Last updated: October 22, 2026
Who we are
Bench Engage is operated by AltCMO, LLC, doing business as Bench Engage. For any privacy question, contact us at support@benchengage.ai.
Information we collect
We collect information you submit through forms on this website, such as your name, company, email address, phone number and the content of your message. We also collect standard server and analytics data about visits to the website. For customers of the Bench Engage platform, we collect account and usage data needed to provide the service.
How we use information
We use information to respond to your inquiries, to provide and operate the platform for our customers, to improve our services, and to meet our legal obligations.
Website analytics and cookies
We use analytics to understand how visitors use benchengage.ai. The cookies and similar technologies on this site fall into general categories: strictly necessary cookies that allow the site to function, and analytics cookies that help us measure visits and improve the site. You can control or delete cookies at any time through your browser settings.
Google User Data and the Marketing Health Module
Bench Engage's Marketing Health module lets an authorized administrator of a client organization connect that organization's own Google accounts so we can report on their marketing performance. This section describes that access specifically and governs it.
What we access
When an administrator connects a Google account, we request:
- Google Analytics 4, read-only (the
analytics.readonlyscope). - Google Search Console, read-only (the
webmasters.readonlyscope). - Google Ads, only if the administrator connects it separately (the
adwordsscope). Google offers no read-only permission for Ads. We only read reporting data and never create, change or delete anything in an Ads account. - Google Business Profile, only if the administrator connects it separately (the
business.managescope). Google offers no read-only permission for Business Profile. We only read location details and daily performance data, and never create, change or delete anything in a Business Profile. - The connecting Google account's email address and account identifier (the
openidandemailscopes), so we can show which account is connected.
We do not request access to Gmail, Drive, Contacts, Calendar or any other Google service.
What we store
Daily reporting data at the level of the whole property, site, account or business location. We do not request or store data about individual visitors: no user identifiers, IP addresses or visitor emails.
- From Google Analytics 4: daily counts of sessions, engaged sessions, users, new users, engagement time, key events and event counts by marketing channel; landing page paths; and event names. We also read visitor cities to choose the locations we check search rankings in; city names from Google Analytics are not stored.
- From Search Console: daily clicks, impressions and average position, the search terms people used to find the site, and page URLs.
- From Google Ads: account and campaign names, and daily or monthly impressions, clicks, cost and conversions per campaign.
- From Google Business Profile: for each location the administrator chooses, its name, city and state, and daily counts of views on Google Search and Google Maps, call button taps, website clicks and direction requests. To help the administrator choose locations, we also show each location's address, store code, phone number, website and Google Maps link; these are not stored. We do not read reviews or ratings.
- The names of connected properties, sites, accounts and locations, and the email address of the Google account that connected them.
How we use it
We use this data for one purpose: to compute and display marketing health scores, channel metrics, search-ranking comparisons and improvement recommendations inside the connecting organization's own Bench Engage dashboard. Some Search Console search terms are selected as tracked keywords, which we use to check where the organization and its competitors rank in public Google search results. We do not use Google user data for advertising of any kind, we do not combine one client's Google data with another's, and no client can view another client's data.
Who we share it with
We do not sell, rent or transfer Google user data to advertisers, data brokers or any other party for their own purposes. We share it only with service providers that run this feature on our behalf:
- Vercel and Neon host our application and database, where the data is stored.
- DataForSEO receives tracked keyword text and a location code, to check public search rankings.
- Anthropic receives the tracked keyword list, together with public search-result titles and descriptions, to identify which competing businesses offer the same service.
Google Business Profile data is processed only by Vercel and Neon, which host our application and database.
We do not use Google user data to develop, improve or train AI or machine-learning models. Anthropic's commercial terms do not permit it to train its models on data we send.
How we store and protect it
Google access and refresh tokens are encrypted at rest using AES-256-GCM with a key derived uniquely per client organization, so one organization's key cannot decrypt another's. Tokens are decrypted only in memory when making an authorized request. Data is encrypted in transit, isolated per organization at the database level, and visible only to that organization's authorized users.
Retention, disconnection and deletion
We keep collected reporting data while a Google account stays connected, so scores can be compared over time. An administrator can disconnect a Google account at any time from the Marketing Health settings. When they do, we delete our stored access tokens and ask Google to revoke Bench Engage's access. The one exception: if the same Google account is still connected in that workspace for another Bench Engage feature, Google access stays on for that connection.
The administrator can choose to delete all data collected from that account when disconnecting, or later with "Delete collected data". Otherwise, collected data is deleted within 30 days of a request to support@benchengage.ai, including on termination of the client's account. A record of connection activity (the date, the action, and the connecting account's email address) is kept in our security audit log.
Users can also revoke Bench Engage's access directly at https://myaccount.google.com/permissions.
Limited Use
Bench Engage's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
HubSpot Data and the Marketing Health Module
An authorized administrator of a client organization can connect that organization's own HubSpot account to Marketing Health so we can show how its marketing turns into sales. This section describes that access specifically and governs it.
What we access
The administrator creates a read-only service key in the organization's own HubSpot account with only the crm.objects.deals.read and crm.objects.contacts.read scopes, and gives it to us. We use it only to read deals, contacts and basic details of the connected account, such as its account ID. We never create, change or delete anything in a HubSpot account.
What we store
- From deals: the deal amount and currency, pipeline and stage, created and closed dates, whether the deal was won, and the IDs of the contacts linked to it. We do not store deal names or notes.
- From contacts: the HubSpot contact ID, created and last-modified dates, original source and source details, and the Google Ads click ID if present.
- Contact phone numbers are never stored. We keep only a one-way, keyed fingerprint of each number, unique to the client organization, used to match phone calls to contacts. We do not store contact names, email addresses or notes.
- The connected HubSpot account's ID and name.
How we use it
We use this data only to show won deals, revenue, close rate, ad return and lead sources inside the connecting organization's own Bench Engage dashboard, and to match that organization's calls to its contacts. We do not use HubSpot data for advertising, we do not combine one client's data with another's, and no client can view another client's data. We do not use HubSpot data to develop, improve or train AI or machine-learning models.
Who we share it with
We do not sell, rent or transfer HubSpot data to anyone. It is processed only by Vercel and Neon, which host our application and database.
How we store and protect it
The HubSpot key is encrypted at rest using AES-256-GCM with a key derived uniquely per client organization, and is decrypted only in memory when making an authorized request. Data is encrypted in transit, isolated per organization at the database level, and visible only to that organization's authorized users.
Retention, disconnection and deletion
We keep the last 25 months of deal and contact data; older records are deleted automatically as the window moves forward. An administrator can disconnect HubSpot at any time from the Marketing Health settings, which deletes our stored key; to remove Bench Engage's access entirely, the administrator deletes the key in HubSpot. The administrator can also choose to delete all data collected from that HubSpot account when disconnecting. Otherwise, collected data is deleted within 30 days of a request to support@benchengage.ai, including on termination of the client's account.
CallRail Data and the Marketing Health Module
An authorized administrator of a client organization can connect that organization's own CallRail account to Marketing Health so phone calls count toward its marketing results. This section describes that access specifically and governs it.
What we access
The administrator gives us an API key from the organization's own CallRail account. We use it only to read call records for the companies the administrator chooses. We never create, change or delete anything in a CallRail account.
What we store
- For each call: the time, duration, whether it was answered, whether it was a first-time caller, its direction, its marketing source, medium, campaign and keyword, the landing page, the Google Ads click ID if present, and the tracking number called.
- Caller phone numbers are never stored. We keep only a one-way, keyed fingerprint of each number, unique to the client organization, used to match calls to that organization's own HubSpot contacts.
- We do not store caller names, call recordings or transcripts.
- The names of the connected CallRail companies.
How we use it
We use this data only to count calls as conversions, show call results, and match calls to contacts inside the connecting organization's own Bench Engage dashboard. We do not use CallRail data for advertising, we do not combine one client's data with another's, and no client can view another client's data. We do not use CallRail data to develop, improve or train AI or machine-learning models.
Who we share it with
We do not sell, rent or transfer CallRail data to anyone. It is processed only by Vercel and Neon, which host our application and database.
How we store and protect it
The CallRail API key is encrypted at rest using AES-256-GCM with a key derived uniquely per client organization, and is decrypted only in memory when making an authorized request. Data is encrypted in transit, isolated per organization at the database level, and visible only to that organization's authorized users.
Retention, disconnection and deletion
We keep the last 25 months of call records; older records are deleted automatically as the window moves forward. An administrator can disconnect CallRail at any time from the Marketing Health settings, which deletes our stored API key; the administrator can also delete that key in CallRail itself. Collected call data is deleted within 30 days of a request to support@benchengage.ai, including on termination of the client's account.
How we share information
We share information only with service providers who help us operate the platform, and only as needed for them to do so, and when required by law. We do not sell personal information.
Data retention
We keep information only as long as needed for the purposes described in this policy, then delete it.
Your rights
Depending on where you live, you may have rights to access, correct, or delete your personal information. Send requests to support@benchengage.ai.
Security
We use reasonable technical and organizational safeguards to protect information, including encryption in transit and at rest, access controls and limited internal access. No system is perfectly secure, so we cannot guarantee absolute security.
Children's privacy
Our services are not directed to children under 13, and we do not knowingly collect their information.
Changes to this policy
We may update this policy from time to time. When we do, we will revise the "Last updated" date above.
Contact us
AltCMO, LLC d/b/a Bench Engage
support@benchengage.ai