Privacy Policy

Effective 17 July 2026

This Privacy Policy explains how Bentokai collects, uses, and protects personal data when you use our platform at app.bentokai.com, including the optional bank-connection (open banking) features.

1. Who we are

Bentokai ("Bentokai", "we", "us") operates a business-management platform for companies and their brands. For the personal data described here, Bentokai acts as the data controller. You can reach us at privacy@bentokai.com.

2. Information we collect

• Account & profile data — name, email, language and display preferences, and authentication data (passwords are stored only as salted hashes; passkeys where you enable them).
• Content you add — the accounts, brands, contacts, invoicing details and similar records you create in the platform.
• Bank account information — where you choose to connect a bank account, the balances and transaction history of that account (see section 3).
• Technical data — sign-in sessions, device and browser information, IP address and approximate location, and an activity log of actions taken in the panel, used for security and support.

3. Bank account information and open banking

Bentokai's Treasury feature lets you connect your own bank accounts to view their balances and movements inside the platform. This access is:

• Explicitly authorised by you at your own bank. You authenticate directly on your bank's or provider's page — we never see or store your online banking credentials.
• Read-only. We retrieve account details, balances and transactions only. Bentokai does not initiate payments or move money.
• Provided through licensed account-information service providers (AISPs) — Enable Banking and, where applicable, GoCardless Bank Account Data — which are regulated to provide open-banking access under PSD2. They facilitate the connection to your bank on your instruction.

The imported balances and transactions are used solely to display your financial information within your Bentokai workspace and are visible only to users you have granted access to that brand.

4. How we use your data and our legal bases

• To provide the service you have signed up for (performance of a contract).
• To connect and display your bank data (your explicit consent, which you can withdraw at any time by disconnecting the account).
• To keep the service secure — authentication, fraud prevention, and the activity log (our legitimate interest in operating a secure service).
• To comply with legal obligations where they apply.

5. Sharing and processors

We do not sell personal data. We share it only with service providers acting on our behalf under appropriate agreements, including our hosting provider, and the open-banking providers named in section 3 when you connect an account. These providers process data only as needed to deliver the service.

6. International transfers

Your data is processed within the European Economic Area. Where any transfer outside the EEA is necessary, we rely on appropriate safeguards such as the European Commission's standard contractual clauses.

7. Data retention

We keep your data for as long as your account is active and as needed to provide the service. When you disconnect a bank account, its stored balances and transactions are removed from that connection. You can ask us to delete your account and associated data as described below.

8. Your rights

Under the GDPR you have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent at any time. To exercise these rights, contact privacy@bentokai.com. You also have the right to lodge a complaint with your local data protection authority (in Spain, the Agencia Española de Protección de Datos).

9. Security

We protect data with encryption in transit, hashing of credentials, and encryption at rest for sensitive fields such as contact details and connected financial credentials. Access is gated by per-user permissions.

10. Cookies

We use only the cookies strictly necessary to keep you signed in and to remember basic preferences. We do not use advertising or third-party tracking cookies.

11. Changes to this policy

We may update this policy from time to time. Material changes will be reflected here with an updated effective date.

12. Contact

Questions about this policy or your data: privacy@bentokai.com.