Last updated: 21 October 2026
1. Who we are
Benull is operated by Quoc Thuan Trade and Service LLC, a single-member limited liability company registered in Viet Nam under business registration number 1602205214. For any privacy question, contact [email protected].
2. Scope
This policy covers benull.uk and every free tool, form, and subpage on it. It applies to visitors from the United States, United Kingdom, Canada, Australia, Vietnam, and elsewhere.
3. What we collect
- Tool inputs — the URL, domain, or email address you enter to run a free check (website speed, malware/phishing, email authentication, searchability, tracking, or brand-presence).
- Waitlist email — the address you give us to hear about new tools.
- Marketing Strategy Generator — the business details you enter (company name, industry, website, social media links, competitors, location, and any optional notes or customisation choices). If you unlock the full report, also your name and email address.
- Technical/security data — standard server and firewall logs (IP address, browser type, timestamp), collected automatically.
- Spam-filtering data — if you submit a comment or form, limited data may be checked by our anti-spam service.
- Brand details for your report — if you ask us to, we read the public homepage of the website you enter to suggest its brand colours, heading font and logo. A logo you upload or accept is stored as an image file on our server.
- Image Optimizer — the website address you enter. To run a scan, our server reads up to 50 public pages of that website and their images, and passes them straight to your browser, which converts the images on your device. Nothing from those pages or images is saved. Images you optimize from your own device are never uploaded. To prevent abuse, we keep short-lived counters of how many scans, pages and images each visitor uses, labeled with a one-way hash of your IP address and the hour (not the address itself).
- Anonymous usage statistics — which steps of the Marketing Strategy Generator are used (for example: page visited, deck generated, report unlocked, file downloaded), with the traffic source of the visit (campaign tags, referring website, whether an ad click ID was present), device type (mobile, tablet or desktop) and the country chosen in the form. No cookies are used, no IP address is stored, and the visit ID exists only while the page is open. We skip this when your browser sends a “Do Not Track” or “Global Privacy Control” signal.
- Source of a lead — when you unlock a report, we record how you reached us on that visit (campaign tags, referring page, landing page, ad click IDs, device). If you accepted analytics cookies, we also record how you first reached us (see section 5).
- Analytics cookie data — only if you accept, see section 5.
4. How we use it, and our legal basis
Tool inputs are used only to run the check you asked for. Waitlist emails are used only to notify you about new tools. Marketing Strategy Generator inputs are used only to research and write your report. The name and email you give to unlock the full report are used to deliver it and, with your consent, to email you about related Benull services; you can unsubscribe at any time. After you unlock a report we send at most two follow-up emails about it: a reminder after one day if you have not opened your private link yet, and, two days after your request, three quick wins taken from your report. Every email has a one-click unsubscribe link. We record when you open your private link or download the deck, so we can stop the reminder and know when a personal follow-up is useful. Security logs are used to protect the site from abuse and spam. Image Optimizer website addresses are used only to run the scan you asked for, and its usage counters only to prevent abuse of the free tools. Anonymous usage statistics and the source of a lead are used to understand which channels and features work, and to improve the tools. Analytics cookies are used only with your consent. Where UK GDPR applies, our basis is: performance of your request, consent (waitlist and strategy report contact details, analytics cookies), and legitimate interest (site security and preventing abuse of the free tools, anonymous usage statistics, recording the source of a lead, and recording whether you opened or downloaded your report).
5. Cookies and tracking
When you first visit, a cookie banner lets you accept or reject non-essential cookies, with equal choice. Nothing non-essential is set unless you accept, and continuing to browse is not treated as consent. You can change your choice at any time with the cookie settings button on the site.
- moove_gdpr_popup (essential, 1 year) — remembers your cookie choice.
- Google Analytics 4 (only if you accept) — loaded through Google Tag Manager. Sets _ga and _ga_* cookies (up to 2 years) to measure visits and how the site is used. We use Google Consent Mode, so Google Analytics does not run until you accept.
- bn_first (only if you accept, 13 months) — remembers how you first reached benull.uk (campaign tags, referring page, landing page, date), so that if you later unlock a report we know your original source.
We do not currently use Meta Pixel, LinkedIn Insight Tag or other advertising cookies. If we add them, they will only run with your consent and this policy will be updated first.
6. Third parties
- Automattic (Akismet) — spam filtering
- Wordfence — firewall and security monitoring
- Cloudflare — traffic routing and security (Cloudflare Tunnel)
- Google (Gemini API) — writes Marketing Strategy Generator reports from the business details you enter and public web pages. Gemini also picks the three quick wins in our follow-up email from the content of your report. Your name and email are never sent to Google. We use Google’s free tier, under which Google may use submitted content to improve its products and human reviewers may read it, so please do not enter confidential or personal information in the strategy form.
- Public search engines — to research your report, our own self-hosted search service sends search queries built from your company name, industry, and location to public search engines.
- Google (Analytics and Tag Manager) — website analytics, only if you accept analytics cookies
- Google Fonts — fonts for the website and your report are loaded from Google’s servers, which receive your IP address as part of the request
- Brevo — sends our emails, including the link to your report
- Telegram — sends private notifications to our own team: when someone starts a deck (company details and report choices only), and when you unlock a report, open it or download it (your name, email, company details, report choices and the source of the lead), so we can follow up quickly. These messages stay in our private Telegram chat.
- Unsplash and Pixabay — stock photos for your report, chosen by search terms based on your industry. Unsplash photos are loaded from Unsplash’s servers; Pixabay photos are copied to our server first.
- jsDelivr — if you choose AVIF in the Image Optimizer (or WebP in Safari), your browser downloads the image encoder program from jsDelivr, a public code network, which receives your IP address as part of the request. Your images are not sent to it.
- Websites you scan — during an Image Optimizer scan, your browser may download images directly from the scanned website or its image host, which then receives your IP address as on any normal visit. Our server’s requests to that website identify themselves as “BenullImageScan”.
Leads from the Marketing Strategy Generator (name, email, company details, report choices and the source of the lead) are stored in our website database and our own self-hosted CRM. Apart from the Telegram notifications to our own team described above, neither is shared with third parties.
We do not sell your personal data to anyone.
7. International data transfers
Because we operate across the US, UK, Canada, Australia, and Vietnam, and use providers based in other countries, your data may be processed outside the country you’re in. Where a transfer requires safeguards (e.g. data leaving the UK), we rely on our providers’ standard contractual protections.
8. Data retention
- Tool inputs (URLs, domains, emails entered to run a check): 30 days, then automatically deleted.
- Waitlist emails: kept until you unsubscribe or ask us to delete them.
- Marketing Strategy Generator inputs and generated report: kept up to 6 hours while your report is built. If you unlock the full report, it is kept for 30 days so your private link works, then automatically deleted.
- Logos and copied stock photos for reports: 35 days, then automatically deleted.
- Anonymous usage statistics: 13 months, then automatically deleted.
- Strategy report leads (name, email, company details, report choices and source of the lead), including the follow-up emails scheduled or sent to you: kept until you unsubscribe or ask us to delete them.
- Unsubscribe list (your email address and the date): kept so that we never email you again after you unsubscribe.
- Telegram notifications to our team: kept in our private Telegram chat until we delete them, and deleted on request with your lead.
- Image Optimizer: the website address and the pages and images read during a scan are not stored. Abuse-prevention counters: 1 hour, then automatically deleted.
- Security/log data: kept only as long as needed for security, per our hosting/firewall provider’s standard settings.
9. Your rights
- United Kingdom — rights under the UK GDPR: access, rectification, erasure, restriction, portability, objection. You may also complain to the ICO.
- United States — some states (e.g. California) give rights to know, delete, and opt out of sale/sharing of personal information. We do not sell personal data.
- Canada — rights under PIPEDA: access to and correction of your personal information.
- Australia — rights under the Privacy Act 1988: access and correction. (Small businesses under AUD 3 million turnover are generally exempt, but we follow its principles regardless.)
- Vietnam — rights under Decree 13/2023/ND-CP on personal data protection: to be informed, to consent, to access, and to withdraw consent.
To exercise any of these, contact [email protected].
10. Children’s privacy
This site is for business use and isn’t directed at children. We don’t knowingly collect data from anyone under 16.
11. Security
We use standard measures (firewall, anti-spam filtering, encrypted transport) to protect your data. No method of storage or transmission is 100% secure.
12. Changes to this policy
We may update this policy as the site or our tools change. The date at the top shows the last update.