Privacy Policy

Who we are

Benefits Studio (“we,” “us”) provides software that lets insurance brokers and HR teams turn employee benefits documents into published benefits websites, with an AI assistant (“Benny”) that answers questions using only those documents. This policy explains what information we collect, how we use it, and the choices you have.

Benefits Studio is a registered fictitious name of Transform Your Marketing LLC, a Florida limited liability company, and that company is the controller of the information described here. Reach us at 225 North Miami Avenue, Suite 3203, Miami, FL 33128, by email at legal@benefitsstudio.com, or through our contact form.

For the plan documents our customers upload, the employer or broker decides what is collected and why; we process it on their behalf under our Terms of Service.

If you’re an employee visiting a benefits portal

Benefits portals are public web pages. You do not create an account, and we do not ask you for your name, email, or health information. When you use the site we collect only:

• Standard web logs and page-view counts (which pages are visited, not who visited them).
• A random session cookie, and your IP address, used to prevent abuse of the AI assistant (rate limiting) and to keep the site secure. Your IP address is kept only briefly for that purpose and is not used to identify you personally.
• The questions typed to Benny, stored with that random session ID so Benny can follow the conversation and so the same browser can pick it back up for 24 hours. They are deleted automatically 90 days after they are asked (see below). Your employer is not shown them, and our own tools count questions and their cost without showing what was asked. To generate an answer, your question and excerpts of the employer’s plan documents are processed by Anthropic (our AI provider) via API; Anthropic does not use this data to train its models. Don’t include personal details (like your name, member ID, or health conditions) in questions — Benny doesn’t need them and can’t access any personal records anyway.
• If you use the “contact your benefits team” form, the name (optional), reply-to email, and message you enter are emailed to your employer’s benefits team through our email delivery provider (Resend) and are not stored by us.

Portal analytics (PostHog) count page views and feature use in aggregate, including which language Benny answered in. They do not include the text of your questions, and we do not use session recording or automatic click capture on benefits portals.

If your employer added a welcome video, it plays in Wistia’s video player with Wistia’s viewer tracking turned off. Carrier logos are served from our own storage.

Cookies & your choices

We use two kinds of browser storage, and only two:

• Strictly necessary — a random session ID used to rate-limit the AI assistant and keep the site secure, your sign-in session on the admin app, (on password-protected portals) the cookie that remembers you entered the site password, and (for visitors from the EU or the UK) the cookie that remembers your analytics choice. These are required for the service to work and are set without asking.
• Analytics — PostHog, to count page views and feature use and to catch errors.

If you are visiting from the EU or the UK, we ask first. Nothing analytics-related loads or is stored until you choose, a banner offers accept or decline, declining is one click, and your choice is remembered in your own browser. If you have an admin account, we also remember the choice on your account, so our servers stop sending your activity to PostHog too (account and billing emails still go out). Elsewhere — including the United States — analytics run by default; you can block or clear them with your browser’s own controls, or email us and we’ll delete what we hold about you. We do not use advertising cookies or third-party trackers anywhere, and we never sell personal information.

Page speed. Vercel, our web host, measures how quickly each page loads (Speed Insights) for every visitor. It sets no cookies and records load times and the kind of device and browser, not who you are.

Security reports are separate from analytics. If your browser blocks something our security policy forbids — a script or image from a site we haven’t approved — it sends us a short technical report: the address of the page (without anything after the “?”), what was blocked, and which kind of browser noticed. We keep a copy in PostHog so we can spot attacks and mistakes in our own setup. It carries no cookie, no account, no IP address of yours and nothing that identifies you, so it is sent regardless of the analytics choice above.

If you’re a broker or HR administrator

We collect:

• Account information — your email, password (stored hashed, never readable by us), and company name. If you sign in with Google or Microsoft, we receive your email from that provider. If you turn on two-step verification, our authentication provider stores the key that links your authenticator app, and we keep your recovery code only in a scrambled (hashed) form that we cannot read.
• Content you upload — benefits plan documents (SBCs, plan summaries, formularies), branding assets, announcements, and contact directories. These are plan-level documents; please don’t upload documents containing individual employees’ personal or health information.
• Billing information — handled by Stripe. We never see or store your card number.
• Usage data — logs and product analytics (PostHog) about how the admin app is used, to keep it working and improve it. In the admin app this can include session recordings of your screen interactions; text you type into forms is masked. We also keep a contact record for you in our email platform (Loops) so we can send account and onboarding emails.

How we use information

• To provide the service: host portals, extract plan facts from documents for your review, and answer employee questions from those documents.
• To process payments and manage subscriptions.
• To send transactional emails (account confirmation, password resets, billing and usage notifications) and onboarding or product-update emails to account holders. You can unsubscribe from the onboarding and product-update emails at any time; account, security, and billing notices continue while you have an account.
• To monitor performance, prevent abuse, and improve the product.

We do not sell personal information, and we do not use your uploaded documents to train AI models.

Service providers

We rely on a small set of processors to run the service: Supabase (database, file storage, authentication), Vercel (web hosting and page-speed measurement), Upstash (short-lived counters that limit how often the assistant and our forms can be used, keyed by IP address, a random session ID or an account ID; the ones keyed by IP address expire within a day), Wistia (the player for a portal’s welcome video, when the employer adds one), Stripe (payments), Anthropic (AI document processing and the Benny assistant), Voyage AI (document search indexing), Cloudflare (domain, DNS, and the Turnstile bot check on our forms), Google and Microsoft (optional sign-in), PostHog (product analytics and error tracking), Loops (account, onboarding, and product emails to administrators), Resend (delivery of contact-form messages, of the email that confirms a benefits team’s address before the contact form sends to it, of security notices about your own login, and of error alerts to our own team), and Slack (internal notifications to our own team about account events such as a signup, a new subscription, or a failed payment; these can include an administrator’s name, email address, and company name, and never anything about employees). Each receives only what it needs to perform its function; PostHog, Loops, Resend, and Slack never receive your uploaded documents or the questions employees ask Benny. Our AI providers process uploaded documents and Benny questions via API and do not use that data to train their models — see Anthropic’s privacy policy and Voyage AI’s privacy policy for how they handle data they process. We may add, replace, or remove providers as the service evolves; this page always lists the current set.

Retention & deletion

Account data and uploaded content are kept while your subscription is active. If a trial or subscription ends, portal data is retained for 90 days and then deleted; we email the account’s administrators before that happens. You can request deletion of your account and data at any time by emailing us; we’ll complete it within 30 days, except records we’re legally required to keep (like billing records).

Questions asked of Benny are deleted automatically 90 days after they are asked, whether or not the portal is still active — a daily job enforces this, so nothing older survives anywhere.

Security

Documents are stored in private storage accessible only through short-lived signed links; data is encrypted in transit and at rest; each customer’s data is isolated at the database layer. No method of storage or transmission is 100% secure, but we design for defense in depth.

Your rights

Depending on where you live (for example, California or the EU), you may have rights to access, correct, export, or delete your personal information. Email legal@benefitsstudio.com (or use our contact form) and we’ll honor these requests regardless of where you’re located.

Children

Benefits Studio is a workplace tool and is not directed at children under 16. We don’t knowingly collect their information.

Changes

If we make material changes to this policy, we’ll update the date above and notify account holders by email. Continued use after changes means you accept the updated policy.