detected, and the periods above then apply;
  • switching the inbox off stops all reading, and what is already stored follows these same periods.
• Media uploaded for publication stays with its post until the post is deleted; temporary public copies are removed within 48 hours.
• Posts created in Bentokai, with the name of each profile they were published to and the link to the published post, stay in the brand's post history until the post is deleted, including after the profile is disconnected.

Disconnecting and deleting.

• In Bentokai: a user with permission disconnects a profile under Social → Profiles; its data is deleted as described above. Once nothing in Bentokai uses an authorisation any more, we also ask Facebook or Google to revoke it. For Instagram accounts connected directly with Instagram, and for LinkedIn, the platform offers no such request, so use its settings below.
• At Facebook: Settings & privacy → Settings → Business integrations, then remove Bentokai.
• At Instagram: Settings → Website permissions → Apps and websites, then remove Bentokai.
• At LinkedIn: Me → Settings & Privacy → Data privacy → Permitted services, then remove Bentokai.
• At Google: remove Bentokai's access in your Google Account at myaccount.google.com/permissions.

When you remove Bentokai at Facebook or Instagram you can also ask Meta to have your data deleted. Meta passes the request to us and we automatically delete the authorisations you gave and the profiles connected through them, with all their data, including their statistics and inbox content; Meta then shows you a confirmation code and a link to a page where you can check the status of your request. You can also ask us to delete this data by writing to privacy@bentokai.com: we complete the request within 10 days for data received from LinkedIn and within 30 days otherwise.

The platforms' own terms. Our access to each platform is governed by the Meta Platform Terms, the LinkedIn API Terms of Use and the Google API Services User Data Policy. What each platform does with your data is described in its own privacy policy: Meta, LinkedIn and Google.

5. How we use your data and our legal bases

This section describes the purposes and legal bases of the processing for which we are the controller. For the business data we process on our customers' behalf (section 1), such as the contents of imported documents or the data about the visitors to their websites, we act only on the customer's instructions to provide the features it uses, and the customer determines the legal basis.

• To provide the service you have signed up for (performance of a contract).
• To connect and display your bank data (your explicit consent, which you can withdraw at any time by disconnecting the account).
• To connect and use social media profiles: publishing, statistics, scheduled statistics emails and the inbox (performance of the contract with the business customer; for other people's data in those profiles, such as comments, reviews and messages, we act on the business customer's instructions, and the customer is responsible for having a legal basis for it, such as its legitimate interest in managing its own social media presence and answering the people who contact it; see section 4).
• To connect the AI apps you choose: signing you in, showing the consent screen, issuing and checking each connection's codes and tokens, and answering the app's requests with your own permissions (performance of the contract; for the customer's business data that a connected app reads or changes, such as its contacts, we act on the customer's instructions, given when the connector is switched on for a brand (by the customer or, at its written request, by us) and when a user approves a connection, and the customer is responsible for having a legal basis for disclosing that data to the provider of the AI app its users choose; see section 6).
• To authenticate and answer API requests made with a brand's keys (performance of the contract; for the customer's business data that they read or change, such as its contacts, we act on the customer's instructions, given when the API is switched on for a brand and a key is created for it (by the customer or, at its written request, by us); the data then goes to systems that the customer chooses and runs, and the customer is responsible for those systems and for what they do with it; see section 6).
• To keep the service secure: authentication, fraud prevention, the activity log (including when an AI app is connected or disconnected or an API key is created or revoked, and the changes made through them) and our web servers' request logs (our legitimate interest in operating a secure service).
• To read documents you import: when you import an invoice PDF, or a supplier bill or receipt as an expense, and it cannot be read fully automatically, we send our AI provider (Anthropic) the document's text (for an invoice, up to the first ~12,000 characters) or, for a photographed receipt, its image, to identify its fields, solely to complete the import you requested. The same provider powers optional interface translations.
• To measure email engagement: delivery, opens and link clicks on platform emails (our legitimate interest in confirming that transactional email reaches its recipient; for the emails a customer sends to its own clients, such as invoices, we do this on that customer's behalf).
• To comply with legal obligations where they apply.

6. Sharing and processors

We do not sell personal data. We share it only with the service providers below, which act on our instructions under appropriate agreements, and only as needed to deliver the service. For the business data we process on our customers' behalf (section 1), these providers are our sub-processors, engaged under the general authorisation in section 12 of our Terms of Service; we will update this list at least 30 days before adding or replacing one.

• OVH SAS (OVHcloud), 2 rue Kellermann, 59100 Roubaix, France: hosts the servers on which Bentokai runs and stores its data, including the web-analytics database, in the European Union;
• the open-banking providers named in section 3, when you connect an account;
• Google Ireland Limited / Google LLC (Google Workspace): Bentokai sends its emails through Google Workspace's SMTP relay service, which processes each email's recipients and content, including attachments; this covers invoices and payment reminders sent to your clients, notifications, scheduled reports, support replies, the emails of status pages and customer portals, and sign-in and security emails;
• Anthropic, PBC (United States): processes the text of the documents you import, or the image of a photographed receipt, when they need automated extraction as described in section 5, the text of catalog and help-content translations, and page-speed measurements when a user asks for an explanation of them;
• ip-api.com: receives your IP address at sign-in to provide the country and internet-provider information shown on your Security page (processing for which we are the controller) and, for customers that use web analytics, the network part of their visitors' IP addresses, to provide the country, region and city (section 2).

When you use the Social feature (section 4), the platform you connect provides the statistics, posts, comments, reviews and messages we read on your behalf, and receives the content you publish or reply with and the requests we make on your behalf: Meta Platforms Ireland Ltd. (Facebook and Instagram), LinkedIn Ireland Unlimited Company (LinkedIn) and Google Ireland Ltd. / Google LLC (Google Business Profile). These platforms are not our sub-processors: each handles that data under its own terms and privacy policy.

Connected AI apps. When a user connects an AI app to Bentokai (section 2), the app, and the company that provides it, receive what the app reads through that connection: for example the names, contact details, tax identification numbers, tags and notes of a brand's contacts, the names of the brands and of the account it can reach and, for the web analytics, the brand's traffic reports (counts by page, source, place and device, and the addresses of the links clicked: web addresses, and the email addresses and phone numbers of mailto:, tel: and sms: links), which identify no visitor, and, for the uptime monitoring, the names and targets of the brand's monitors, their states and uptime, its incidents with their notes and the names of the staff who wrote them, acknowledged an incident or were assigned to one, and, where the connection can change it, of those who could be assigned one, its maintenance windows and its status pages, and, for the site-speed measurements, the names and addresses of the brand's sites, their scores and measurements, the figures its visitors' browsers report about how fast its pages load, which identify no visitor, its deploy markers and its speed alerts, and, for the projects, their names, codes, dates and descriptions, their tasks, their comments (including the names of clients who wrote through the client portal), the names and roles of their team members, the hours logged on them (the person, the date, the duration and the note) and their budget summary, and, for the site-search analytics, the names of the brand's search connections and tracked indexes, the terms visitors searched for and how many times, which identify no visitor although a term can hold what a visitor typed, the indexes' sizes and the search server's performance and health. Bentokai sends this only in answer to requests that the app makes through a connection the user approved, and never on its own initiative. The app is chosen by the customer's user, not by us, and neither the app nor its provider is our sub-processor: each handles that data under its own terms and privacy policy, which the customer or the user accepts with that provider. This is separate from Anthropic's role in the list above: if a user connects Claude, what Claude reads reaches Anthropic as the provider that user chose, under the terms that govern the user's own use of Claude, and not as our sub-processor.

The API. Data read through an API key (section 2) goes to the systems of the customer that holds the key, at its request. Those systems are the customer's, or its providers', chosen by the customer: they are not our sub-processors, and the customer is responsible for them. A comment added with an API key stores the key's name as its author.

Public services and authorities. Some features send a request to a public service, which receives only what it needs to answer and is not our sub-processor. When the website icon of a contact, a supplier or a brand cannot be fetched from the website itself, our server asks Google's public favicon service (t0.gstatic.com) for it, which sends Google that website's domain name, for example example.com (for a contact, this can be the domain of their business email address), and nothing else about the contact or supplier. The Speed feature sends Google's PageSpeed Insights and Chrome UX Report services the public web addresses of the pages a customer asks it to measure. When a customer activates the submission of its invoicing records to the Spanish Tax Agency (VERI*FACTU), the records of the invoices it issues, including its clients' names and tax identification numbers, are sent to the Agencia Estatal de Administración Tributaria, which receives them as a public authority, as the law requires.

7. International transfers

The data Bentokai stores is kept on servers in the European Union (section 6), and your data is primarily processed within the European Economic Area. The providers of AI document extraction and of location lookups (at sign-in and for web analytics) named in section 6 process data in the United States, and our email provider, Google, may also do so; for these and any other transfer outside the EEA we rely on appropriate safeguards such as the European Commission's standard contractual clauses. The social media platforms named in section 6 may also process data in the United States; where that involves a transfer outside the EEA, it relies on the standard contractual clauses or, where the recipient is certified under it, the EU-US Data Privacy Framework. A connected AI app (section 6) and its provider may process what the app reads outside the EEA, for example in the United States. That data reaches them because a user connected the app and the app asked for it, not because we chose that provider, and the safeguards that apply are the ones that provider offers under its own terms; the customer is responsible for checking that they are adequate (section 7 of our Terms of Service).

8. Data retention

We keep your data for as long as your account is active and as needed to provide the service. When you disconnect a bank account, its stored balances and transactions are removed from that connection. Data from connected social media profiles follows the specific rules in section 4, including the shorter limits for data received from LinkedIn and Google and for inbox data. You can ask us to delete your account and associated data as described below.

The activity log (section 2) is kept for at least 24 months. For each brand, the customer can set how many months back its users can see the log, from 1 to 120 (12 by default); this setting limits only what they see. A daily clean-up deletes a customer account's entries once they are older than the longest period set on any of the account's brands, and never before they are 24 months old; entries that belong to no customer account are deleted after 24 months. Umai Media's platform administrators can see every entry until it is deleted.

An API key's record (section 2) is kept until the key is revoked or its brand is deleted: a key that has expired stops working, but its record stays until it is revoked. The key's own record keeps only the date and time of its most recent use and the IP address that use came from, overwritten as the key is used again (at most once a minute); the activity log separately records the IP address of each change made with a key (section 2). Idempotency records are used for 24 hours and deleted within the following day, and at once when their key is revoked. The request logs of the API's address, api.bentokai.com, do not record the query string of a request, and are otherwise kept only as long as needed for security and troubleshooting, like our other web servers' request logs.

For connected AI apps (section 2):

• An app's access lasts one hour at a time and is renewed with a token that is valid for 30 days and replaced each time it is used, so a connection that the app does not use for 30 days stops working. Every connection ends 90 days after it was made at the latest, after which the app has to be connected again. The codes used while connecting last two minutes and can be used only once.
• A connection is deleted, with its tokens, as soon as you disconnect it on your Security page or the app revokes it; when your password is reset or changed; when an administrator signs you out everywhere, changes your email address or deactivates your access; and when an eleventh connection replaces the one used least recently. After any other change to your email address, or while the account you belong to is switched off, it stops working and is deleted, at the latest, the next time the app tries to renew its access.
• A daily clean-up deletes expired codes and tokens and the connections that have passed their 90 days. The record of an app that no connection uses is deleted: for an app that registered itself with Bentokai, together with the IP address it registered from, 30 days after it was last used; for an app that publishes its details on its own website, 30 days after Bentokai last read them.

For the data about the people our customers serve (section 2):

• Web analytics: each page view and event is kept for the period the customer sets, from 1 to 800 days (365 by default), and then deleted; the daily totals built from them, which contain no visitor code or IP address, are kept until the customer's brand is deleted or the service ends. Each day's secret key is destroyed after two days, the location found for a network is kept for up to 90 days, and backups of the analytics database are kept for 7 days.
• Page speed and site search: for the period the customer sets, 24 months by default (up to 60 months for page speed and 120 months for site search). Search performance data: while the customer's website stays connected.
• Status-page subscriptions: until the person unsubscribes or the customer removes the subscriber or the page.
• Support tickets and project portal content: for as long as the customer keeps them in Bentokai, and at the latest until the end of the service (section 12 of our Terms of Service).
• Our web servers' request logs: only as long as needed for security and troubleshooting.

9. Your rights

Under the GDPR you have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent at any time. To exercise these rights, contact privacy@bentokai.com. You also have the right to lodge a complaint with your local data protection authority (in Spain, the Agencia Española de Protección de Datos).

You can end a connected AI app's access to Bentokai at any time by disconnecting it on your Security page (Security › Connected apps); the app can then no longer read or change anything in Bentokai. This does not delete what the app has already received, which is in the hands of the app's provider and governed by its own terms (section 6): to have it deleted, contact that provider.

Whoever manages a brand in Bentokai can revoke any of its API keys at any time on the brand's page; the key then stops working from its next request. This does not delete what the customer's systems have already received through the key, for which the customer is responsible.

If your data reached Bentokai as part of a customer's business data (section 1), for example because you visited that customer's website or used its portal, that customer is the controller and the one to contact; if you write to us instead, we will pass your request on to it and help it respond.

10. Security

We protect data with encryption in transit, hashing of credentials, and encryption at rest for sensitive fields such as contact details, status-page subscribers' email addresses, connected financial credentials and social media access tokens. Access is gated by per-user permissions.

11. Children

Bentokai is a business tool intended for use by authorised representatives of companies. It is not directed at children, and we do not knowingly collect personal data from anyone under 18.

12. Cookies

We use only first-party cookies that are strictly necessary to provide the service or that store a preference you chose, and no advertising or third-party tracking cookies. Each cookie, its purpose and its lifetime are described in our Cookie Policy. The web-analytics and page-speed scripts our customers add to their websites set no cookies and store nothing on their visitors' devices.

13. Changes to this policy

We may update this policy from time to time. Material changes will be reflected here.

14. Contact

Questions about this policy or your data: privacy@bentokai.com, or by post to Umai Media, S.L., Calle San Gerardo 50, 28035 Madrid, Spain.