What B.E.N knows

Account identity

Your email address and name. If you set a password, only a one-way hash of it is stored, never the password itself. If you sign in with Google or Slack, the account identifier, name and email address they return. Sign-in links are one-time tokens that expire.

Sessions

For each signed-in session, which lasts up to 90 days: when it started and was last used, when it expires, and the browser user agent and IP address it came from. These are used to keep you signed in and to detect abuse, such as many new accounts created from one address.

Where you signed up from

When your sign-up creates an account: the campaign tags (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and the sign-up link you used, the referring site’s host and the page you landed on. Used for counting where sign-ups come from, and never for pricing, limits or trust.

Domains you add

Each host you add, whether you have proved ownership of it with a DNS record, and the outcome of each check. A site you added and never proved is stored as an unproven claim. If another company proves ownership of it, your claim is retired but kept in the history of any deal made through it.

Site metrics

Domain rating, organic traffic estimate, topic, entity type, country and language, and the time each figure was fetched. These come from third-party SEO data providers, not from anything installed on your site. B.E.N does not measure your visitors.

Pages

URLs found on your sites through their sitemaps, with their title, placement kind and the number of outbound links already on them. Public pages only, read the way any visitor reads them.

Your deal rules, goals, limits and prices

The deal rules and minimums for each site, the deal modes you are open to, any partner you have excluded, each site’s goals and limits, whether your agent may approve deals for it, and your prices if a site sells. Partners never see your rules or limits. On paid placements, a buyer sees a price but not your domain until a deal forms.

Swap links

Your swap link settings (enabled, note, whether minimums show), counts of views and joins, and which companies joined through it.

Messages

What you and your agent write in a negotiation or on a deal, and which API key sent each message. Both sides see the conversation.

Negotiations

Every offer and counter-offer, including any price per link, who made it (you, or your agent and which API key), each response, and each approval with whether a person or an agent gave it. A note your agent leaves for you on an offer is visible only to your company.

Vouches and disputes

Vouches you give, with any note; only your company can read the note. Disputes you raise, with the reason, the written decision, and who at B.E.N made it.

Activity

When you or your agent last used B.E.N, and which API key last checked for new activity. Partners you can trade with see when you were last active, rounded to the hour.

API keys

Each key’s name, a short prefix, its access level, when it was last used, and a one-way hash. The full key is not stored.

Exchange records

Every deal and every obligation within it: which domain gives, which receives, the host page, the target URL, the agreed anchor text and rel value, any placement brief, the agreed price on a paid placement, the date promised, the current state, and when the link first went live.

Verification evidence

For each automated check of a placement: the time, the HTTP status, whether the link was found, the href, rel and anchor text actually observed, where in the page the link sat, how many outbound links surrounded it, whether the page was indexable and self-canonical, and the resulting verdict.

Billing

Your Stripe customer id; each top-up (amount, state, Stripe checkout and payment ids, who started it and when it was paid); each refund; each fee (the deal and link it belongs to, the price, rate, amount and whether it was reserved, charged, released, owed or waived); your wallet’s state; ledger entries for every movement of credit; founding seat records; and the id and type of each payment event Stripe sends. B.E.N does not receive or store your card number, your billing address or your tax id: Stripe collects and keeps those.

Anti-abuse signals

Counts of requests per key, person and company; which partner sites your company has been shown and when; a hash, length and first two characters of each directory search (never the search text); whether your account touched a decoy listing; and a resulting score. These are used to limit scraping and resale of the directory, and can lead to an account being throttled.

Email records

Your email preferences, time zone and muted partners, which notifications were sent to you and when, and any bounce, spam report or unsubscribe SendGrid reports (stored as a hash of the address), and SendGrid’s delivery events for recent messages.

Operational logs

Request identifiers, timestamps, endpoints and error types, kept so a fault can be traced back to the request that caused it. Access tokens, credentials and full response bodies are never written to a log.

• Sites added to B.E.N: robots.txt, sitemaps and the public pages they list, to build the page inventory described above.
• Agreed link pages: the host page of each agreed link, checked on a schedule while the link is expected to stand. The crawler stores what it observed about the link, not the page.
• The homepage preview: when someone types a site into the preview on this website, B.E.N reads that site’s sitemap and looks up its metrics and topic with third-party SEO data providers. The answer is cached for 24 hours (metrics for 30 days), and the request is logged as a hash of the site, not the site or the visitor’s address.

• No card details. Top-ups are paid on Stripe’s checkout page. Your card number never reaches B.E.N, and your billing address and tax id stay with Stripe.
• No deal money. The buyer on a paid placement pays the seller directly, outside B.E.N. B.E.N has no record of how or whether that payment was made.
• No readable password or API key. Both are kept only as one-way hashes.
• No visitor analytics on your site. B.E.N does not run script on your site and cannot see who visits it.
• No advertising cookies. The application sets only what is needed to keep you signed in. Google Analytics runs only if you click Accept on the cookie banner.

Account identity

For as long as the account is open. Within 90 days of the account closing it is deleted or anonymised, except what we must keep for legal, tax or accounting reasons or to prevent abuse.

Sessions

While the session is valid (up to 90 days), then for up to 12 months after it expires or you sign out, for security and abuse checks. Unfinished Google or Slack sign-ins are deleted a day after they expire.

Where you signed up from

Kept with the account, and deleted or anonymised with it.

Domains, metrics and pages

For as long as the site is listed. A removed site with no deals, negotiations or proof is deleted; one with history is retired and kept with that history.

Exchange records and verification evidence

For the life of the obligation, and afterwards as a historical record shared with the counterparty.

Billing records

Top-ups, refunds, fees and ledger entries are kept for 6 years after the end of the financial year they relate to, as UK tax law requires, including after an account closes. Ledger entries are never altered once written.

Short-lived records

Search traces: 48 hours. Request counters: 2 days after last use. Activity events: 90 days. Which partner sites you were shown: 90 days. Sent notification records: 90 days. Email delivery events from SendGrid: 30 days. Spam reports: 90 days. Homepage preview cache: 24 hours, and its site profiles and request log: 30 days.

Bounces and unsubscribes

Kept as a hash of the address for as long as we send email, so that we never email an address that bounced or opted out.

Operational logs

Kept short, long enough to investigate an incident.

• An agent sees what you see and nothing more. The tenant boundary is enforced in the database.
• What an agent may do depends on the key you give it: read only, propose and place, or autonomous. It approves deals only if its key may approve deals and the site allows it, and only inside your rules and limits. Topping up, refunds, managing keys and signing in stay with you in the web app.
• When your agent approves a deal, the deal records that it did and which key it used.
• Whatever you send to your agent goes to whichever model provider you have chosen. That relationship is between you and them; B.E.N is not a party to it and does not see it.

• Stripe: payments for top-ups, the checkout page, tax calculation, refunds and fraud screening. Stripe receives your card details, billing address, any tax id and your payment, and B.E.N sends it your company’s internal id and the top-up amount. Stripe processes card and payment data under its own privacy policy as an independent controller.
• SendGrid: delivers sign-in, security, billing and notification email. It receives your email address and the message.
• Google Analytics: measures how people use the website and console (pages viewed, sign-up steps), only if you accept analytics cookies. It receives your IP address, device and browser details and those page events; ad features are off. You can change your answer by clearing this site's storage in your browser.
• Google and Slack: identity at sign-in, if you choose it. B.E.N receives an account identifier, a name and an email address, and asks for no other access.
• Third-party SEO data providers: queried for metrics and topics of sites. They are asked about hosts, not about people.
• Hosting and database: the infrastructure the service runs on.
• The public web: the crawler fetches sites and agreed link pages as described above.

Some of these providers, such as Stripe, SendGrid and Google, process data outside the UK and the EEA. Those transfers rely on the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, or on an adequacy decision, including the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it. Details of the safeguards for a provider are available on request from [email protected].

B.E.N, last updated 16 September 2026. We may update this policy. Material changes will be announced in the application or by email before they take effect.