BENKOL

Privacy Policy

Last updated: April 10, 2026

1. Who We Are

Benkol ("we", "us", "our") operates the Benkol platform at benkol.ai. We are the data controller for the personal data processed through our Service. Contact: privacy@benkol.ai.

2. Data We Collect

Account data

Email address, name, and authentication credentials (or OAuth tokens for Google sign-in).

Content you upload

Reference images, brand materials, project briefs, and any other content you provide to the Service. This content is stored securely and used solely to generate content for you.

Generated content

Images, videos, carousels, and voiceovers created by the AI on your behalf.

Usage data

Credit consumption, feature usage, job history, and service interaction logs. This data is used for billing, service improvement, and support.

Technical data

IP address, browser type, device information, and cookies necessary for the Service to function. We use essential cookies only (authentication session). No third-party tracking cookies are used.

3. How We Use Your Data

  • Provide the Service: Process your inputs through AI models and deliver generated content
  • Billing: Process payments and manage your subscription via Stripe
  • Communications: Send transactional emails (welcome, generation notifications, billing alerts)
  • Support: Respond to your inquiries and troubleshoot issues
  • Improvement: Analyze anonymized, aggregated usage patterns to improve the Service

We do not: sell your personal data, use your content to train AI models without consent, or share your data with third parties for their marketing purposes.

4. Legal Basis (GDPR)

We process your data under the following legal bases:

  • Contract: Processing necessary to provide the Service you signed up for (Art. 6(1)(b))
  • Legitimate interest: Service improvement, security, and fraud prevention (Art. 6(1)(f))
  • Consent: Marketing communications, if any (Art. 6(1)(a))
  • Legal obligation: Tax records and compliance requirements (Art. 6(1)(c))

5. Third-Party Services

We use the following third-party services that may process your data:

  • Supabase (database and authentication) — hosted in the EU
  • Google AI / Gemini (AI content generation) — your inputs are sent to Google's API for processing
  • xAI / Grok (video generation) — image data sent for video creation
  • Stripe (payment processing) — billing and payment data
  • Resend (transactional email) — email address for sending notifications
  • Vercel (hosting) — technical data from web requests
  • Railway (backend hosting) — backend processing

Each provider processes data under their own privacy policies and data processing agreements.

6. Data Retention

  • Account data: Retained while your account is active, deleted within 30 days of account deletion
  • Uploaded content: Deleted within 30 days of account deletion or when you delete a project
  • Generated content: Same as uploaded content
  • Billing records: Retained for 7 years as required by tax law
  • Server logs: Automatically purged after 90 days

7. Your Rights (GDPR / CCPA)

You have the right to:

  • Access: Request a copy of all personal data we hold about you
  • Rectification: Correct inaccurate personal data
  • Erasure: Request deletion of your personal data ("right to be forgotten")
  • Portability: Receive your data in a structured, machine-readable format
  • Restriction: Request that we limit processing of your data
  • Objection: Object to processing based on legitimate interest
  • Withdraw consent: Where processing is based on consent, withdraw it at any time

To exercise any of these rights, email privacy@benkol.ai or use the data export and deletion features in your account settings. We will respond within 30 days.

8. Cookies

We use only essential cookies required for the Service to function (authentication session cookies managed by Supabase). We do not use advertising, analytics, or third-party tracking cookies.

If we add non-essential cookies in the future (e.g., analytics), we will update this policy and request your consent before setting them.

9. International Data Transfers

Some of our service providers (Google AI, xAI, Vercel) may process data outside the EU. Where this occurs, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) where required.

10. Children

The Service is not intended for anyone under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us to have it removed.

11. Security

We implement appropriate technical and organizational measures to protect your data, including encryption in transit (TLS), encryption at rest, access controls, and regular security reviews. However, no system is 100% secure.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email at least 14 days before they take effect. The "Last updated" date at the top indicates the most recent revision.

13. Contact and Complaints

For privacy-related questions or to exercise your rights: privacy@benkol.ai

If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority. In France, this is the CNIL.