Benly

GDPR overview

Benly never uses the word GDPR in its own legal pages, so compliance has to be read from the machinery it describes rather than from a claim. That machinery is substantial: a Data Processing Agreement built into the privacy policy, explicit Controller and Processor roles, legal bases listed purpose by purpose, the full set of data subject rights, EU Standard Contractual Clauses of 2021 with UK and Swiss addenda for transfers, adequacy under the EU-US Data Privacy Framework where available, assistance with data subject requests, breach notification and DPIAs, an annual audit right, and a published sub-processor list with thirty days' notice before changes. The publisher is established in France, so no Article 27 representative is required or named. Privacy contact: privacy@benly.ai. Both legal documents are dated 16 August 2025.

Who owns the data?

The terms of use state that the customer keeps all rights to Customer Data pulled from connected platforms and to the artifacts Benly generates from it, including reports, dashboards and insights. Benly receives only a licence to process that data in order to run the service. The vendor holds two distinct roles: it is Data Controller for the website, product telemetry, support and billing, and Data Processor for everything synced from Facebook Ads, Google Ads, TikTok Ads, GA4 or Shopify. A Data Processing Agreement published inside the privacy policy governs the second role. Benly states it does not sell personal data, and shares it only with its listed sub-processors, with tools the customer connects, with advisors or authorities when law requires, and with a successor in a corporate transaction.

Reuse rights

Because the customer retains ownership of both the imported data and the generated artifacts, reports, dashboards, exports and creative variations can be reused freely, including in client deliverables, without asking Benly for permission. The licence granted to Benly runs the other way: it is limited to operating the service. Two limits are worth noting. First, the customer remains responsible for having lawfully collected the data on the connected advertising platforms and for respecting those platforms' own terms, which the agreement explicitly places outside Benly's control. Second, the acceptable use clause forbids reselling or sharing access beyond the plan, reverse-engineering the service and using it to build a competing product. Benly may also use the customer's name and logo as a reference unless the customer opts out by writing to privacy@benly.ai.

Data retention & training

Hosting summary

Processing of Customer Data runs on OVHcloud infrastructure located in France, inside the EEA. Storage of account data, media and generated artifacts is handled by Amazon Web Services S3, either in the EEA or in the United States depending on the customer's region. Transactional email is sent through Brevo, hosted in the EEA. These three vendors are the declared Customer Data sub-processors. Two further providers are disclosed for transparency in Benly's Controller role: Plausible Analytics in the EEA for cookieless analytics, and Google and Microsoft Entra ID in the EU or the US for single sign-on. Transfers outside the EEA, the UK or Switzerland rely on EU Standard Contractual Clauses of 2021 with the UK addendum, or on an adequacy decision where one applies. Encryption is TLS 1.2 or higher in transit and AES-256 at rest. Consistently with the declared hosting, the website itself resolves to a French IP address on OVH's network in Dunkirk. The jurisdiction governing the contract is France.