Privacy Policy

We collect three categories of data:

• Account information.When you sign in with Google, we receive your name, email address, profile picture URL, and a Google account identifier (“sub”). We do not receive your Google password.
• Product usage. API keys you create, request metadata (verdict, score, latency, timestamp, model version), dashboard activity, and coarse network information (IP address, user agent) for security and billing.
• Scan content. The text, tool output, or message body you submit to our classification endpoints, plus the role and source tags you attach. Storage of this content is controlled by the Telemetry logging setting described below.

Every organization has a Telemetry logging toggle at Dashboard → Settings. When turned off, we store only the metadata described above — the raw input text, tool output, and message content you send to our scan endpoints are not persisted. The toggle applies to future scans only; past records are not retroactively affected but can be deleted on request (see section 7).

For customers on an Enterprise plan, Benchspan does not use your scan content, prompts, tool outputs, or other inputs to train, fine-tune, evaluate, or otherwise improve our shared classification models. Enterprise data is used only to operate the service for you, debug issues you report, and produce aggregated, non-identifiable metrics. Custom model training for an individual enterprise customer is available only under a separately signed data processing agreement that scopes data use to that customer’s own deployment.

For free and standard plans, retained scan content may be used in aggregate and in de-identified form to evaluate and improve our classifiers, unless you opt out via the telemetry toggle.

• Operate and maintain the service (authentication, API calls, dashboard metrics).
• Secure the service (detect abuse, investigate incidents, enforce rate limits).
• Communicate about your account, outages, and material product changes.
• Improve classifier accuracy for non-Enterprise customers when telemetry is enabled.
• Comply with legal obligations and respond to lawful requests.

Account records and request metadata are retained while your account is active. Scan content is retained when telemetry is enabled; when telemetry is disabled in your settings, it is not stored in the first place. API keys are stored as one-way SHA-256 hashes and cannot be recovered after creation; the raw key is shown to you exactly once. You may request deletion of your account and associated data at any time (see Section 6).

You may access, correct, export, or delete your personal data by emailing founders@benchspan.com. We honor verified requests within 30 days. Users in the European Economic Area, the UK, California, and other jurisdictions with applicable laws have additional rights (including lodging complaints with a supervisory authority); we honor those too.

We transport all data over TLS. API keys are stored hashed; session cookies are HTTP-only and signed. Scan content, when retained, is encrypted at rest. Access to production data is limited to employees whose roles require it. No service is immune to every attack; if you believe you have found a vulnerability, email founders@benchspan.com.

Benchspan is a business product not directed to individuals under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

We operate in the United States. If you access the service from outside the U.S., you consent to the transfer of your information to the U.S. and other countries where our service providers operate.

We may update this policy as the product evolves. If we make material changes we will update the “Effective” date above and notify account owners by email. Continued use of the service after changes take effect constitutes acceptance of the updated policy.

Known Quantity Labs, Inc.
Email: founders@benchspan.com