Privacy Policy

This policy describes how Douglas Anthony Silkstone, trading as Benson ("Benson", "we") handles personal data. Benson is a service for online stores. It plays two different roles, and this policy covers both.

Who is responsible#

• We're the controller for this website (trybenson.com), for people who join the waitlist or preview their store here, and for the accounts of the businesses that use Benson.
• We're a processor for storefront data. When a store uses Benson, the store decides what Benson measures on its site, and we process that data under our Data Processing Agreement. Shoppers should contact the store first about storefront data.

Contact: [email protected]. Address: Nademlejnská 600/1, 198 00 Prague – Hloubětín, Czech Republic.

What we collect#

From visitors to this website#

• We measure this site with Benson itself using a session-only id. With optional analytics on, PostHog and Google Analytics also measure page views and product actions. On this website, PostHog also records how you use the pages (scrolling, clicks and what appears on screen) as a session recording, with everything you type into a form hidden, so we can see where the site is unclear. We keep recordings for 30 days and never record visits made with optional analytics off. With optional analytics off, PostHog still counts page views and site actions anonymously, without cookies or other storage on your device: PostHog derives a visitor count from a hash that changes daily, and these visits are never linked to a person or an account, or sent to Google Analytics or any ad provider. We do this on the basis of our legitimate interest in knowing how many people use the site. With the separate ad measurement choice on, the Reddit Pixel, Meta Pixel, LinkedIn Insight Tag and X Pixel measure our ads where configured, and linked Google Ads can import consented GA4 sign-up, verified-install and paid-subscription events, using cookies and browser storage only where configured. The conversions APIs of Meta, Reddit and LinkedIn measure real accepted leads, verified registrations and paid subscriptions from our server. In the EEA, the UK, Switzerland, Brazil and Quebec, or if we can't tell where you are, both stay off until you allow them. Elsewhere both start on, and ad measurement starts off if your browser sends Global Privacy Control. Where this policy says consent for analytics or ad measurement, outside those regions it means you haven't turned it off. You can change either choice through Cookie preferences. See the Cookie Policy.
• Inside the Shopify admin, Benson's app measures page views and product actions with PostHog only, held in memory: it sets no cookie, uses no browser storage, and never loads Google Analytics or an ad pixel. It identifies you by your Benson account id, and stops if you turn analytics off in Benson. Installs, reinstalls, uninstalls, sign-ups made from Shopify and Shopify Billing subscriptions are recorded from our server as product events on your account, never with your store's address. In the regions above, Benson's Shopify onboarding asks the same two optional questions as our sign-up form. If you left your store's address on our site before installing from Shopify, we copy that visit's campaign tags (utm_ values only) into the record of where your account came from.
• If you join the waitlist: your email address, the store address you enter, campaign (UTM) tags from the link you arrived by, and whether you asked for product news. Sign-ups made before 28 September 2026 may also hold the result of a scan of that store's homepage.
• If you register for a webinar or its replay: your email address, the name you give (optional), your browser's time zone (so reminders show your local time), whether you asked for product news, whether you opened your watch link while the webinar was live, and any question you send (with the name you give). The player and chat come from YouTube and load when you press play.
• If you follow someone's Benson invite link (/invite/… or a link with ?via=): we set a functional bn_via cookie on trybenson.com and its subdomains for 30 days. It holds only the invite code, so that if you sign up you get the invite's offer and the person who invited you gets the credit. We count unique visitors to each invite link from a one-way hash of your IP address, browser and the date. The IP address and browser details themselves aren't kept.
• If you preview your store: the store address you enter. We fetch that store's homepage and icon to show them to you, keep the result for a day so we don't fetch it again, and don't link it to you.

From businesses that use Benson#

• Account details: name, email address, password (stored as a salted hash), two-factor settings, the workspaces you belong to, and your email choices (product news, and set-up tips).
• A record of what you agreed to: each time you accept the Terms, acknowledge the Privacy Policy, or make or change an email choice, we record which version or wording you were shown, what you chose, when, where in Benson you chose it, your browser's user agent, and a keyed hash of your IP address.
• Billing details, handled by Stripe or Shopify. We hold the plan, status and invoice references, not card numbers.
• Invites you send: your invite page (/invite/ and your code) is public. Anyone with the link sees your first name and profile photo, and your store name if you switch it on. We keep your invite code, a count of unique visitors to your link, the invites linked to it and any credit they earn.
• Invites you accept: if you sign up through someone's invite, we record which invite you used. The person who invited you sees your first name and last initial, when you joined, how your trial is going (when it ends and whether you've started paying) and the credit you earn them, which is a month of your plan at list price. They don't see your email address, your store or your invoices.
• Invite checks: to stop people inviting themselves, we compare the two accounts' billing (an invite billed to the same card account or Shopify store doesn't count) and email domains (invites between people at the same company are checked by our team before credit lands).
• Support emails and messages you send us.
• With optional analytics consent: account and workspace identifiers, product actions, and subscription events.

From storefronts (as a processor)#

• Events about shopping sessions: pages viewed, which extensions were detected (and, where the store turns it on, which were installed), what Benson hid, widget views and codes applied, and a random session id. Storefront events are designed not to include names, email addresses, postal addresses or phone numbers.
• IP addresses of storefront visitors are used to estimate the country and to rate-limit traffic. Storefront events don't include them.
• Order data from Shopify or the store's platform: order totals, discount codes used and the Benson session id.
• Email addresses shoppers give the store's widget to unlock a code, when the store turns that on.

Installed-extension check#

Stores can let Benson check whether a shopper has one of a short list of coupon and cashback browser extensions installed, even before the extension shows anything on the page.

• What it does. Each listed extension makes some of its own files available to every website. Benson asks the browser for one such file per extension. If the file loads, that extension is installed.
• Which extensions. Coupon, cashback and shopping-assistant extensions. The current list:

• Acorns Earn
• Aeroplan Shopping Button
• American Airlines AAdvantage eShopping
• Atmos Rewards Shopping
• Avast SafePrice
• Avira Safe Shopping
• Buyhatke
• buykers
• Capital One Shopping
• Cently
• Citi Shop
• CNET Shopping
• Comparador EscolhaSegura
• Coupert
• Coupon Hacker
• CouponBirds
• CouponCabin
• CouponDunia
• DealFinder by VoucherCodes
• Delta SkyMiles Shopping
• eBuyClub
• GoCashBack
• Hapitas Smart
• Hyyzo
• Ibotta
• iGraal
• Karma
• Klarna
• LetyShops
• Lumaly
• MaxRebates
• Megabonus
• Mr. Rebates
• Norton Coupons
• Octoshop
• PayPal Honey
• Phia
• Pie Shopping
• Poulpeo
• Price.com
• PriceBlink
• PriceBuddy
• Qantas Shopping Points-Prompter
• Quidco
• Rakuten
• RebatesMe
• RetailMeNot
• Shopilo
• Southwest Rapid Rewards Shopping
• SwagButton
• Tipli
• TopCashback
• Troywell
• Unbroke
• United MileagePlus Shopping
• Wanteeed
• Widilo

• Where it runs. In desktop Chrome and Microsoft Edge, once per visit, outside checkout pages.
• Legal basis. In the EEA, the UK and Switzerland the check runs after consent (the same analytics consent the store's banner asks for). Elsewhere it runs when the visitor appears to be outside those regions. Each store chooses whether the check is off, automatic, or only with consent.
• What's kept. The names of matched extensions, as part of the visit's events.
• How long. The same as other storefront events (see How long we keep it).

Why we use it#

Purpose	Data	Legal basis
Providing the service to businesses	Account, billing, storefront data	Contract; for storefront data, the store's instructions
Running the invite programme: offers, credit, showing inviters how their invites are doing, and self-referral checks	Invite codes and visitor counts, who joined through which invite, their stage and credit, billing and email-domain matches	Contract (the programme terms) and legitimate interests
Keeping a record of what you agreed to	Versions and wording shown, choices, time, user agent, IP hash	Legal obligation (showing consent) and legitimate interests (showing agreement to our Terms)
Sending waitlist emails	Email, store address	Your request (steps before a contract)
Webinar emails: confirmation, reminders, "we're live" and the replay	Email, name, time zone	Your request
Tips to help you set up and get value from Benson	Email (Loops)	Legitimate interests; opt out at sign-up, in settings or in any email
Product news, if you tick the box	Email (Loops)	Consent, which you can withdraw any time in settings or in any email
Security, abuse prevention and rate limits	Request metadata, transient IP	Legitimate interests
Optional website and product analytics	Page views, product actions, account and workspace identifiers	Analytics consent
Optional ad measurement	Public page visits, accepted leads, verified registrations, subscription value and currency, ad cookie and ad-click identifiers, IP address and browser information; a hashed account identifier for server conversions (Meta, Reddit, LinkedIn) and consented GA4 conversion events for linked Google Ads	Separate ad measurement consent
Improving Benson	Aggregated, de-identified statistics	Legitimate interests
Tax, accounting and legal obligations	Billing records	Legal obligation
Establishing, exercising or defending legal claims	Any of the above, as relevant	Legitimate interests

How long we keep it#

Data	Kept for
Raw storefront events and session summaries	90 days
Hourly analytics summaries	35 days
Daily analytics summaries	25 months
Order records and order summaries	25 months
Discount code summaries	25 months
Attribution records	25 months
Affiliate integrity cases and their evidence	25 months after the case is closed
Weekly leak scans	13 months
Edge traffic summaries	25 months
Experiment assignments	180 days after the experiment ends
Email delivery log	90 days
Workspace audit log	2 years
Staff access log	2 years
Workspace deletion records	2 years
Shopify privacy requests	2 years
Waitlist sign-ups (leads)	24 months, unless you create an account
Webinar registrations	24 months
Invite codes, invites and invite credit	While both workspaces exist
Invite link visitor counts	2 years after the link's last visit
Webinar questions	12 months
Widget email subscribers after deletion	30 days
Store scans from setup	90 days
Data export files	24 hours
Report export files	7 days

Account data, including the record of what you agreed to, is kept while the account exists. It may be kept longer where the law requires it or where we need it to establish, exercise or defend legal claims.

For optional server conversion measurement (Meta, Reddit and LinkedIn), saved browser matching context expires after six months, the random identifier that pairs a sign-up's browser and server events after 30 days, and pending delivery records after seven days. Google Ads receives the existing GA4 conversion events only while Google Ads measurement is configured and advertising consent allows it. Withdrawing ad measurement clears this context, the identifier and pending conversions when the consent change reaches our server.

Who we share it with#

We use these subprocessors to run Benson:

Subprocessor	Purpose	Data	Location
Railway Corporation	Application hosting, databases and queues	All service data (accounts, workspace settings, storefront events, orders)	EU (Netherlands data centre); US company
Cloudflare, Inc.	DNS, content delivery of the storefront script, file storage	Request metadata (IP address transiently), the public script, exports	Global edge network; US company
Resend (Plus Five Five, Inc.)	Transactional and notification email	Recipient email address, email content	US
Loops, Inc.	Lifecycle and product email (set-up tips, product news)	Account holder name and email, workspace name and role, plan and set-up progress	US (standard contractual clauses)
Stripe Payments Europe, Ltd.Workspaces that pay by card	Card payments and invoicing	Billing contact, payment details (held by Stripe), invoices	EU and US
Shopify International LimitedStores that install the Shopify app	App platform and billing for Shopify-installed stores	Shop domain, app subscription, order and discount data you let the app read	Ireland; global

For optional analytics on our own website and app, we use PostHog (EU project) and Google Analytics. These providers receive the analytics data described above when you allow optional analytics. PostHog also receives the anonymous, cookie-free visit counts described above when you don't.

Where configured, Google Ads imports the consented sign_up, installation_verified and purchase events from our linked Google Analytics property, and can show our ads to people who visited our site, using lists of visitors built in Google Analytics. Both happen only with ad measurement consent; without it, Google Analytics tells Google not to use your data for ads. Google signals stays disabled; click identifiers are kept in the page context only after ad measurement consent.

To measure our ads on Reddit, we use the Reddit Pixel and the Conversions API from Reddit, Inc. (US). With ad measurement consent, Reddit receives page visits, accepted leads, verified sign-ups (including those made from Shopify) and paid subscriptions through Stripe or Shopify Billing (with their value and currency), together with Reddit's own cookie and ad-click identifiers, your browser's IP address and user agent, and a one-way hash of the Benson account identifier where applicable. We don't send Reddit your email address or other contact details. Reddit also uses this data under its own privacy policy, for example to measure and target ads.

With the same separate ad measurement consent, we use Meta Pixel and the Conversions API from Meta. Meta receives public page visits and successful conversion events, browser and Facebook ad-click identifiers, IP address and user agent, and a one-way hash of the Benson account identifier where applicable. Paid subscription events include their value and currency. We do not send Meta email addresses, phone numbers, form contents, private dashboard URLs, query strings or private link tokens. Meta processes this information under its own Privacy Policy, including ad measurement and targeting. Prior analytics consent and marketing email consent do not give Meta permission to track you.

Where configured, we use the LinkedIn Insight Tag and LinkedIn's Conversions API with ad measurement consent. LinkedIn receives permitted public page visits, browser information and cookie identifiers. From our server it receives accepted leads, verified registrations and paid subscriptions (with their value and currency), together with LinkedIn's ad-click identifier, a one-way hash of your IP address and a one-way hash of the Benson account identifier where applicable. It can associate visits and conversions with LinkedIn members to measure advertising and build audiences under its Privacy Policy. We do not send LinkedIn form contents, contact details, private dashboard URLs or private link tokens.

Where configured, we use the X Pixel with ad measurement consent. X receives permitted public page visits and X click attribution identifiers from approved campaign URLs. X's automatic advanced matching is disabled, so we do not send X email addresses, phone numbers, postal addresses or form contents. X processes this information under its conversion tracking guidance and privacy policy.

We may also disclose data to professional advisers, to a buyer or successor if the business is sold or reorganised, or where the law requires.

International transfers#

Our main hosting is in the EU. Some subprocessors are based in, or can access data from, the United States. Where data leaves the UK or EEA we rely on adequacy decisions (including the UK–US data bridge and the EU–US Data Privacy Framework where the provider is certified) or on standard contractual clauses with the UK addendum.

Your rights#

Depending on where you live, you may have the right to ask to access, correct, delete or export your personal data, to object to or restrict how it's used, and to withdraw consent. Requests go to [email protected] and are handled within the time limits the law sets. Some rights have exceptions, for example where data is needed to meet a legal obligation or to establish or defend legal claims. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.

Security#

Sensitive fields are encrypted at rest, traffic is encrypted in transit, and access is limited and logged. No system is completely secure. See the security section of our Terms.

Changes#

This policy changes from time to time. The version date at the top shows the current one. Where the law requires it, account holders are told about material changes.