BentoBits Inc.

1. Who we are and what this policy covers

BentoBits Inc. ("BentoBits", "we", "us") provides Rowseta, a business software service for organizations using Brightspace (the "Service"). This policy explains how personal information is handled in connection with the Service. Contact our Privacy Officer through the website contact form.

The organization using Rowseta is the "Customer". We determine the purposes of processing our business records, including account administration, billing administration, security administration, support correspondence and legal records. For personal information processed on a Customer's behalf, including Customer-controlled learning management system ("LMS") content, the Data Processing Agreement also applies. A support report or diagnostic record may contain Customer-controlled information even when it also serves an administrative purpose. Our role depends on the particular processing and applicable law.

Customers decide which LMS data to connect, which users may access it and how to use the resulting analytics. People with questions about their institution's or employer's LMS information should normally contact that organization first.

2. Information we collect

Category	Examples and sources
Website contact form enquiries	Names, work email addresses, organization details and messages supplied through the website contact form.
Account and contact information	Names, work email addresses, organization name, Rowseta address, selected storage region, roles, permissions and account settings, provided by the Customer, its users or its connected systems.
Signup source	When you sign up, we may record how you found us, including campaign source, medium, name and keyword supplied in your link, the referring website's domain name, and the first page you visited. We save this information with your Organization. We record that first page without anything after a question mark or # sign, and we remove campaign values that look like email addresses, web addresses or access codes. This signup-source feature uses no third-party scripts and does not record your IP address.
Marketing website analytics	Page-view and performance information about visits to our marketing website, including the referring page and the page you landed on, collected by Cloudflare Web Analytics.
Agreement and notice records	The accepting person's identity, represented organization and authority acknowledgement; document versions and digests; acceptance times; and records of notices and relevant account changes.
Billing information	Plan, licensed LMS Account counts, dated measurement and snapshot identifiers, count-check results, invoices, transaction status and billing contacts. Stripe collects payment-card details directly.
Customer-controlled LMS information	Datasets selected by the Customer, potentially including learner and staff identities, enrollments, course activity, grades and other LMS content.
Billing measurement information	Brightspace Course Access and Course Access Log extracts and the Brightspace Organizational Units data used to identify course offerings, plus derived user and course identifiers, UTC course-access days, per-user access counts and last-access days.
Service and security information	Sign-ins, synchronization history, access and audit records, IP addresses, user agents, timestamps, technical errors and diagnostic records. Error and diagnostic records can contain identifiers, query details or values from Customer data; they should not be assumed to exclude learner information.
Organization usage and health measurements	Where we generate them, Organization usage and health measurements include Organization identifiers, synchronization success or failure counts, sanitized error categories, query-duration measurements and aggregate sign-in counts generated through operation of the Service. These measurements exclude names, email addresses, individual user identifiers, query text, report results and learner-record content. Small counts and precise details are reduced or withheld where necessary to avoid identifying an individual.
Support information	Email correspondence, written problem descriptions, relevant technical details and information users choose to send. Where in-app problem reporting is available, this also includes optional screenshots, images or recordings.

Screenshots, recordings and emailed attachments can contain student information and other personal information. In-app media is sent as shown, without automatic masking. Users should review it and remove unnecessary information before sending it. See Support and Problem Reporting.

3. Why we use information

We use information to establish and administer accounts; provide the Customer's selected analytics; authenticate users and enforce permissions; measure subscription usage and calculate charges; process payments; investigate connection and count errors; provide support; protect the Service; send service, billing and legal notices; respond to privacy requests; comply with legal obligations; and establish, exercise or defend legal claims where necessary.

We use this information to understand which campaigns and websites bring new customers to Rowseta and improve our marketing.

We may use Organization usage and health measurements to monitor availability, investigate faults, assess performance and plan capacity for the Service. We may use statistics that do not reasonably identify individuals to understand reliability and usage patterns and improve the Service. We do not use identifiable learner records for our own unrelated product research or independent profiling of individuals.

Operational records containing Customer-controlled personal information remain subject to the DPA and the Customer's instructions. Removing names or substituting identifiers does not, by itself, make information anonymous.

LMS Account measurement

Rowseta uses the Customer's stored Brightspace connection to check its LMS Account count daily without requiring a Customer-initiated sync. These checks apply to Evaluation accounts after a completed sync and to active paid accounts during the 21 days before the subscription period ends, including accounts with cancellation scheduled. Locked, dormant, purged and failed-payment read-only accounts are excluded.

Rowseta may also perform a price check before purchase for an Evaluation Organization that has no free sync credits remaining and has not completed a sync. Using the Organization's stored Brightspace connection, the price check obtains the latest available full extracts and applicable updates for Course Access, Course Access Log and Organizational Units, and processes them in separate billing storage to calculate the LMS Account count. It does not download other LMS datasets, consume free sync credits, or load or refresh analytical datasets. Price checks may run automatically during connection setup or be requested through the Service. Billing measurement records are retained and deleted as described in this policy.

Measurement can download the latest full Course Access and Course Access Log extracts and later updates. To identify course offerings, measurement uses Organizational Units data already synchronized for the Organization or obtained through the separate pre-purchase price check. The count uses distinct Brightspace user identifiers meeting the activity threshold: at least 10 distinct combinations of user identifier, course offering identifier, and UTC calendar day within the measurement window. Only organizational units that the Organizational Units data identifies as type Course Offering count; activity in any other organizational unit, such as the organization itself, a department or a semester, is not counted. The window runs from the count date minus 12 calendar months through the count date, including both boundary dates. Duplicate activity for the same user, course offering and UTC day counts once toward that user's threshold. The resulting LMS Account count counts qualifying users, not the number of activity rows.

This processing creates dated count snapshots. It does not consume Evaluation sync credits or refresh the Customer's analytical datasets. The Terms of Service govern subscription pricing and renewal, including circumstances in which an earlier licensed count is used.

Applicable legal grounds

Where a legal basis is required, we use the basis appropriate to the activity. This may include performance of a contract with the individual concerned, compliance with a legal obligation, or legitimate interests in administering a business relationship, securing the Service, responding to support requests and maintaining necessary business records, balanced against individuals' rights. A contract with an organization does not by itself make every employee or learner a party to that contract. Consent is used where required and may be withdrawn for future processing, without affecting lawful processing already carried out.

Customers determine the lawful basis and required notices for the processing they instruct us to perform. Required account information includes identity and contact details, organization information, the Rowseta address, region selection and agreement-acceptance information. Without required information we may be unable to create or administer an account. Optional information is identified when requested.

4. Who receives information

We disclose information as needed to:

The Customer and users it authorizes, subject to the Service's access controls.
Authorized BentoBits personnel carrying out service, support, security or administrative work. Support personnel may view synced LMS data, including learner data, and other Organization records, such as people, reports and insight widgets, through read-only, time-limited support sessions when necessary to provide or support the Service. Support personnel can view the ticket submitter's name, email address and role, along with the Organization's plan, account status and Rowseta address, without opening a support session. Separate Customer approval is not requested for every session. Necessary access may follow a Customer request or a service fault or security concern identified by BentoBits. The DPA describes the permitted purposes, access records and how an authorized Customer representative may request records for its Organization.
Providers of hosting, storage, backup, technical logging, payment processing and email services, and other providers identified for the relevant processing. The DPA governs providers acting as sub-processors of Customer-controlled personal data. Cloudflare also provides website analytics for our marketing website.
Authorities, professional advisers and other recipients where disclosure is required by law or necessary and lawful for security, dispute resolution or legal claims.
A successor in a business reorganization or transfer, subject to applicable law and safeguards for the information transferred.

For a purchase, Stripe receives the organization's name, its billing email address, LMS Account count, organization identifier, measurement snapshot identifier and count date. The billing email is the billing administrator's address or an invoice address entered at purchase. Billing operations emails can contain organization names, counts, dates and check status.

When in-app problem reporting is available, support notification emails contain routing and diagnostic information, including the organization name and identifier, receipt time, application version, attachment state, a limited set of failed-request details and a link to the report viewer. The full written report and attached media are accessed separately. Ordinary support emails contain whatever the sender includes. Support email is received in a Gmail mailbox operated under Google's consumer terms. We do not claim that processor terms or a data processing agreement cover that mailbox.

We do not sell personal information or share it for cross-context behavioral advertising. We do not use Customer-controlled LMS data to train machine-learning models.

5. Locations and international processing

Global is the only storage location currently offered for analytical data, billing measurement files and, where available, uploaded in-app report media. Global provides no guaranteed storage location.

Region selection does not locate all processing or all copies in that region. Platform metadata, query processing and billing measurement processing are configured in Canada. Cloudflare's network terminates TLS and proxies web traffic worldwide. The managed technical-log destination and platform-metadata backup replica are also configured in Canada. Infrastructure providers also take volume snapshots, whose processing locations are governed by the applicable provider arrangements. Queries and other processing can create temporary working data outside the selected content-storage region. Email, payments, support and other service providers may process information in other countries, where local authorities may have lawful access. Cloudflare Web Analytics processes marketing website visit information, and that processing can occur in other countries.

Where a transfer requires additional safeguards or a customer-specific legal mechanism, the necessary arrangements must be completed before that processing begins. This policy does not execute Standard Contractual Clauses or a transfer assessment. The DPA and applicable provider information describe the relevant arrangements.

6. Retention and deletion

We retain information for the purposes described in this policy and applicable legal requirements, applying the following rules and criteria. A legal preservation requirement may require limited information to be retained longer. Such information is restricted to the purpose requiring preservation.

Evaluation allowance records. To administer free Evaluation sync allowances and prevent repeated use of those allowances through new Organizations, we retain a limited record containing hashed identifiers derived from the owner's email address and Brightspace instance address, the number of free syncs used, and relevant usage and retention dates. This dedicated record does not contain the original email address, Brightspace address, connection credentials or learner records. We use it only to administer Evaluation allowances and prevent their misuse, and treat the hashed identifiers as personal information. After Organization deletion, we retain this record for up to two years, deleting it sooner when no longer necessary or legally required. At the end of that period, we delete it from active systems; residual backup copies follow the backup retention and deletion rules below.

Information	Retention approach
Active account and analytical data	Retained to provide the Service and respond to Customer instructions, including available dataset deletion functions. Evaluation access and storage remain subject to the discretionary Evaluation terms; an Evaluation account has no guaranteed minimum storage period.
Accounts placed in the ordinary locked-account deletion process	Scheduled for purge after 90 days in the locked state, subject to a valid earlier deletion instruction, required return or preservation, and completion of the applicable cleanup processes. Retention does not promise interactive access during lock.
Never-paid, inactive Evaluation accounts	The ordinary inactivity process can lead to deletion after six months without an administrator sign-in followed by a 90-day warning period. This describes the inactivity process, not a minimum Evaluation term or a restriction on BentoBits' separate rights to end Evaluation. Previously paid accounts are not treated as never-paid accounts.
Billing measurement data	Raw extracts are deleted after successful processing. After publication of a newer count snapshot, cleanup removes superseded compact access files and per-user snapshots no longer required for processing or current billing and report snapshots. Failed cleanup is retried during later successful runs. Remaining measurement files and account-linked snapshot records are removed through account purge, subject to any separately justified minimal business record. Deleting an analytical dataset does not itself delete billing measurement files.
Personnel-access audit records	Personnel-access audit records are retained for two years, with source IP addresses removed after 30 days. Incident files and technical service logs follow their own retention rules.
Technical service logs	The configured retention target is 30 days. Provider expiration and deletion processing can take additional time. This is not a promise that every copy is physically erased at exactly 30 days. Necessary incident evidence may be retained separately under the security or legal-record criteria below. Technical service logs are separate from the limited Organization usage and health summaries described below. They may contain user identifiers, email addresses, IP addresses and diagnostic information, including information from Customer records, and are protected accordingly. A longer retention period for aggregate summaries does not extend the retention of the underlying detailed logs.
Organization usage and health summaries	Organization-linked usage and health summaries are retained for up to 24 months to support troubleshooting and year-over-year capacity comparisons, and are deleted sooner when no longer necessary or when required by the DPA. Account purge removes ordinary Organization-linked summaries. Any residual information is retained only where it separately qualifies under the retention rules in DPA section 9.
Authorized diagnostic copies	If we create an authorized diagnostic copy of Customer-controlled information where reasonably necessary to investigate or resolve service faults, including faults we identify ourselves, to provide necessary customer support or to investigate security incidents, the copy must remain within approved, access-controlled environments and comply with applicable location, transfer and security requirements. We limit the information copied, document its purpose and retention, and delete it when no longer necessary, subject to applicable preservation obligations and Customer instructions.
Platform-metadata backups	The separate backup replica is configured with a 30-day retention cycle. Additional infrastructure volume snapshots currently have a five-day retention setting for new snapshots. Deletion takes effect through backup rotation and provider cleanup rather than immediate removal of an individual record from every backup. After a restore, deletion suppression is reapplied for Organization purge, support media and sync error messages stored with problem reports.
In-app report screenshots, images and recordings	Scheduled for deletion 90 days after the report is closed, or through an earlier account-purge process. Reopening a report before its media is deleted can reset the closure-based period. Reopening does not restore media already deleted. Required preservation is an exception.
Sync error messages in problem reports	When a problem report includes synchronization details, we attach a limited snapshot of available error messages. Before storage, automated rules replace recognized patterns for passwords, tokens, other secrets, web addresses and email addresses, and withhold some messages entirely. These rules do not remove every sensitive value. Stored messages can still contain identifiers or values from Customer data. The message text in this snapshot is scheduled for deletion 90 days after the report is closed, or through an earlier account-purge process. Reopening before deletion clears the deadline; closing the report again starts a new 90-day period. Reopening does not restore deleted messages. Other synchronization details, including error codes, dataset names, counts, timings, sync and machine identifiers, and the Brightspace host name, remain with the report under the written report details rule below.
Deletion records for sync error messages	Before clearing stored sync error messages under the report-closure retention rule, we record a technical suppression marker containing its format version, deletion type, Organization identifier, report identifier and the time the marker was recorded. It contains no message text. After a platform-metadata restore, we use the marker to clear those message fields again, including if the restored report is open. Account purge uses an Organization-level suppression marker and removes the report's stored synchronization details. These markers are configured for storage in Canada. Deletion markers have no automatic expiry. We periodically review whether they remain necessary to prevent deleted information from being restored or reintroduced, and delete them when no longer needed, subject to applicable legal requirements. Identifiers can remain personal information.
Written report details and support email, including emailed attachments	Retained while needed to resolve the matter and conduct relevant follow-up, and for justified security, dispute or legal-record purposes. Our internal schedule takes account of whether a matter remains open, the last meaningful activity, necessary follow-up, sensitivity, applicable legal requirements and relevant claim periods. Open matters and retained records are reviewed; unnecessary learner information and sensitive attachments are removed when no longer needed. The 90-day in-app media rule does not apply to the support mailbox.
Invitation email delivery records	Provider message ID, delivery status (delivered, bounced or reported as spam), and event time. Kept with the invitation record for approximately 30 days after the invitation email is sent, or removed earlier through Organization deletion.
Signup source	Deleted 24 months after signup by a daily cleanup job, or earlier through Organization deletion. Remaining backup copies follow the platform-metadata backup rules above.
Marketing website analytics	Kept by Cloudflare under its own retention arrangements. Organization deletion does not delete website analytics.
Agreement, billing, security and legal records	Limited records needed to evidence transactions, accepted terms, notices, compliance, incidents or claims may survive account deletion. The internal schedule identifies the legal or operational purpose, relevant requirement or claim period, review point and deletion trigger. This does not authorize retaining the Customer's complete LMS dataset as general legal evidence.
Deletion records	Identifier-only technical suppression markers are kept in Canada to prevent deleted content being restored or reintroduced after Organization purge, support-media deletion or deletion of sync error messages stored with problem reports. Deletion markers have no automatic expiry. We periodically review whether they remain necessary to prevent deleted information from being restored or reintroduced, and delete them when no longer needed, subject to applicable legal requirements. Identifiers can remain personal information. Limited deletion audit records are retained for their documented accountability purpose.

Temporary query working data follows the processing environment's cleanup lifecycle. It is not necessarily cleared after each sync and is not covered by a universal per-account deletion deadline. Required deletion and return of Customer-controlled personal data remain governed by the DPA.

Organization deletion removes operational account data through the applicable deletion processes. Limited Evaluation allowance records and other specifically disclosed retained records remain subject to their stated purposes and retention periods. It does not mean that every backup, service log, email or lawfully retained record disappears immediately. We do not retain Customer-controlled personal data for unrelated purposes merely because access to the account has ended. Return or deletion after access ends is handled through a support-led process on request through the website contact form.

A self-serve Organization deletion request immediately suspends ordinary access and syncing. We retain Organization data during a seven-day cancellation period so that an authorized Owner can cancel the request. Owners can access the limited cancellation screen during that period. Unless cancelled, Organization deletion begins after the displayed deadline through the applicable deletion processes; completion is not instantaneous. Requests for earlier deletion or required return can be made through support.

7. Security

We use technical and organizational safeguards appropriate to the information and processing risks. These include access restrictions, protection of credentials, encrypted transport, organization-scoped application controls, logging, backups and deletion procedures. The Security and Data Handling notice describes these arrangements. No system can guarantee that every incident will be prevented. This does not reduce our express duties under the DPA or applicable law.

8. Individual rights

Depending on applicable law, individuals may have rights to access, correct or delete information; restrict processing; obtain portability; object to processing; withdraw consent where relevant; and complain to an applicable privacy authority. We will not discriminate against someone for exercising a protected right.

Use the website contact form for requests concerning information we control. We may request proportionate verification and information needed to locate the relevant records. We respond within the time required by applicable law and explain applicable exceptions where relevant.

For Customer-controlled LMS information, contact the Customer. If we receive such a request, we will refer it to the Customer and assist as required by the DPA and applicable law.

9. Students and children

LMS information and support content may concern students, including minors. The Customer is responsible for deciding whether it may provide that information, establishing the required authority and giving required notices or obtaining required consents. Rowseta is offered to organizations, not directly to children. These Customer responsibilities do not remove BentoBits' own legal duties.

10. Cookies and automated processing

The Service uses cookies necessary for authentication and security. Cloudflare Turnstile protects the website contact form and signup against automated abuse. It does not use advertising cookies. Rowseta applies automated plan and security rules and performs the analytics configured by Customers. BentoBits does not use that processing to make solely automated decisions about individuals producing legal or similarly significant effects. Customers remain responsible for their own decisions based on analytics and their associated legal obligations.

We use Cloudflare Web Analytics on our marketing website to understand website traffic and performance. Its browser script sends page-view and performance information to Cloudflare without using cookies or browser storage.

11. Changes and contact

We identify material changes by updating the policy's effective date and provide notice before they take effect, except where a law requires a different approach. We obtain consent where a new use legally requires it. Acknowledgement that a notice was received is not a substitute for consent where consent is required.

To contact the Privacy Officer at BentoBits Inc., use the website contact form.