PRIVACY POLICY

Last Updated: November 4, 2026

Benson Technologies LLC (“Benson,” “we,” “us,” or “our”) provides workforce, human-resources, compliance, communications, document, electronic-signature, screening, reporting, and related software and services for business customers in the United States. This Privacy Policy explains how Benson collects, uses, discloses, and protects personal information when you visit our website, communicate with us, request a demonstration, use a Benson account, or otherwise interact with Benson in a context where Benson determines the purposes and means of processing.

This Privacy Policy also explains an important distinction between information Benson processes for its own business purposes and information Benson processes on behalf of customer organizations. When a customer organization uses Benson to manage information about its workforce, contractors, communications, documents, or other records, that organization determines why the information is processed. In that context, Benson processes the information as a service provider, contractor, or business associate, as applicable, under the Benson Software-as-a-Service Customer Agreement and its incorporated addenda (the “Customer Agreement”).

1. SCOPE

This Privacy Policy applies to Benson’s United States website and services and to personal information for which Benson acts as the business or controller under applicable law. It does not replace the privacy notices or legal obligations of Benson customers with respect to information those customers control.

If you are an employee, contractor, applicant, clinician, signer, or other individual whose information was placed in Benson by an organization you work with, that organization is the controller of your information and is the appropriate first contact for questions or requests about it. Benson processes that information only on the organization’s instructions and will assist the organization as required by applicable law and our contractual obligations.

2. INFORMATION WE COLLECT

2.1 Information You Provide Directly

Depending on how you interact with Benson, we may collect:

• Business contact information, such as your name, work email address, telephone number, company or agency name, job title, and professional contact details.

• Demo, sales, and inquiry information, including information you submit through Contact Us, Request Demo, Book Demo, or similar forms and communications.

• Account and profile information, such as your name, email address, username, role, organization, account settings, authentication information, and permissions.

• Support and correspondence information, including messages, attachments, feedback, and other information you provide when communicating with Benson.

• Billing and subscription information, such as billing contact details, subscription status, transaction identifiers, and invoices. Payments are processed by Stripe, Inc. Stripe receives your payment-card details directly; Benson does not store full payment-card numbers.

2.2 Information Collected Through Use of the Service

When authorized users access or use Benson, we collect technical and usage information such as IP address, browser and device information, login and authentication events, timestamps, feature interactions, configuration activity, audit events, error and diagnostic information, and security-related events. Application errors are reported to Sentry, our error-reporting provider, and an error report may include fragments of the request that failed. We use this information to operate, secure, support, and improve the Service.

2.3 Customer-Submitted Information

Customers and their authorized users may submit personal information concerning employees, contractors, applicants or onboarding personnel, administrators, business contacts, recipients of communications or documents, and other individuals. Depending on customer use, this may include identifiers, contact information, employment and workforce records, professional credentials, compliance information, documents and attachments, communications, electronic-signature information, screening records, and other information selected by the customer.

Some customer-submitted information may be sensitive. For example, customers may submit Social Security numbers and other government identifiers, account credentials, health-related information, or the contents of communications. Customers are responsible for determining what information is appropriate and lawful to submit to the Service.

2.4 Information from Third Parties

We may receive information from organizations that use Benson, authorized users, service providers, our payment processor, connected services selected by a customer, publicly available sources, and other parties where permitted by law. Exclusion screening in the Service checks the names a customer enters against the United States Department of Health and Human Services Office of Inspector General List of Excluded Individuals and Entities and stores the result and the evidence of the check.

2.5 Connected Mailboxes

A customer may connect its own Microsoft 365 mailbox so that email from the Service is sent from the customer’s own address. When a customer does so, Benson receives the connected address, the account’s display name, and a send-only token. Benson uses the token only to send email the customer or its automations compose in the Service. Benson does not read, store, or synchronize the contents of the connected mailbox. The token is stored encrypted. Disconnecting the mailbox in Settings deletes the token from Benson; for a Google mailbox, Benson also revokes its grant with Google at that time, and for a Microsoft mailbox the Service directs the administrator to remove Benson’s access in the organization’s Microsoft account. Until a customer connects its own mailbox, email from the Service is sent by Benson’s delivery provider from the mail.bensonhr.com domain and displays the customer’s name followed by “via Benson.”

3. HOW WE USE PERSONAL INFORMATION

We may use personal information to:

• Provide, operate, administer, maintain, and support Benson and its requested functionality.

• Create and administer customer organizations, accounts, permissions, authentication, and user access.

• Respond to inquiries, schedule and provide demonstrations, communicate with customers and prospects, and manage business relationships.

• Process subscriptions, billing, payments, renewals, and related records through our payment processor.

• Provide customer-configured communications, document workflows, electronic-signature functionality, compliance tools, exclusion screening, reporting, and other Service features.

• Provide automated document reading, extraction, and classification when a customer enables it.

• Protect the security, integrity, availability, and reliability of Benson; detect and prevent fraud, abuse, unauthorized access, and other harmful activity.

• Troubleshoot, maintain, analyze, and improve the quality and performance of the Service.

• Comply with law, enforce agreements, establish or defend legal claims, and protect the rights, safety, and property of Benson, our customers, users, and others.

Benson does not use personal information to train artificial-intelligence models. Automated document reading is performed through Anthropic’s application programming interface; Anthropic is contractually prohibited from using the content Benson submits to train its models.

4. HOW WE DISCLOSE PERSONAL INFORMATION

We may disclose personal information in the following circumstances:

4.1 Service Providers and Subprocessors

We disclose personal information to the service providers that host, secure, operate, support, deliver email for, process payments for, and provide automated document reading within Benson. Each is located in the United States and may process information only for the purpose Benson engages it for. Our current providers are Supabase (database and file storage), Vercel (application hosting), Anthropic (automated document reading), Resend (email delivery), Stripe (payment processing), and Sentry (error reporting). The current list, with each provider’s purpose and location, is published at bensonhr.com/legal/subprocessors.

4.2 Customer-Directed and Authorized Disclosures

We disclose information when a customer or authorized user directs us to do so, such as when sending a communication, routing a document for signature, connecting a mailbox, or sharing information with another authorized user or recipient.

4.3 Legal, Safety, and Security Purposes

We may disclose information when we reasonably believe disclosure is required by law or legal process, or is reasonably necessary to protect rights, investigate fraud or security incidents, prevent harm, or enforce our agreements.

4.4 Business Transactions

If Benson is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, personal information may be disclosed as part of due diligence or transferred as part of the transaction, subject to applicable law.

4.5 With Your Direction or Consent

We may disclose information for other purposes when you direct us to do so or provide legally valid consent.

4.6 Google API Services

Benson does not currently offer a Google mailbox connection. If it does, Benson’s use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Benson requests only the permission to send email on the connected account’s behalf, together with the basic profile information needed to identify the connected address. Benson uses that access solely to send email that a customer or its automations compose in the Service. Benson does not read, store, or share the contents of a connected Google mailbox, does not use Google user data for advertising, and does not allow humans to read that data except with the customer’s affirmative agreement for support, as necessary for security purposes, or as required by law.

5. NO SALE OR CROSS-CONTEXT BEHAVIORAL ADVERTISING

Benson does not sell personal information for money and does not share personal information for cross-context behavioral advertising as those terms are defined by the CCPA. Benson also does not use customer-controlled personal information to build advertising profiles for unrelated third parties.

If Benson’s practices materially change in the future, we will update this Privacy Policy and implement any legally required choice mechanisms before engaging in the changed practice.

6. SENSITIVE PERSONAL INFORMATION

Depending on how Benson is used, personal information may include categories treated as sensitive under applicable law, including account credentials, Social Security numbers and other government identifiers, contents of communications, and health-related information. Benson uses sensitive personal information only for purposes reasonably necessary to provide, secure, support, and administer the Service, comply with law, or as otherwise permitted by applicable law. Benson does not use sensitive personal information to infer characteristics about individuals for unrelated advertising purposes.

7. AUTOMATED DOCUMENT READING AND AUTOMATED PROCESSING

When a customer enables automatic document reading, Benson reads an uploaded document to identify what it is, which person and compliance item it belongs to, and dates such as an expiration date. Depending on settings the customer controls, the Service may then accept the upload or return it to the person who uploaded it, for example when the file is unreadable or does not match the requested item. Those actions are document-intake steps, not employment decisions; they do not change anyone’s employment status, pay, or eligibility. The customer sees every automated action in the Service and can review, change, or reverse it. Automated results may contain errors, and the customer remains responsible for any decision about a person.

Benson does not use automated processing to make final legally significant employment, healthcare, or similar decisions about individuals.

8. PROTECTED HEALTH INFORMATION AND HIPAA

Benson is workforce, human-resources, and compliance software and is not an electronic health record, patient chart, or clinical documentation system. However, a healthcare customer may use supported Benson functionality in a manner that causes Protected Health Information (“PHI”) to be processed by Benson, such as through uploaded documents or documents sent for signature.

When Benson creates, receives, maintains, or transmits PHI on behalf of a HIPAA Covered Entity or Business Associate in a capacity that makes Benson a Business Associate, that PHI is governed by the applicable Business Associate Agreement and HIPAA, in addition to other applicable requirements. Employment records held by a customer in its role as employer, including workforce health screenings, tuberculosis test results, immunization records, physical examinations, and fitness-for-duty documentation, are excluded from Protected Health Information under 45 C.F.R. § 160.103 and are governed by the Data Protection and Security Addendum, not the Business Associate Agreement. This Privacy Policy is not a HIPAA Notice of Privacy Practices for a healthcare provider or health plan.

9. DATA RETENTION

We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Service, maintain business and transaction records, comply with legal obligations, protect security, resolve disputes, and enforce agreements. The criteria we apply to each category are:

Information may remain for a limited period in backups, security records, legal holds, or records that Benson is required or permitted to retain. After a customer relationship ends, customer data is handled in accordance with the Customer Agreement, the Data Protection and Security Addendum, and the Business Associate Agreement where applicable.

10. SECURITY

Benson uses administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, acquisition, destruction, loss, alteration, use, or disclosure. These include encryption of data in transit and at rest, additional field-level encryption of Social Security numbers, per-customer row-level security enforced on every database table, role-based access that each customer administers, a permanent audit log, automatic sign-out after fifteen (15) minutes of inactivity, and daily encrypted backups. Benson’s Security Overview describes these measures. No method of transmission, storage, or security is completely risk-free, and Benson does not represent that unauthorized access or other security incidents can never occur.

Customers and users are responsible for protecting their credentials, devices, accounts, permissions, and authorized-user access and for promptly notifying Benson at info@bensonhr.com of suspected account compromise.

11. YOUR PRIVACY RIGHTS

Depending on where you reside and which privacy laws apply to Benson and the relevant information, you may have rights to request access to or information about personal information, request correction or deletion, receive information about disclosures, opt out of certain sales or sharing, limit certain uses of sensitive personal information, or exercise other rights provided by law. Benson will not unlawfully discriminate against you for exercising an applicable privacy right.

To submit a privacy request concerning information for which Benson acts as the business or controller, email info@bensonhr.com and describe the request. We may need to verify your identity and authority before completing certain requests. An authorized agent may submit a request where permitted by law, subject to appropriate verification.

If your request concerns information that an employer, agency, healthcare organization, or other Benson customer placed in the Service, please contact that organization first. Benson processes that information on the customer’s behalf and will assist the customer as required by applicable law and our agreements. If you contact Benson about such information, we will pass your request to the organization.

12. CALIFORNIA PRIVACY INFORMATION

If the CCPA applies to Benson and to your personal information, California residents may have rights to know/access, delete, correct, opt out of sale or sharing, limit certain uses or disclosures of sensitive personal information, and receive equal service and pricing when exercising applicable rights, subject to statutory exceptions.

For the categories of personal information described in Section 2, Benson’s sources generally include you, Benson customers and authorized users, service providers, connected services, and publicly available sources where permitted. Benson uses those categories for the purposes described in Section 3, retains them according to the criteria in Section 9, and may disclose them to the categories of recipients described in Section 4.

Benson does not sell personal information and does not share personal information for cross-context behavioral advertising. Accordingly, Benson does not offer a sale/sharing opt-out link. Benson’s website does not use cookies or trackers that would be affected by an opt-out preference signal; if that changes, Benson will treat a Global Privacy Control signal received from your browser as a valid request to opt out of sale or sharing for that browser.

California privacy rights are subject to applicability thresholds, exemptions, verification requirements, and exceptions. Certain information may be governed by other laws or may be exempt from some CCPA requirements.

13. COOKIES AND SIMILAR TECHNOLOGIES

Benson’s website and Service use only cookies that are strictly necessary: a sign-in cookie that keeps you signed in after you enter your username and password; two activity cookies that record the time of your last activity so that the Service can sign you out after fifteen (15) minutes without activity; and a short-lived cookie, kept for five (5) minutes, that carries the list of addresses an email could not be sent to so that the Service can show it on the next page. These cookies are HttpOnly and SameSite, are sent only over encrypted connections, and contain nothing beyond what is needed to identify your session. The public pages on which workforce members upload documents, complete onboarding, or sign documents do not set the sign-in or activity cookies. Benson does not use analytics, advertising, or other non-essential cookies or trackers and does not allow third parties to set cookies through the Service, so there is no cookie banner and no cookie setting; you can block or delete cookies in your browser, but the Service cannot keep you signed in without them. If Benson later uses non-essential technologies, this Privacy Policy and any required consent or preference mechanisms will be updated before those technologies are deployed.

14. COMMUNICATIONS

Benson may send service, security, transactional, account, billing, support, and business-relationship communications. If Benson later sends promotional marketing communications, Benson will provide legally required unsubscribe or preference controls. You may still receive non-promotional communications necessary to administer an account, transaction, or customer relationship.

15. CHILDREN

Benson is a business service and is not directed to children under 13. Benson does not knowingly collect personal information directly from children under 13 through its website or Service. If you believe a child under 13 has provided personal information directly to Benson without appropriate authorization, contact info@bensonhr.com.

16. THIRD-PARTY SERVICES AND LINKS

The Service or website may contain links to or integrations with third-party services. Their privacy practices are governed by their own terms and privacy notices. Customer-directed integrations, such as a connected mailbox, may cause information to be transmitted to a third party selected or authorized by the customer. Benson is not responsible for a third party’s independent privacy practices.

17. DATA LOCATION

Benson stores and processes personal information, including backups, in the United States only.

18. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in the Service, law, technology, or our practices. We will post the updated version and revise the “Last Updated” date. If a change materially affects how we use personal information, we will provide additional notice when required by applicable law.

19. CONTACT US

For privacy questions, requests, or concerns, contact Benson Technologies LLC at info@bensonhr.com.