Your business stays yours.

Benchlight is provided by Winter Watermelon. We store your contact email, website-review requests (including an optional referral name), hosting setup requests (website name, domain, provider and an optional source repository link), private proofs, questions, revisions and order records to provide the service. Stripe processes payments; we do not store card details. Resend delivers access emails. Cloudflare hosts the site and database.

Domain accounts and transfers

Benchlight Domains uses Tucows OpenSRS to provide domain registration, transfers and renewals. When you create a domain account, we send your verified email, name, postal address and phone number to OpenSRS. We retain the account identifiers needed to connect your Benchlight login. OpenSRS manages domain contacts, authorization codes and registration records; Stripe processes domain payments. Domain registration and renewal are separate from website hosting. Read the OpenSRS privacy policy for its handling of registration data.

Partner codes

If you enter an approved partner code for a first website purchase, we retain its partner identifier with the order, payment and delivery records to calculate any reward. Retrying keeps the original partner choice. These records do not use tracking cookies or third-party browser scripts. PromoteKit manages partner applications and approval. Benchlight verifies the approved partner there and records website rewards in its own order ledger. Stripe receives internal order and partner identifiers with the payment. We keep reward and delivery records for accounting and dispute handling. Hosting, imports and later revisions do not earn this first-website reward.

Private previews

Requested sign-in email links expire after 30 minutes. Private proof invitations expire after seven days. Both are single-use; you can request a fresh sign-in email from Log in. Sessions expire after 24 hours. Private workspace pages require sign-in. Workspace, sign-in and unsubscribe pages are excluded from search and have no product analytics or session replay.

For a website preview we email to a business, we count how many preview links are requested each day, including by email security scanners. Each preview link keeps only the last day it was requested, so a link is counted once a day.

We also keep a record for each emailed preview, so we can tell whether it was useful: when the pictures in our email loaded (which is how we know an email was opened), which preview pages were opened, how long each was actively viewed and how far down it was scrolled, and which parts of the offer (buy, request changes, custom quote) were opened. The record belongs to that one emailed offer. It holds no cookie, IP address, browser details, referrer or anything typed, and notes only whether the request looked like a browser, a mail service loading pictures, or an automated scanner. Mail services and security scanners also load pictures and links, so a record is not proof that a person opened the email. Nothing is recorded in the EU, EEA, UK or Switzerland, when we can’t tell where a request comes from, when your browser sends Global Privacy Control or Do Not Track, or after you turn analytics off on this site (this browser then keeps a cookie holding only “off” so previews know). A mail service loading pictures for you can’t see that choice. The preview works the same either way.

Product improvement

Public-page analytics are enabled outside the EU/EEA, UK and Switzerland unless you opt out or your browser sends Global Privacy Control or Do Not Track. Within these regions, or if the country is unknown, analytics require your choice. Anonymous visit totals may count undecided or declined visits without storing an identifier, IP address, user agent or referrer. When analytics are on, PostHog (United States) receives a random browser ID stored in local storage, a session ID for this tab, the public page route without its query, coarse device type and country, referring hostname only, and approved campaign labels. Form input, email addresses, business names, website addresses and private workspace content are never sent. No person profiles, advertising tracking, fingerprinting or session replay. Turning analytics off removes the saved ID and stops anonymous totals too; previously delivered events remain.

When product analytics are allowed, we also use Google Analytics, based in the United States, to measure visits and named product actions. It uses first-party browser and session cookies, processes connection information such as IP addresses to provide the service, and receives fixed page routes, approved campaign labels and the referring site hostname. We do not send form contents, uploaded files, email addresses or private workspace addresses. Advertising signals and personalization are disabled. The same regional consent, browser privacy signals and turn-off control apply to both analytics services; turning analytics off stops Google collection and removes its cookies. Google analytics event data is retained for up to 14 months. Anonymous totals are not sent to Google.

Your information and rights

Proofs and requests are retained while we provide the service. Order records are retained for accounting and dispute handling. Email support@benchlight.dev to request access, correction or deletion. We verify your email before processing a request and may retain records required for legal or payment obligations.

Content rights

Public availability does not establish reuse rights. We verify content and image rights before publishing a proof. Assessment requests authorize a private review of content you own or manage; they do not authorize public publication or changes to your hosting.

Website source builds

When you request a source build, Benchlight copies the selected repository revision to temporary storage and builds supported website files on a separate Hetzner server. Benchlight does not supply your GitHub access token or separately saved production credentials to the build. Temporary source files and build servers are removed after the job, with automatic expiry and cleanup retries as a backstop. We retain the built website version for your private preview, publishing and rollback, along with build status and file-integrity records.

Connected website providers

When account connections are available, you can authorize Benchlight through your provider. We store your provider account identifier, display name and encrypted access token to list the resources you authorize and copy selected website files. GitHub connections use the repositories selected for the Benchlight App. Provider connections do not authorize us to delete or change your original website. Authorization uses a secure, host-only cookie that expires after ten minutes. Disconnecting removes our saved token and invalidates pending connection requests; provider-side app installations and grants can also be removed in that provider’s account settings. Imported copies remain available in your Benchlight workspace after disconnecting. Expired authorization states and resource selections are removed periodically, and expired access tokens are cleared.

Connected assistants and private drafts

When you connect an assistant, Benchlight shares your account email and a stable account identifier with that assistant, together with the website and draft information you ask it to read. The websites permission lets the assistant create and update private drafts, read your website records and obtain preview links. It does not let the assistant purchase services, publish websites, connect domains or change DNS. Your assistant provider handles the conversation and tool results under its own privacy policy.

A domain registration lookup sends the requested domain name to its public RDAP registry. Benchlight returns registration status and the source of that observation, without registrant contact details.

To understand whether assistant drafts become working websites, we retain the assistant source, your account identifier, draft and website identifiers, whether a draft was added to a new or existing website, and creation and setup timestamps. These records contain no draft files or conversation text. They link draft creation to adding a website, starting hosting and publishing, and remain until your account is deleted. A deleted account stops appearing in these reports immediately; any remaining attribution records are removed by scheduled cleanup, which runs every 15 minutes. Hosting plan status and its list-price equivalent do not establish that a payment was collected.

Drafts started with the form on Benchlight retain a website origin, your account and draft identifiers, and a creation timestamp until your account is deleted. Website-made drafts are excluded from assistant-channel reports. These records contain no draft files or conversation text. The same account-deletion cleanup applies.

Cloudflare stores your draft files and version records privately. Drafts expire 30 days after their last change, and Benchlight retains up to ten recent versions of each draft. Adding a draft to a dashboard website copies its files into that website; that copy follows the website’s retention rules. Private preview links expire after 60 minutes. A valid preview link grants access to that version. Share it only with its intended viewers.

Benchlight stores connection identifiers and hashed authorization codes, access tokens and refresh tokens. Access tokens last one hour; refresh tokens last 30 days and rotate on use. Disconnecting at Connected assistants immediately revokes the assistant’s tokens. Previously issued preview links remain usable until their expiry, within 60 minutes. Disconnecting does not delete drafts or files already copied to a website. Read the assistant guide for setup, supported files and current availability.

Automatic website transfers

When automatic transfer is available, you may connect a source server, database and application configuration. Connection credentials are encrypted in our control database and released only to the authorized transfer runner. The runner uses restricted temporary files while copying your site; customer applications and database restores run on an isolated hosting server. Cloudflare provides the transfer control service and Hetzner provides isolated application hosting.

Source connection credentials in the control service are removed when a transfer completes or is cancelled, or after 14 days. Deployment credentials needed to operate your hosted website remain in restricted server storage. Transfer backups and website files are retained for recovery while hosting is provided. Private transfer previews use a host-only access cookie that expires after 30 minutes. Preview environments block outbound services to avoid sending customer email or triggering payments during testing.

Website hosting

If you host your website with us, we store its web address, your hosting plan status from Stripe and the result of our daily address check in your private workspace. Messages visitors send through your website's contact form are emailed to you through our email provider; we do not keep a copy. We keep monthly totals of page loads, estimated arrivals, call and email taps, and contact-form messages accepted for delivery to show you website activity and send a monthly report. These totals contain no visitor cookies, IP addresses, visitor IDs or page paths. Short-lived hashed rate-limit keys are used only for hourly abuse limits. For website imports, we store the uploaded static website files and retained versions to provide previews, publishing and rollback. Previews use an expiring access link and a secure cookie limited to that website’s separate hostname; website files remain private until you approve publishing. Do not upload passwords, private keys or database backups. Imported websites also keep their setup progress, verification timestamps, aggregate activity readings and monitor alerts in the private workspace. Monitoring is active only after it is connected; requesting it alone does not activate monitoring or billing. Do not send passwords or access tokens through forms, questions or email.