Benjamin Privacy Policy

Effective date

October 12, 2026

Last updated

October 27, 2026

1. Who we are

Benjamin is a mobile app. It connects your bank and card accounts, shows where your money goes, and estimates what credit cards would have earned on your own spending. Benjamin is operated by Wasder, Inc. (“Benjamin”, “we”, “us”), 16192 Coastal Hwy, Lewes, DE 19958.

This policy explains:

• what personal information we collect, and why;
• who we share it with;
• how long we keep it;
• the choices you have.

It applies to the Benjamin mobile app and to https://agentben.money (together, the “Service”).

2. The short version

• We collect what you give us and what you let us read from your banks and card providers through Plaid.
• We use it to run Benjamin for you.
• We do not sell your personal information. We do not share it for cross-context behavioral advertising.
• Ask Benjamin uses AI. When you use it, your conversation, totals Benjamin calculated and transactions from your accounts go to confidential inference: the AI runs in a hardware-isolated environment that Benjamin checks before it sends anything, designed so that the people who operate it cannot read your requests. Benjamin never sends your Social Security number, full card numbers or full account numbers (section 6).
• On our servers, your Ask Benjamin conversations and the account, balance, card-bill and transaction details Benjamin reads through Plaid are encrypted with your Benjamin keys. Our servers can open them only while you allow Benjamin to use your data. Section 10 explains what this covers and its limits.
• You can disconnect an institution, delete an Ask Benjamin conversation, and delete your account in the app. Deleting your account deletes your data within one month (section 9). Transaction records that we separate so they are not connected to your account may be kept to improve the service.

3. Information we collect

3.1 Information you give us

3.2 Bank and card data from Plaid

When you connect a financial institution, you log in through Plaid Inc., a third-party service. Plaid collects information directly from you and your institution under its own End User Privacy Policy at https://plaid.com/legal/#end-user-privacy-policy. By connecting an account through Plaid, you acknowledge that information Plaid collects is treated under that policy. Plaid, not Benjamin, receives your bank username and password; we never see or store them.

Before Plaid opens, we show you what we will read and record your agreement.

With your permission, Plaid gives us the following information from that institution, and we store it:

• About each account: name and official name, type and subtype, the last digits of the account number (not the full number), interest rate (APY) where provided, and the account-holder name your institution reports for verification, if any.
• Balances.
• Transactions, including:
  • amount, currency, dates and pending status;
  • the description your institution shows, both cleaned up and original;
  • merchant name and category, and payment channel;
  • check number, and the running balance after the transaction where provided;
  • payment details your institution attaches to some transfers, such as payer, payee, “by order of”, reference number and ACH identifiers. These can include the names of people or businesses you paid or were paid by.
• History: when you connect an institution, we ask Plaid for up to 24 months (730 days) of past transactions, limited to what your institution provides, and then new transactions as they post.
• Credit card bills, only if you agree: for your credit card connections, now and ones you add later, each card’s balance, statement balance, minimum payment, payment due date and interest rates (APRs). We read these once a day.

When your institution names the owner of a transaction’s account, we do not store that name.

Your ZIP code. Benjamin asks you for your ZIP code in the app, and you can change it in your profile. We do not collect your street address, and we do not take your address from your bank or from Plaid. We keep your ZIP code on our servers, protected by our database’s storage encryption, not by your Benjamin keys. We use it to check which state’s rules apply, to show it in your profile, and to improve the service. When you delete your account, we delete the ZIP code linked to your account. It may remain in separated transaction records that are not connected to your account (section 9).

3.3 Device and technical information

• Your device’s push notification token and platform (iOS or Android), an app installation ID, and whether notifications are allowed, if you register for notifications.
• Sign-in session records, for example when a session started and was last refreshed. We use these to keep you signed in and to sign out a device.
• IP address and similar network information that our servers receive when the app talks to them. We use this for security and rate limiting, and keep it only in short-lived rate-limit counters. We do not write IP addresses to our app servers’ logs.
• Records of how you use the app’s features, for example which suggestions you acted on or dismissed. The app also sends product analytics to PostHog (section 7): which screens you open and which main actions you take, with your Benjamin user ID and technical information about the app and your device (such as app version, device model and operating system).
• When you visit agentben.money, the website sends PostHog the pages you view and how long you stay, where you click and scroll (including the text of the links and buttons you click), how fast pages load, and a recording of the page as you use it (a session replay). It also sends the full page address, with any name, email address, phone number or similar detail removed, including campaign tags such as utm_source and ad click IDs such as gclid or fbclid, the website that referred you, and technical information about your browser and device. Session replay hides everything you type into a form field and the text in the Join now form; the name and email address you enter there are never sent to PostHog.
• PostHog uses your IP address to estimate your city, region and country, and does not keep the IP address after that.
• The website sets one first-party cookie for this, named ph_<project key>_posthog. It holds a random identifier for your browser, so we can recognize repeat visits, and it lasts until one year after your last visit. You can delete it or block cookies in your browser settings.
• When you sign up for Benjamin after visiting the website, we link your website visits to your Benjamin account, so we can see which pages and campaigns led you to Benjamin.
• These analytics never include your name, email address, phone number, postal address or Social Security number, or any bank or card data from Plaid. The app does not record session replays.

We do not collect precise location (GPS). We do not collect the advertising identifier of your device (such as the Apple IDFA or the Google advertising ID).

3.4 Information we create

We compute information from the data above. Examples:

• spending totals and categories;
• recurring charges and upcoming bills;
• how much of a card’s limit is used;
• a safety buffer;
• an estimate of what a card earned or would have earned on your own spending;
• the suggestions shown on Home and in your inbox.

For each suggestion and each card estimate, we keep a record of the inputs, rules and versions that produced it, so we can explain it and correct mistakes.

4. How we use information

Card estimates and comparisons are computed by Benjamin’s own rules from your data. They are not affected by any payment from a card issuer.

We do not use your information to make credit decisions. We do not decide whether you qualify for any card.

5. Credit reports

Benjamin does not obtain your credit report or credit score today.

Nothing Benjamin computes from your bank data is a credit score, and we do not call it one.

When the credit feature launches. The rest of this section applies only after Benjamin launches its optional credit feature and you turn it on. We will update this policy before the credit feature launches.

• What we collect. To verify your identity, you enter your legal name, address, date of birth and Social Security number in the sign-up form in the app. With your permission, our credit data provider and the credit bureau send us your credit report and credit score each month until you turn the feature off. A report can include your credit accounts, balances, credit limits, payment history, inquiries, public records, collections, and identifying information the bureau has on file.
• What we remove. When a report arrives, we remove Social Security numbers, full addresses and full account numbers from it. We keep at most the last four digits of an account number so you can recognize the account.
• How we use it. Only to show you your credit report and score in the app. We do not use it to make credit decisions.
• Bank data and credit data are kept apart. We store data from Plaid and data from the credit bureau separately, each labeled with its source. We never send Plaid data to the credit bureau or our credit data provider, and we never send credit report data to Plaid. We never combine them into one score.

6. Ask Benjamin and AI

When you set up Benjamin, you read a notice about Ask Benjamin in the app and tap “Agree and start”.

Who receives your data. To answer your questions, Benjamin uses confidential inference: a third-party AI service provider runs the AI inside a hardware-isolated environment (a trusted execution environment), designed so that the people who operate it cannot read your requests. We do not sell this information or share it for advertising.

How Benjamin checks the environment:

• Before it sends anything, Benjamin checks a report signed by the environment’s hardware that shows the environment is genuine and which software it runs. It checks again at least every hour.
• Benjamin sends each request only over an encrypted connection that ends inside the environment it checked.
• Each request may be passed only to a model server that the environment has also checked. If none is available, the request is refused, not passed on.
• Benjamin uses a reply only after a receipt signed inside the environment confirms that the request and the reply passed through it.
• If a check fails, Benjamin does not send the request to another provider. Ask Benjamin then shows what Benjamin calculated, or says it cannot answer right now.

What is sent:

• your conversation: the question you typed, your earlier messages and, to answer follow-up questions, what you said in earlier conversations, including a short summary of them that Benjamin keeps;
• totals Benjamin calculated from your accounts, such as spending by category, bills and recurring charges, including their dollar amounts;
• your transactions, including merchant names and transaction descriptions;
• other details that help answer you, which can include your name, your address or city, and the last four digits of an account.

What is never sent: Benjamin never sends your Social Security number, full card numbers or full account numbers.

Card suggestions. To suggest which card an account is, Benjamin uses the same confidential inference and sends the account name your institution reports, your institution’s name, the account type and public card names from Benjamin’s card list. It does not send the account’s last digits, balances or transactions.

If another provider is used. If Benjamin ever sends a request to an AI service provider that does not use confidential inference, it first removes email addresses, phone numbers, street addresses, Social Security numbers, card and account numbers, and dates of birth from it. It sends the request only with settings that require the provider not to keep it or use it for training.

If a message looks like it contains a Social Security number or card number, Benjamin blocks it before it reaches the AI and does not store the number. Before a conversation summary is stored, Benjamin replaces details such as Social Security, card, account and routing numbers, email addresses, phone numbers, street addresses and birth dates with placeholders. These checks can miss some formats, so please do not type those details.

How the AI is used. Benjamin’s own rules calculate every number you see. The AI only writes the words around those numbers, and Benjamin checks each reply before showing it. Replies can still be wrong.

Retention. Each request asks for zero data retention: it may be passed only to a model server that the provider states keeps no prompts or replies. The provider keeps a receipt of each request for a limited time. The receipt holds fingerprints of the request and reply and the results of the checks, not their content. Benjamin keeps a copy of each Ask Benjamin request it sends, encrypted with your Benjamin keys (section 10), and deletes it when you delete that conversation or your account.

Training. Neither Benjamin nor the AI service provider uses your conversations, or anything else Benjamin sends to the AI, to train AI models.

Your controls. You can delete a conversation in Ask Benjamin. Deleting your account deletes all your conversations (section 9).

7. How we share information

We do not sell your personal information. We do not “share” it for cross-context behavioral advertising, as California law defines those terms. We have not done either in the past 12 months.

We disclose personal information only as follows:

Our service providers may use your information only to provide services to us, under contracts that require them to protect it. These contracts include each provider’s standard data processing terms.

If you open a card issuer’s website from Benjamin, you leave Benjamin. What you share there is governed by the issuer’s own terms and privacy policy.

8. Your choices

• Connecting an institution. Before Plaid opens, we show you a notice of what we will read and why. We record your agreement and the version of that notice, and we ask again when the notice changes. Card bills have their own agreement, described next; if you gave it under the current card-bills notice, it also covers a new credit card connection.
• Card bills. You agree when you set up Benjamin, the next time you open the app if you joined earlier, or later on the Bills screen, and we ask again if the card-bills notice changes. Under the current notice, your agreement covers your credit card connections, now and ones you add later. Choosing Not now when we ask does not stop reading you already allowed. Reading stops for a connection when you disconnect it, and for all of them when you delete your account. There is no separate setting to withdraw this agreement.
• Disconnecting an institution. You can disconnect an institution in the app. We stop reading new data from it and ask Plaid to end our access. Data we already received from it stays in your account, shown as disconnected, until you delete your account. Disconnecting is how you withdraw your agreement for that connection. If you connect the institution again, a card-bills agreement under the current notice covers its credit cards again. If Plaid cannot be reached, the disconnect stays pending, and you can retry; we read nothing new from that institution in the meantime.
• Ask Benjamin. Delete a conversation in Ask Benjamin (section 6).
• Notifications. Choose how often Benjamin pushes in Settings > Notifications, or turn notifications off in your phone’s settings. Alerts still appear in your in-app inbox. We do not send advertising or promotions by push. Push notifications can show an amount on your lock screen but never merchant, card or account names; if you share your phone, you can turn pushes off and use the inbox.
• Deleting your account. In the app, go to Settings > Delete account. Or follow https://www.agentben.money/terms#delete-account to ask by email; we verify that you control the account’s email first. Deleting your account signs you out on every device, disconnects your institutions at Plaid, and deletes your data within one month (section 9). Transaction records that we separate so they are not connected to your account may be kept to improve the service.

Where a consent can be withdrawn, withdrawing it stops future collection under it. It does not undo actions already taken with it.

9. How long we keep information

We may keep information longer if the law requires it, or to resolve a dispute or enforce our Terms. When we do, a copy of data kept under your Benjamin keys stays encrypted with those keys.

10. Security

We use administrative, technical and physical safeguards designed to protect your information. These include:

• encryption in transit;
• encryption of the Plaid access tokens that let us read your connected institutions, using a managed key service;
• encryption with your Benjamin keys (section 3.1) of your Ask Benjamin conversations: your messages, Benjamin’s replies, the requests Benjamin sends to the AI and what comes back, the details Benjamin remembers about you, and its summaries of your conversations;
• encryption with your Benjamin keys of what Benjamin reads from Plaid and computes from it: account names, institution names and the last digits of account numbers, balances, card bills and interest rates, transactions with their amounts, dates, descriptions, merchants, locations, categories and payment details, your recurring charges, which cards you hold, and Benjamin’s suggestions and card estimates;
• access limited to people who need it.

Our application logs are designed to leave out financial and identity data.

What your Benjamin keys cover, and their limits. Our servers cannot read data kept under your Benjamin keys without those keys, and they hold a copy of your keys only while you allow Benjamin to use your data (section 3.1): when you use the app, and in the background until 30 days after your device last renewed that permission. Our backups can still open it for up to 7 days after that. While they can open it, our servers and the AI service provider in section 6 process it. A copy of our database alone cannot open it. Benjamin reads new data from Plaid only while you allow it, but it keeps the credential that lets it do so, and Plaid keeps its own copy under its own policy (section 3.2). These are not kept under your Benjamin keys: our record identifiers, statuses and timestamps; which kinds of details Benjamin remembers, and the topic label it gives each question; the account type and institution identifier; information you enter yourself, such as your ZIP code, bills you add and card offers and benefits you report; the text of push notifications (section 7); and separated transaction records (section 9).

Once you set up a passcode and recovery code for your account, if you lose your recovery code and can no longer unlock any of your devices (for example, you lose them or enter a wrong passcode too many times), anything kept under your Benjamin keys cannot be restored to you by anyone, including Benjamin, and it is lost to you. Keep your recovery code somewhere safe. This does not affect information we encrypt with our own keys, such as the Plaid access tokens.

No system is perfectly secure, and we cannot guarantee the security of information you send us. If a security breach affects your personal information, we will notify you as the law requires (for California residents, Cal. Civ. Code 1798.82).

11. Your California privacy rights

We offer the rights in this section to California residents even where the law may not require it of us.

If you are a California resident, you have the right to:

• Know what personal information we collected about you, the categories of sources, why we collected it, the categories of third parties we disclosed it to, and the specific pieces of information we hold;
• Delete personal information we collected from you, subject to legal exceptions;
• Correct inaccurate personal information;
• Not be discriminated against for exercising these rights.

We do not sell or share personal information, so there is no sale or sharing to opt out of. We use sensitive personal information (such as your financial account information and account log-in methods) only to provide the Service you asked for and for other purposes the law allows without a right to limit. So we do not offer a separate “limit” choice.

Categories collected in the past 12 months (using the California categories):

• identifiers: email, account ID, sign-in IDs from Apple or Google once the app offers them, ZIP code, IP address, the website cookie identifier, ad click IDs (such as gclid or fbclid), device push token, app installation ID, device public keys used for your passcode and recovery code;
• personal information described in Cal. Civ. Code 1798.80(e): financial account information;
• commercial information: transactions and card holdings;
• internet or other electronic network activity: sign-in and session records, how you use the app’s features, and how you use our website: pages you view, clicks, scrolling and session replays;
• geolocation data: your approximate city, region and country, estimated from your IP address;
• inferences: computed spending patterns and card estimates;
• sensitive personal information: financial account information.

We do not collect biometric, precise geolocation or audio information.

Sources: you; your financial institutions through Plaid; your device; your browser when you visit our website; PostHog, which estimates your approximate location from your IP address; Apple and Google when you use their sign-in, once the app offers it.

Disclosed for a business purpose: the categories and recipients in section 7.

How to make a request: email gm@agentben.money from the email address on your account, or use Settings > Delete account for deletion. We verify requests by confirming you control the account, for example by sending a code to your account email. We respond within 45 days. We may extend that once by 45 days, and if we do we will tell you why. You can use an authorized agent; we will ask for your signed permission and may ask you to verify your identity directly.

Opt-out preference signals: we do not sell or share personal information, so an opt-out preference signal (such as Global Privacy Control) has nothing to opt you out of.

Do Not Track: Benjamin does not track you across third-party apps or websites, and does not let third parties do so through Benjamin. We do not respond differently to browser “Do Not Track” signals.

12. Children

Benjamin is for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us information, contact us and we will delete it.

13. Where we process information

We store information in the United States. Some service providers, including AI service providers, may process it in other countries.

14. Changes to this policy

When we change this policy, we update the “Last updated” date. If a change is material, we will tell you in the app or by email before it takes effect. Where the law or our consent notices require it, we will ask for your agreement again. If you need to agree to a change, the app asks you before you continue using it.

15. Contact

Questions or requests about this policy or your information:

• Email: gm@agentben.money
• Mail: Wasder, Inc., 16192 Coastal Hwy, Lewes, DE 19958