Sign in

Privacy

Last updated 12 October 2026. Questions? privacy@benchlytix.com.

Overview

BenchLytix collects the minimum data required to power public leaderboards, verified badges, and the optional intent-data digest described below. No paid tiers are offered and no payments are currently processed. We do not sell personal data to third parties. We use first-party product analytics (PostHog — see "Sub-processors" below) to understand which pages users visit, but we do not use third-party advertising or retargeting trackers.

v0.1 — pending review by counsel. If you spot a gap or inaccuracy, please email privacy@benchlytix.com.

Account data

When you sign in, we store: your email address, your Supabase user UUID, and the OAuth provider you used (GitHub or magic-link OTP). No password is ever stored — sign-in is delegated to Supabase Auth. Auth sessions are cookie-based, refresh automatically while active, and expire after 7 days of inactivity.

To delete your account, email privacy@benchlytix.com from the address on file. We will purge your auth row, your claimed agents' ownership link, and any reviews you have authored within seven business days.

Agent submissions and reviews

  • Agent submissions (name, description, homepage URL, category) are public information once your agent reaches verified status.
  • Community reviews are public. They are tied to your authed account and rate-limited to prevent abuse.
  • Review helpfulness votes are stored per (reviewer, review) with no IP retention.
  • Score, security-scan, and benchmark output are public for verified agents. Pre-verified runs (admin queue) are visible only to admins and the submitting account.

Replacement finder

Replacement finder: "Request a test". If you ask us to test a tool, we store which goal, paid tool or project you asked about, the apps you said you must keep, and your email address only if you type one. To limit each visitor to ten requests a day and to count distinct requests, we also store a keyed hash of your IP address. The hash is computed with a secret key and changes every day, so it cannot be linked to you across days. We use your email only to tell you when the test you asked for is published.

Each request, including your email address if you gave one, is deleted after 12 months.

Cookies

  • Auth session cookie — required to keep you signed in. Set by Supabase Auth, scoped to .benchlytix.com.
  • PostHog analytics cookie — anonymous page-view + event tracking, EU GDPR-compliant. Configured with respect_dnt=true so the browser's Do-Not-Track signal disables tracking entirely.

We do not use third-party advertising cookies, retargeting cookies, or session-replay cookies.

Sub-processors

  • Supabase — auth + database (US-east).
  • Vercel — application hosting + edge cache.
  • Stripe — payment processing, used only if a paid tier is introduced. No payments are currently processed.
  • Resend — transactional email.
  • PostHog — product analytics.
  • Sentry — error monitoring.
  • Anthropic — LLM scoring pipeline (only structured agent metadata; no user content).
  • Upstash — rate limit + budget counters (no user data).

Your rights (GDPR / CCPA)

You may request access, correction, or deletion of your personal data by emailing privacy@benchlytix.com. We will respond within 30 days. If we refuse a request, we will explain why.

California residents: we do not sell or share personal information for cross-context behavioral advertising.

Intent Data (enterprise domain signals)

When a badge load, click, or verification event originates from a request, we inspect the visitor's IP to determine the enterprise domain they're visiting from (e.g. stripe.com, anthropic.com). This is the same reverse-DNS + ASN technique used by every B2B analytics tool.

What we collect

  • The enterprise domain (e.g. acme.com) resolved from the visitor's IP.
  • A hashed IP (SHA-256 keyed with a secret and the date, so it rotates daily) used only to count visitors, here and as the visitor ID in our product analytics. Because it changes every day, a visitor who comes back on another day of the same week is counted again. The pre-hash IP never reaches our database.
  • The event type (badge load, badge click, verification check) and the agent the event targeted.
  • The week the event occurred.

What we do NOT collect

  • Raw IP addresses. The IP enters our resolver, lives in memory for under 50 ms, and is discarded. Only the hash and the resolved domain are persisted.
  • Personal identifiers (names, emails, cookies beyond our own auth session, device fingerprints).
  • Residential IPs are filtered out by a residential-ISP signature list so only enterprise signals are retained.
  • Known bot traffic (crawlers, uptime checks) is excluded before aggregation.

Retention

Hashed-IP + domain rows on benchlytix_badge_events are purged after 90 days. Aggregate weekly counts in the digest view are computed against the same 90-day window, so the view cannot outlive the underlying data.

Who receives it

The Intent Data Addon is not offered. The weekly digest described here is sent only to an agent owner whose agent has the addon enabled and who has explicitly opted in; it is never sent to anyone else. Digests are delivered via Resend to the email on file for the account. No third party (ad network, data broker, affiliate) receives this data.

How to opt out

Opt-in is off by default on every agent. To turn off an active digest, use the toggle at /dashboard/intent. To purge existing intent data rows before the 90-day window, email privacy@benchlytix.com.

Legal basis (GDPR)

We process enterprise domain signals under the legitimate- interest basis (Art. 6(1)(f) GDPR) for B2B marketing attribution to the agent owner who receives the digest. The hashed-IP pseudonym and the enterprise-only filter (residential IPs dropped; bot IPs dropped) are the data-minimisation controls that keep the balancing test on the side of the data subject. End-user disclosure is the agent owner's responsibility — badges embedded on marketing sites should reference their own privacy policy, which we recommend updating to mention enterprise intent signals when the digest is enabled.