Benji One
Get started

Privacy Policy

Last updated: 24 September 2026

Benji One is a personal assistant that lives in WhatsApp. You message it to set reminders, keep lists, tasks and notes, and manage your calendar, and you can see and change the same things on the website at benji.benjione.com. This policy explains what we collect, why, who else handles it, where it goes, how long we keep it, and the rights you have wherever you live.

Who we are

The service is run by Benji One, a business registered in India (referred to as "we", "us"). We decide why and how your personal data is used, so we are the "controller" under the GDPR and UK GDPR, the "business" under California law, and the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023 (DPDP Act). Our servers, where your data is stored, are located in India. You can reach us at support@benjione.com.

The short version

  • We collect what you give us (your WhatsApp number, name, messages and the things you ask us to keep) so the service can work.

  • We do not sell your personal information, we do not share it for advertising, and we do not use it to train our own AI models.

  • Your messages are processed by AI providers to write replies. That means some of your data leaves India (section 5).

  • You can see and correct your data on the website, ask us to export or delete it, and withdraw consent at any time (section 12).

1. What we collect

  • Your account: your name, your WhatsApp number, a password (stored only as a one-way hash, never the password itself), and, if you use "Continue with Google", your Google account identifier, email address and name.

  • Your conversations: the messages you send Benji One on WhatsApp or in the chat on the website, and the replies it sends back. Voice notes and images you send are converted to text so the assistant can understand them.

  • What you ask it to keep: reminders, lists and list items, tasks and boards, saved notes and links, your chosen tone and any notes you write about yourself, and friends you add (their name and WhatsApp number).

  • Google Calendar (only if you connect it): your calendar events, including titles, times, locations and attendees where present. See section 6.

  • Meta Ads (only if you connect it): read-only performance figures for your advertising account, such as spend, results and campaign names. See section 7.

  • Technical data: things a server normally records, such as your IP address, browser type, request times, and diagnostic logs that include the phone number a message came from. Used to keep the service secure and working.

We do not knowingly ask for sensitive information (such as health, biometric or financial data), but you might include some in what you write to the assistant. It is treated like everything else you send us: used only to provide the service to you.

  • To run the service (send your reminders on time, answer your messages, show your data on the website). Basis: performing our agreement with you (GDPR Art. 6(1)(b)); your consent (DPDP Act s.6); necessary to provide what you asked for.

  • To connect Google Calendar or Meta Ads and use what they return. Basis: your consent, which you can withdraw by disconnecting.

  • To keep the service secure and working (prevent abuse, limit how many messages one person can send, fix faults). Basis: our legitimate interests (GDPR Art. 6(1)(f)), which we balance against your rights.

  • To personalise replies using the tone and notes you chose. Basis: performing our agreement with you.

  • To meet legal obligations and respond to lawful requests. Basis: legal obligation.

We do not sell your personal information, and we do not use it for advertising or profiling for advertising.

3. AI and automated processing

Replies are written by AI models. They can be wrong, so check anything important. No decision that has a legal or similarly significant effect on you is made solely by automated means. We do not use your content to train our own models. The providers below handle it under their own terms.

4. WhatsApp, friends and shared lists

Your messages travel over the WhatsApp Business Platform, which Meta operates. Meta handles them under its own terms and privacy policy, and you can stop hearing from us at any time by blocking the number.

If you ask Benji One to remind a friend, it sends that person a WhatsApp message from our number and keeps their name and number so it can do so. If you share a list, the other person you name can see and edit it. Only add people who are happy to hear from you this way. Anyone whose number we hold can ask us to stop messaging them and to delete their number at support@benjione.com.

5. Who else handles your data, and where

We use a small number of service providers ("processors") only so the service can work:

  • Meta Platforms (WhatsApp Business Platform; Facebook Login if you connect ads): carries your messages and provides ad data you choose to connect. Global, including the United States.

  • Google (Sign-in, Calendar API, Gemini AI, Google Fonts): signs you in, reads and changes your calendar when you ask, and helps understand voice notes and images. The website also loads its typeface from Google Fonts, which means Google receives your IP address when a page loads. Global, including the United States.

  • Groq: runs the AI model that writes replies, so the text of what you send, plus the context needed to answer, is sent to it. United States.

  • NVIDIA (testing phase only): a backup AI model used when our main provider is unavailable, so the text of what you send may be sent to it. While we are in testing this runs on NVIDIA's free developer service, whose terms say inputs may be used to improve NVIDIA's products and models and that it is for evaluation. So during testing please do not send passwords, financial details, health information or anything sensitive. We will remove this provider, or move to a paid plan with stronger terms, before public launch. United States.

  • Tavily: web search, used only when you ask something that needs the web. The search words are sent to it. United States.

  • Hosting provider: operates the servers in India where your data is stored.

These providers process your data to give us their service and are not permitted to use it to advertise to you (NVIDIA's testing-phase terms, described above, are the one exception we know of for how it may use inputs). We do not otherwise disclose your personal information, except where the law requires it, to protect people from harm, or if the business is sold or reorganised (in which case this policy continues to protect your data).

International transfers. Your data is stored in India and, as described above, some of it is sent to providers in the United States and other countries. Where the law of your country requires a safeguard for such transfers (for example the EU and UK rules), we rely on the transfer mechanisms our providers make available, such as standard contractual clauses, or on your consent. By using Benji One you understand your information may be handled outside the country where you live.

6. Google user data

You can choose to connect your Google Calendar. We ask for permission to view, create, edit and delete events on your calendars (Google's "calendar.events" permission) and to see your email address, so Benji One can tell you what is coming up and add, change or cancel events when you ask it to. We use this data only to provide those features to you. We do not use it for advertising, we do not sell it, and we do not let people read it, other than where you ask for support and agree, to keep the service secure, or where the law requires it. Changes to your events are made only in response to your request.

We store an encrypted access token so we can keep reaching your calendar until you disconnect. We read your events when they are needed rather than keeping a copy, but if Benji One mentions an event in a reply, that reply is saved in your conversation history like any other message, and is removed if you delete your account.

Benji One's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect at any time from the Calendars page, or remove our access in your Google Account under "Security > Third-party access".

7. Meta Ads data

If you connect an advertising account, we ask Meta only for read-only access (the "ads_read" permission). We use the results and spend figures to show you your ad performance and in your daily briefing, and for nothing else. We store an encrypted access token until you disconnect, and you can disconnect on the Ads page or in your Facebook account's Business Integrations settings.

8. How long we keep it

  • Your account and what you save (conversations, reminders, lists, tasks, notes, connections): for as long as you have an account, so it is there when you need it.

  • Deletion: when you ask us to delete your account or data, we remove it from our live systems within 30 days, apart from what we must keep by law (for example a record that the request was made).

  • Backups: we keep database backups for up to six months so we can recover from a failure. Deleted data can remain in those backups until they age out, is not used for anything else, and is deleted again if a backup is ever restored.

  • Technical logs: kept for as long as needed for security and troubleshooting, then deleted.

9. Security

Connections to the website use HTTPS. Passwords are stored using a strong one-way hash, and access tokens for Google and Meta are stored encrypted. Each person's data is kept separate and is available only through their own verified WhatsApp number. No service is perfectly secure, so we cannot promise absolute security. If a breach affects your data we will tell you and the authorities as the law requires (for example within 72 hours to an EU or UK regulator where that rule applies, and to India's Data Protection Board and affected people under the DPDP Act).

10. Children

Benji One is not for anyone under 18. We do not knowingly collect data from them. If you think a child has used it, tell us and we will delete the data.

11. Cookies and similar storage

We do not use advertising, analytics or tracking cookies. When you log in, your browser stores a sign-in token so the site can keep you signed in, along with a few display preferences. You can clear these by logging out or clearing your browser data. Because we do not track you across sites or sell or share your data, there is nothing to opt out of; we treat a "Do Not Track" or Global Privacy Control signal as a request that we already honour.

12. Your rights, wherever you live

Everyone can: see and edit their reminders, lists, tasks, notes and friends on the website; ask us for a copy of their data; ask us to correct it; ask us to delete their account and everything in it; disconnect Google Calendar or Meta Ads at any time; and withdraw consent at any time (this does not affect what we did before, and may mean we can no longer provide the service).

  • European Economic Area and United Kingdom (GDPR and UK GDPR): the rights of access, rectification, erasure, restriction, portability and objection (including to processing based on our legitimate interests), and the right to withdraw consent. You may complain to your data protection authority, such as the ICO in the UK or the authority in your EU country.

  • California and other US states (CCPA/CPRA and similar laws in Virginia, Colorado, Connecticut, Texas and others): the rights to know what we collect and how it is used and disclosed, to access and correct it, to delete it, to opt out of sale or sharing (we do neither), to limit use of sensitive information (we use it only to provide the service), and not to be treated worse for using these rights. In the last 12 months we collected identifiers (name, phone number, email, IP address), the content of your messages, audio and images you send, and data you connect from Google and Meta, from you and your devices, for the purposes above, and disclosed it only to the processors in section 5. You can use an authorised agent, and if we decline a request you can appeal by replying to our answer.

  • India (DPDP Act, 2023): the rights to access a summary of your data and who it is shared with, to correct and erase it, to grievance redressal, and to nominate another person to exercise these rights if you die or cannot. Contact us first at the address below; if you are not satisfied you may complain to the Data Protection Board of India.

  • Brazil (LGPD): the rights to confirmation of processing, access, correction, anonymisation or deletion, portability, information about sharing, and to revoke consent. You may complain to the ANPD.

  • Canada (PIPEDA and provincial laws, including Quebec Law 25), Australia (Privacy Act), Singapore (PDPA), South Africa (POPIA), the UAE, Japan, South Korea and other countries: the rights your local law gives you to access, correct and delete your data and to withdraw consent, and to complain to your privacy regulator.

How to use them. Write to support@benjione.com from the WhatsApp number on your account, or message Benji One on WhatsApp, and say what you want. We may ask you to confirm you own the number, so that we never give your data to someone else. There is no charge. We answer within 30 days, or sooner where your local law sets a shorter time.

13. Changes to this policy

If we change this policy, we will update the date at the top and, if the change matters, tell you on WhatsApp or on the website before it takes effect.

14. Contact and grievances

Benji One, benji.benjione.com. Privacy and grievance contact: support@benjione.com. Please also read our Terms of Service.