Ben

Privacy Policy

Effective 30 September 2026

In short

Ben only keeps what it needs to work: your account and the things you add yourself (cards, lists, your car, receipts, your contact card). We don't sell your data, we don't show adverts, and we don't use tracking or analytics cookies.

Your data is encrypted on our server (AES-256). Card numbers aren't visible even in the admin panel.

Who we are

Ben (benhome.app) is the controller of your personal data. For anything to do with your data, email [email protected].

What we collect and why

• Account: your email, your name (optional) and your password, stored only as a one-way hash. We need these to sign you in and to send password reset emails (contract, Article 6(1)(b) UK GDPR).
• What you add: cards (number, shop, note, label, expiry date, balance and stamps), card photos, shopping lists, your contact card and photo, your car (number plate and due dates), receipts, receipt photos and warranties. We keep them so we can show them to you (contract).
• Sharing and invites: the email addresses of people you share a card with or invite. We use them only for that share and for one invite email. Invites expire after 30 days.
• Notifications: the push address your phone gives us when you turn notifications on (consent; you can turn them off at any time).
• Security log: when and what happened in your account, IP address, approximate country and city (from Cloudflare), device and browser, language and technical request headers. It helps us spot misuse and sign-ins that aren't yours (legitimate interests, Article 6(1)(f)). We keep it for 180 days.

To recognise the shop when you scan a card, Ben builds summary patterns from cards across all accounts: the code type, length and the common start of the numbers (up to 8 characters, only when at least 2 different accounts share it). Full card numbers are never part of these patterns, and the match against your scanned code happens on your phone.

Your location for "Nearby cards" is only used on your phone and is never sent to us. Your camera is only used to scan codes and take the photos you choose to save.

Who we share it with

• Cloudflare: delivers and protects the connection to our site (your data travels encrypted).
• Google (Gmail): sends Ben's emails. If you sign in with Google or add a card to Google Wallet, Google receives what's needed for that.
• Google, Apple and Mozilla push services: deliver notifications to your phone (the content is encrypted).

Our server is in the European Economic Area, which the UK recognises as providing adequate protection for personal data. Where a provider is elsewhere, transfers are covered by the UK International Data Transfer Agreement or Addendum, or the UK Extension to the EU-US Data Privacy Framework.

Cookies and storage on your phone

We only use strictly necessary cookies: one to keep you signed in, a short-lived one when you sign in with Google, and one that remembers your country and language. Your browser also keeps your settings (theme, text size) and a copy of your cards so they work offline. We don't use analytics or advertising cookies, so there's no cookie banner.

How long we keep it

For as long as you have an account. When you delete your account (Profile > "Delete account"), we immediately delete your cards, photos, lists, contact card, car, receipts, notifications and log.

Your rights

• Access and portability: you can see all your data in the app and download your cards as a file (Profile > "Backup").
• Rectification: you can correct your data at any time.
• Erasure: Profile > "Delete account", or email us.
• Restriction and objection, and withdrawing consent (for example, for notifications).
• Complaints: you can complain to the Information Commissioner's Office (ico.org.uk), although we'd appreciate the chance to put things right first.

For any request, email [email protected]. We'll reply within one month.

Children

Ben is for people aged 13 and over. Under 13, a parent or guardian needs to give consent.

Changes

If we make significant changes to this policy, we'll let you know in the app or by email.