Privacy Policy

1. Who we are

Benjy is an interactive and shoppable video platform operated by Roomfilla Pte Ltd, a company registered in Singapore at 160 Robinson Road, Singapore ("we", "us", "our"). For any privacy question, or to exercise your rights, contact us at privacy@heybenjy.com.

We act as a data controller for information about our customers and their use of Benjy. For data that customers capture from their own viewers using Benjy (for example, an email collected by an email-gated video), we act as a data processor on that customer's behalf — see section 9.

2. The short version

• We collect what we need to run your account, host and deliver your videos, and show you analytics.
• We don't sell your personal data, and we don't run third-party advertising trackers on our site or player.
• Videos you upload and the people who watch them are yours — we process them to provide the service, nothing more.
• You can access, correct, export, or delete your data — email privacy@heybenjy.com.

3. Information we collect

Information you give us

• Account data — your name, email address, and a securely hashed password (or, if you sign in with Google, your basic Google profile and email).
• Content — the videos, images, text, product details, and experiences you create, upload, or import.
• Billing data — if you buy a paid plan or a lifetime deal, our payment or marketplace provider processes your payment; we receive a record of the purchase, not your full card details.
• Support data — anything you send us when you contact us.

Information we collect automatically

• Usage and device data — IP address, browser and device type, pages or features used, and timestamps, so we can operate, secure, and improve the service.
• Local storage — we store a session token to keep you signed in, and the player stores a random visitor identifier (no name or email) to count unique viewers and measure how far each session watched. See section 5.

Information from integrations

• Shopify — if you connect a store, we read your product catalogue (titles, images, prices, variants) to power shoppable overlays. We request product access only — we do not request or receive your Shopify customers' personal data.
• Google — if you sign in with Google, we receive your email and basic profile to create and authenticate your account.

Viewer information on published experiences

When someone watches a video our customer has published, we collect engagement data (such as plays, how far they watched, device type, and referrer) and, where a customer has enabled email-gating, the email address and consent the viewer provides. We process this on behalf of the customer who published the video (section 9). The customer decides what to gate and is responsible for having a lawful basis and their own privacy notice.

4. How we use information, and our legal bases

We process personal data under Singapore's Personal Data Protection Act (PDPA). Where the UK/EU GDPR or similar laws also apply (for example to your EU/UK viewers), our lawful bases include:

• To provide the service (host and deliver your videos, run the editor, show analytics) — performance of our contract with you.
• To secure and improve Benjy, prevent abuse, and understand usage — our legitimate interests, balanced against your rights.
• To communicate with you about your account, changes, and support — contract and legitimate interests.
• To send marketing (if any) — your consent, which you can withdraw at any time.
• To comply with law — legal obligation.

5. Cookies and local storage

We keep this minimal. Benjy uses strictly necessary local storage to keep you signed in and to make the video player work, and a random visitor token to measure unique viewers and watch-through without identifying anyone. We do not use third-party advertising or cross-site tracking cookies in our player or on this website.

6. How we share information

We do not sell personal data. We share it only with service providers ("subprocessors") who help us run Benjy, under contracts that require them to protect it:

• Cloudflare — hosting, content delivery, video storage, and our edge API.
• Fly.io — short-lived video processing (transcoding).
• Our database and authentication host — stores accounts and content.
• Google — optional sign-in.
• Shopify — only if you connect a store, to read your products.
• Our payment / marketplace provider — to process purchases.

We may also disclose information if required by law, to protect our rights or users' safety, or as part of a merger or acquisition (you'll be notified of any change of control affecting your data).

7. Where your data is processed

We use reputable providers, some of whom operate globally, so your data may be transferred across borders (including outside Singapore, the UK, or the EU). Where we transfer personal data internationally, we take steps required by applicable law — under the PDPA, comparable protection for data sent overseas, and under the UK/EU GDPR, safeguards such as Standard Contractual Clauses or the UK International Data Transfer Agreement.

8. How long we keep it

We keep account data and content for as long as your account is active, and for a reasonable period afterwards to meet legal, accounting, or dispute needs. When you delete content or close your account, we delete or anonymise the associated personal data within a reasonable period, except where we must retain it by law. Analytics are kept in aggregated or pseudonymised form.

9. Data we process for our customers

For viewer data captured through published experiences (analytics and gated leads), our customer is the data controller and we are a processor acting on their documented instructions. We only process that data to provide the service, we don't use it for our own purposes, and we help customers respond to their viewers' data requests. If you are a viewer and want your data accessed or deleted, contact the brand whose video you watched; we will assist them. Customers who gate videos are responsible for obtaining valid consent and providing their own privacy notice to their viewers.

10. Your rights

Under Singapore's PDPA you may request access to, and correction of, your personal data, and you may withdraw consent at any time. Depending on where you live you may have further rights — under the UK/EU GDPR, to delete, restrict, object to, or port your data; and under the CCPA/CPRA (California), to know and delete personal information and not be discriminated against for exercising those rights (we do not sell or "share" personal information as those terms are defined). To exercise any right, email privacy@heybenjy.com. You can also complain to the Personal Data Protection Commission (PDPC) of Singapore or your local data protection authority.

11. Security

We protect data with encryption in transit, encryption of integration credentials at rest, hashed passwords, access controls, and tenant isolation so one account cannot reach another's data. No system is perfectly secure, but we work to protect your information and will notify you and the relevant authority of a breach where required.

12. Children

Benjy is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.

13. Changes to this policy

We may update this policy as Benjy evolves. We'll change the "last updated" date above and, for material changes, give you reasonable notice.

14. Contact

Questions or requests: privacy@heybenjy.com. See also our Terms of Service.