Legal

Privacy Policy

Last updated September 28, 2026. Draft for design partners; not yet reviewed by counsel.

This policy explains what The Bench collects, why, where it goes, and how to get it removed. It is written for people who run finance and operations, not for lawyers. It applies under PIPEDA in Canada and, for US customers, state privacy laws including the CCPA.

What we collect

Data	Where it comes from	Why
Workspace identity: team name, team id, installing user id, bot token	Slack, on install	To run Specialists in your workspace
Messages that mention a Specialist or are sent to it directly, and thread replies	Slack	To understand and complete the task
Data from systems you connect (for example Shopify orders, QuickBooks ledger, Klaviyo metrics)	Your connected accounts	Only to complete tasks you request
Specialist memory notes: short facts about your business	Written by Specialists during tasks	So they improve over time
Approval requests and decisions	Your workspace	Audit trail of what was authorized and by whom
Usage and billing records	Generated by the service	To meter credits and show you spend
Aggregate web analytics on meetthebench.com	Vercel Analytics, cookie-free	To see which pages are read

We do not read your Slack channels beyond the messages addressed to a Specialist. We do not collect payment card numbers; Stripe handles payment.

Where it goes

Anthropic runs the AI models and the isolated sandbox each task runs in. Task content is retained by Anthropic for 30 days for abuse monitoring and then deleted. Anthropic does not train on it.
Composio (when you use one-click connect) holds the OAuth connection to your systems and passes data to the sandbox on request.
Vercel hosts the website and dashboard. Neon or an equivalent hosts our database, in US data centers.
Slack delivers messages both ways.
Stripe processes payments.

Credentials for your connected systems are stored in a vault operated by Anthropic and are injected at the network edge. They never enter the AI sandbox, the prompt, or our logs.

How long we keep it

Task transcripts: 30 days at Anthropic, then deleted. We keep the thread-to-task mapping, not the content.
Memory notes, approvals, and billing records: for as long as your workspace is installed, then deleted within 30 days of uninstall, except billing records we must keep for tax purposes (7 years, Canada).
Connected-system credentials: revoked and deleted on disconnect or uninstall.

Your rights

You can see what a Specialist remembers and delete any of it, disconnect any system, or remove The Bench entirely from the dashboard. You can ask us for a copy of your data, a correction, or deletion at hello@meetthebench.com; we respond within 30 days. Canadian residents may complain to the Office of the Privacy Commissioner of Canada; California residents have the rights described in the CCPA, which we honor for all US customers.

Security

Data in transit is encrypted with TLS. Slack tokens are encrypted at rest. Each workspace has its own isolated vault and memory. Every irreversible action requires human approval and is logged. We will notify you without undue delay, and within 72 hours where the law requires, if we learn of a breach affecting your data.

Children

The Bench is for businesses and is not directed at anyone under 18.

Changes and contact

We will announce material changes on the dashboard before they take effect. Contact: hello@meetthebench.com. The Bench is operated from Toronto, Ontario, Canada.