Privacy policy

1Who handles your data

This policy explains which data benflow processes, for what purpose, with whom it shares them and how you exercise your rights, in accordance with the Lei Geral de Proteção de Dados (Law 13.709/2018, LGPD, Brazil's General Data Protection Law).

• ally:code (ALLYCODE DESENVOLVIMENTO DO SOFTWARE LTDA., CNPJ 60.545.857/0001-19, Ourinhos, SP) is the controller of the registration and billing data of those who subscribe to benflow.
• For the content each company puts into benflow (tickets, messages, attachments and minutes), the subscribing company is the controller and ally:code acts as the processor, handling the data according to the company's instructions.
• Data protection officer: alexandre.luccia@allycode.com.br

2Which data we process

• Registration and subscription: name, email, company name, number of projects and subscription status. Phone and CPF or CNPJ, if you provide them.
• On the launch offer's free project: name, email, mobile number, company name, the IP address used at sign-up and the date you accepted these terms. The mobile number lets you sign in through Telegram, prevents more than one trial with the same number and lets us contact you about your account.
• Panel access: email, password (stored only as a hash, never as text), profile in each organization and access logs (date, time and IP address).
• Signing in by phone: when you request access, your company's bot sends a link and a code to your Telegram. We keep the date, IP address and browser of the request for up to 2 days.
• Tickets: titles, descriptions, comments, history, attachments (up to 20 MB per file) and meeting minutes submitted by link, file or text.
• Telegram: name, @username and ID of whoever talks to the bot; messages sent to the bot in private; and, in groups, messages that open a request (with a hashtag or a mention of the bot), reply to a ticket message or send minutes (a link or file with the word ata). All other group messages are ignored.
• Phone: only when the person chooses to share their phone number with the bot, to sign in to the panel or link the Telegram account to their registration.
• Audio: transcribed by Google's Speech-to-Text or on benflow's server (see Artificial intelligence and transcription). In groups, audio that is not a request is discarded immediately, without saving the transcription.
• AI Team: logs of each run (duration, turns, tokens and equivalent cost), work stage and evidence sent by the dev's agent, such as test results, screenshots and logs.
• Payment: Mercado Pago informs us of the subscription status and the billing identifiers. We do not receive card details.
• Browsing: pages viewed, where the visit came from, device, browser, approximate city and time of use of the site and the panel, measured by Google Analytics (see Cookies). Also the early steps, to know where the trial gets stuck: registration done, project created, Telegram bot connected, first ticket received (channel only) and subscription. In the panel, only the type of screen and these steps: without the organization's name, without the content of tickets and without what you type.

3What we use it for

• Providing the contracted service: login, panel, Telegram bot, notices, AI features and billing (performance of a contract, art. 7, V, of the LGPD).
• Complying with legal obligations: keeping access logs and billing documents (art. 7, II).
• Keeping benflow secure and running: preventing fraud and abuse and fixing errors (legitimate interest, art. 7, IX).
• Measuring visits and improving benflow: how many people visit the site and use the panel, where they come from and what works best (legitimate interest, art. 7, IX). With your consent (art. 7, I), we also measure our ad campaigns on Google and show benflow ads to people who have already visited the site (personalized ads).
• Contacting you about the account, billing and important changes to the service.

We do not sell personal data and do not use ticket content for advertising.

4Artificial intelligence and transcription

• To understand a request or read minutes, benflow may send the text to Claude, from Anthropic, which returns a title, sector, description, due date and task suggestions. Along with minutes, the names of the panel members are also sent, so the AI can suggest assignees. benflow also works without external AI, using simple rules. If your company prefers that nothing goes to Anthropic, contact us.
• Audio is turned into text by Google's Speech-to-Text (Google Cloud): the audio goes to Google only to be transcribed in Portuguese, and the text comes back to benflow. If Google is down, benflow's own server transcribes it, using whisper.cpp. This applies to Telegram audio, Record the request in New ticket, Record audio in text fields, the Claude Terminal and group audio.
• In the AI Team, Claude Code runs on the dev's machine, with their Anthropic account. The agent does not read .env files or secrets, uses only allowed commands, and its token is stored in the system's password vault. Anyone who connects OpenAI's Codex uses their own OpenAI account: Codex runs on the dev's machine, in a sandbox that only allows writing to the work folders, and what it reads in order to work goes to OpenAI through the dev's account.
• When the organization connects an Obsidian vault, the notes are indexed for search and consulted by the AI. The dev's personal vault is read only on their own machine.
• In the AI Team's Marketing, a piece's image can be generated by OpenAI, from the scene description, or fetched from Unsplash and Pixabay, using the search terms. The line illustration is drawn by the project's Claude, and the Brand references go to that Claude when an adjustment request or the research uses them (see Who we share with).

5Obsidian vault (Knowledge)

When a project admin uploads an Obsidian vault in AI Team, Knowledge, benflow treats the content of the notes as the subscribing company's content (it is the controller, and ally:code is the processor).

• What we store: the uploaded notes (.md), with the path of each one inside the vault, in two environments (staging and production), and the history of uploads and activations (date, who did it and which notes changed). Settings, plugins, attachments, hidden files and commercial notes (Privado and Comercial folders) are not stored.
• What we use it for: so the project's AI can consult the production notes when reading minutes and documents, analyzing cards and suggesting tasks, to show the network of notes on the Knowledge screen and for search. In these uses, only the relevant excerpts are sent along to Claude, from Anthropic (through benflow's server or through the connected Claude of someone on the project). If profiles, rules and notifications are missing, the project's connected Claude reads staging to build those parts (see Who we share with).
• Where it is stored: on benflow's server and, for the production vault, in a backup on ally:code's Google Drive (Google Workspace), updated every 15 minutes, in a separate folder per project. Only the team responsible for benflow accesses this backup, to recover the notes in case of failure and to support the project.
• What we don't do: we do not sell, do not use for advertising, do not use to train AI models and do not show to other clients.
• How to delete: in AI Team, Knowledge, use Delete the vault (or delete the project). The notes and history are removed from benflow immediately and from the backup within 30 minutes; the Google Drive trash is emptied within 30 days. Beforehand, you can download everything as a .zip.

6benflow Grupos extension (Chrome)

The benflow Grupos extension, for Chrome, brings into benflow the conversation of a group you open in WhatsApp Web. It is optional and only works after you install it and connect it to the panel.

• What it reads: the name of the open group and the messages already on screen (author, date and time, text and, for audio, the duration). It does not scroll the conversation, switch groups or send messages. No script is installed in WhatsApp Web.
• When it reads: when you click Capture now or, if you turn it on, automatically every X minutes, only in the chosen group. For automatic reading, Chrome asks for your permission for WhatsApp Web.
• Audio (optional): if you turn on Download and transcribe audio, the extension plays each new audio silently to download the file, which shows as listened to for the sender. The audio is sent to benflow and transcribed on the server, like any other audio.
• Where it goes: only to your company's benflow (benflow.net or the address you connected to), using a key created in the panel. The content appears in the Groups tab, where the AI flags requests and you choose what becomes a ticket, and it follows this policy's rules for panel content. We do not send it to third parties or use it for advertising.
• What stays in the browser: the benflow address, the project, the connection key and your choices (group, interval and audio). Without a connection, the conversation stays only in the browser session's memory, for a few minutes, until the benflow page fetches it.
• How to delete: click Disconnect the extension in its window (or remove the extension in Chrome) to erase the key and choices from the browser. Captures already sent stay in benflow until the project admin deletes the capture, in the Groups tab, and the retention rules below apply.

Be careful with group content: capture only work conversations and let the people in the group know. The extension is not a WhatsApp product and has no affiliation with it.

7benflow mobile app (iPhone and Android)

The benflow app shows your projects, the pipeline, chat, calendar and notices on your phone. It uses the same account and the same rules as the panel.

• Sign-in: with your mobile number, using the code your project's bot sends on Telegram, or with email and password. The app stores the session in the phone's protected storage (Keychain on iPhone, Keystore on Android) and erases it on Sign out.
• Microphone: it only records when you tap Dictate, to write a card's request. The audio goes to benflow, is turned into text by the same transcription used for other audio (see Artificial intelligence and transcription) and is not stored: only the text comes back, for you to check.
• Notices (push): if you allow notifications, the app generates a push address for the phone and benflow stores that address linked to your session. Each notice from the notifications bell (the title, an excerpt and the project) goes out through Expo's push service, which delivers it through Apple (APNs) or Google (Firebase Cloud Messaging). On Sign out, the address is erased and the phone stops receiving them.
• What the app does not do: it does not read contacts, photos or location, does not track you in other apps and does not show ads.

8Import from Gmail (your Google account data)

In Files > Import from Gmail, you can connect your Gmail to benflow to turn received emails into cards. It is optional and only works after you click Sign in with Google and authorize on Google's screen.

• What we access: your Google account address and, with Gmail's read-only permission (gmail.readonly), the emails in your inbox, to list the received ones so you can choose which to import. benflow does not send, delete, alter or mark emails as read.
• What we store: the account address and the access keys that Google provides, encrypted in our database. Of the emails, only those you select: sender, recipients, subject, date, body, attachments and the text of the attachments, which become a card or a Files item in the chosen project, and the ID of each imported email, to show what has already come in. The inbox list is read on the spot and is not stored.
• What we use it for: only to show your inbox in the benflow screen and to create the cards and files you asked for. We do not use Gmail data for ads, do not sell it, do not pass it to data brokers and do not use it to train or improve general artificial intelligence models. No one on the benflow team reads your emails, except at your request (for example, in support), for security reasons or when required by law.
• Who we share with: the card or file created is visible to the project's members, like any other panel content. If you choose Read with AI, the selected emails and the attachment text go to the project's AI (Claude, from Anthropic, through benflow's server or the project's connected Claude), only to suggest the cards. Nothing else leaves benflow.
• How to disconnect and delete: click Disconnect on the Import from Gmail screen. benflow revokes the permission at Google and erases the keys immediately. You can also remove the permission at myaccount.google.com/permissions (opens in a new tab). Cards and files already created stay in the project until someone on the project deletes them, and the retention rules below apply. To delete everything that came from your Gmail, contact us at alexandre.luccia@allycode.com.br.

The use and transfer to any other app of information received from Google APIs adhere to the Google API Services User Data Policy (opens in a new tab), including the Limited Use requirements.

benflow's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (opens in a new tab), including the Limited Use requirements.

9Marketing connections (Instagram, LinkedIn, Meta Ads, Google Analytics, Search Console and Hotjar)

In AI Team, under Marketing > Connections, the project admin can connect social and analytics accounts to benflow. It is optional, and each connection only exists after the person signs in to the service and authorizes on its screen (for Hotjar, with the API credentials the project pastes).

• Instagram (Meta): with the authorized professional account, we receive the account's ID, @handle, name, type and photo, and the permission to publish and to read the numbers of the posts. benflow only publishes the pieces that the project admin publishes or schedules, and reads reach, likes, comments, saves and shares only for the posts it made itself. At the time of publishing, the image sits at a public address with a hard-to-guess code, from which Instagram fetches it.
• LinkedIn: we receive the ID, name and profile photo of the person connecting and the permission to publish on that profile. When benflow is set up for Pages, we also receive the list of company Pages the person administers (the number, name, address and logo) and the permission to publish on them. benflow only publishes the pieces scheduled by the project admin, on the chosen profile or Page, and does not read posts, comments, followers or LinkedIn numbers.
• Facebook (Meta): with the Facebook account of the person connecting, we receive that person's ID and name, the permissions they granted and the list of Pages where they create content (the number, name, address and photo), with the permission to publish on the chosen Page and to read its numbers. benflow only publishes the pieces that the project admin publishes or schedules, on the chosen Page, and reads reach, views, reactions, comments, shares and clicks only for the posts it made itself, as well as the Page's followers and reach. It does not publish on the personal profile and does not read the Page's messages.
• Meta Ads (Meta): with the Facebook account of whoever manages the ad account, we receive that person's ID and name, the list of ad accounts they can see (the number, name, currency and company) and read-only permission for ads (ads_read). From the chosen account, we read the aggregated numbers for campaigns, ad sets and ads (spend, reach, impressions, clicks and results) and which Instagram post each ad boosts, to show in Marketing. benflow does not create, change or pause ads and does not receive data about the people who saw the ads.
• Google Analytics and Search Console: we receive the Google account's email and, with read-only permissions (analytics.readonly and webmasters.readonly), we read the aggregated reports of the chosen property and site (visits, sources, pages and searches), which appear in Marketing and feed into the project's research. benflow changes nothing in these accounts.
• Hotjar: with the project's API credentials, we read the site's surveys and responses. Heatmaps and recordings stay in Hotjar.
• What we store and for how long: the access keys that each service provides are encrypted in our database and do not go to the screen, to the AI or to the system's publishing; the account data above; the posts (the image, caption, date and post link); and the numbers read. The keys stay until someone clicks Disconnect; the rest, while the project exists (the retention rules below apply).
• What we use it for: only to publish what the project requested and to show the numbers in Marketing and in the project's research, which the project's connected Claude builds. We do not use this data for ads, do not sell it and do not pass it on to third parties.
• How to disconnect and delete: click Disconnect on the connection card, in Marketing > Connections: benflow erases the keys immediately. You can also remove the permission in the service itself: on Instagram, in Settings > Apps and websites; on Facebook (Page and Meta Ads), in Settings > Business integrations; on LinkedIn, in Settings > Data privacy > Permitted services; on Google, at myaccount.google.com/permissions (opens in a new tab); on Hotjar, by deleting the API key. What has already been published remains on the network until you delete it there.

10Who we share with

Only with those necessary for the service to work:

• Mercado Pago: processes payments and the subscription.
• Telegram: messages with the bot pass through the Telegram platform.
• Anthropic: receives the text of requests and minutes when the interpretation AI is turned on. Along with the minutes, the AI receives the names of panel members to suggest assignees. In Import from Gmail, it receives the emails you select for the AI to read (see Import from Gmail). In Marketing, the Brand references (the image, the note and what the AI saw) go to the project's Claude, the Claude Code of someone on the project, on their Anthropic account, when a piece adjustment request or the research uses them. When the project's AI is OpenAI's Codex, the same goes to OpenAI, through the ChatGPT account of whoever connected Codex.
• OpenAI: when the project uses Generate with AI on Marketing pieces, it receives only the image description (the scene, type, tone, brand colors and what to avoid) to generate the image, through the project's key or benflow's key.
• Unsplash and Pixabay: when the project searches for photos for Marketing pieces, they receive the search terms (for example, wooden table) and, on Unsplash, the notice that a photo was used, as the API rules require. Unsplash photos and search thumbnails are loaded directly from their servers, which receive the IP address and browser of whoever views the piece.
• GitHub: we query, read-only, the status of Actions and deploys of the repositories the organization connects.
• Meta (Instagram and Meta Ads), LinkedIn and Hotjar: when the project connects these accounts in Marketing, they receive the published pieces (the image and caption) and the requests to read the numbers (see Marketing connections).
• Google: when you paste the link to minutes in Google Docs or Drive, benflow downloads that document; when you connect Gmail, benflow reads your inbox only so you can choose the emails (see Import from Gmail). Audio goes to Google Cloud Speech-to-Text only to be turned into text (see Artificial intelligence and transcription). Obsidian vault notes have a backup on ally:code's Google Drive (see Obsidian vault). Google is also the processor for measuring visits to the site and the panel (Google Analytics) and, only with your Accept on the cookie notice, for measuring our campaigns and for personalized ads on Google Ads (see Cookies).
• Expo, Apple and Google (app push): when you turn on notifications in the mobile app, the device's push address and the text of each notice pass through Expo's push service and through Apple (APNs) or Google (Firebase Cloud Messaging), only to deliver the notice (see benflow mobile app).
• Resend: sends benflow's emails (password link, notifications, notices to whoever opened a ticket). The sending history stays with Resend for up to 90 days; the email content is deleted after 7.
• Hosting and infrastructure: providers that store the data on our behalf.
• Authorities: when required by law or a court order.

11International transfer

Some of these partners, such as Anthropic, OpenAI, Unsplash, Pixabay, Telegram, GitHub, Google (Google Analytics and Speech-to-Text, in the United States), Meta, LinkedIn, Hotjar and Resend, process data outside Brazil. In these cases, the transfer follows art. 33 of the LGPD, with partners that adopt adequate data protection safeguards.

12How long we keep it

• While the subscription is active, we keep the data so the service works.
• After cancellation, we delete or anonymize the data at the company's request or when it is no longer needed.
• Access logs are kept for 6 months, as required by the Marco Civil da Internet (Law 12.965/2014, art. 15, Brazil's Internet Civil Rights Framework).
• Browsing data in Google Analytics is kept for 14 months.
• Obsidian vault notes remain while the project exists and the vault is not deleted; the backup is removed within 30 minutes after deletion.
• The history of sent emails stays with Resend for up to 90 days; the content is deleted after 7.
• Billing data is kept for the period required by tax legislation.

13Security

• Encrypted connections (HTTPS).
• Passwords stored as hashes, never as text.
• Profile-based access: each person sees only the panels they belong to.
• The AI Team agent stores the token in the system's password vault and uses only allowed commands.

No system is completely immune to failures. If there is an incident that poses a relevant risk, we will notify you and the Autoridade Nacional de Proteção de Dados (ANPD, Brazil's National Data Protection Authority), as the law requires.

14Cookies

Cookies are small files that the browser stores. benflow's site and panel use these:

• Panel session (required): keeps you signed in after you log in. Without it, the panel does not work.
• Google Analytics 4 (visit measurement): the _ga and _ga_<id> cookies, which last up to 2 years, measure visits to the site and use of the panel. No ticket data, names, emails, phone numbers or anything you type is sent to Google, and page addresses go without tokens, codes or the organization name. Legal basis: legitimate interest (art. 7, IX, of the LGPD). You can decline in the cookie notice or, at any time, in Cookie preferences, in the site footer.
• Google ads: only with your Accept on the cookie notice (legal basis: consent, art. 7, I). They are used to measure and improve our campaigns on Google Ads and for personalized ads: with Accept, Google may show you benflow ads on other sites and apps, based on your visit (remarketing). If you are signed in to a Google account with ad personalization turned on, Google may also link the visit to that account (Google signals). Without Accept, they stay off, and you can change your mind at any time.

Anyone accessing from the European Economic Area, the United Kingdom or Switzerland only receives Google Analytics cookies after clicking Accept. Your choice is stored in your browser, and the panel respects the same choice. If you decline, Google Analytics stops immediately, including on the page that is open, and the site deletes from your browser the Google cookies that had already been saved.

Google processes this data as a processor, and it may be processed in the United States (see International transfer). In Google Analytics, data is kept for 14 months. Learn more in Google's Privacy Policy (opens in a new tab). To turn off Google Analytics across all sites, use the Google Analytics opt-out browser add-on (opens in a new tab).

15Your rights

Under the LGPD (art. 18), you may request at any time:

• confirmation that we process your data and access to it;
• correction of incomplete, incorrect or outdated data;
• anonymization, blocking or deletion of unnecessary data or data processed in violation of the law;
• portability of the data to another provider;
• information about whom we share your data with;
• withdrawal of consent, when consent is the basis for processing;
• review of decisions made solely by automated means.

To exercise any of them, write to alexandre.luccia@allycode.com.br. We respond within 15 days. If the request concerns the content of a subscribing company, we forward it to that company, which is the controller. You may also file a complaint with the ANPD.

16Children and teenagers

benflow is made for professional use, by companies and independent professionals, and is not intended for people under 18.

17Changes to this policy

We may update this policy. The date at the top shows the current version, and important changes are announced by email or in the panel.

18Contact

ALLYCODE DESENVOLVIMENTO DO SOFTWARE LTDA.
CNPJ 60.545.857/0001-19, Ourinhos, SP

• Email: alexandre.luccia@allycode.com.br