What we keep, and why.
Benefactor helps people lend to and repay one another through binding covenants. To do that lawfully we must know who you are and keep an honest ledger of what was promised and paid. Here is exactly what that means for your data.
SANDBOX NOTICE · 5 OCTOBER 2026
Benefactor is in a sandbox. No real money moves, no fee is charged, and no partner bank, payment processor, advertiser, or identity-verification, screening or credit partner is engaged. Memberships are not yet open. Much of this notice describes how Benefactor will work once it opens; where it describes data this site does not yet collect, read it as what we will do.
What this site handles today:
- Every visit is served by Vercel, our hosting provider, which receives your IP address, browser details and the pages you request, and keeps its request logs for a period Vercel sets. If a request to our server fails, details of the failure may also be written to those logs.
- Every page loads its typefaces from Google Fonts, so Google receives your IP address and browser details when a page loads.
- There is no waitlist form on this site, and no waitlist entry is collected. When the waitlist opens, it will keep, in our database hosted by Supabase, the email address and name you give, how you heard of us, a normalised form of your email address used to spot duplicate requests, and two flags our system sets if the address looks disposable or the request looks automated. It will also ask for the US state you live in; a request from any state is accepted onto the waitlist, and only California residents can be admitted while Benefactor operates only in California. It will record when you joined, and when, by whom and how your request was decided, with any reason recorded for declining it. If you enter an invite code, it is checked when you submit and is never sent back to your browser; if the code came from a keeper's invitation, your request is linked to that invitation. Like the Contact form, the waitlist will keep a salted one-way hash of your IP address, used only to limit repeated sending, and not your raw IP address.
- The Contact form, when it accepts a message, keeps your name, email address, the topic you choose and your message in our database, hosted by Supabase. With them it keeps a salted one-way hash of your IP address, used only to limit repeated sending. Your raw IP address is not stored there. Before the form opens, it asks our server for a form token that records when the form was opened, so that a message sent too quickly to have been typed by a person can be refused; the token is not a cookie and is not stored with your message.
- Sign-in is not open on this site. When invited testers are admitted, the sign-in code will be emailed by Supabase, our sign-in provider, through Resend, our email-delivery provider. Supabase will keep your sign-in email address with your account and in its own sign-in logs, which may also record the network address a sign-in request came from; that may be our hosting provider's address rather than yours. Your sign-in code is inside that email, so Resend holds a copy for a period it sets and we do not. Sign-in will also ask for a code from an authenticator app, and Supabase, our sign-in provider, will hold your authenticator enrolment.
- This site sets no cookies. The home page remembers, in your browser's own storage, whether you have seen its opening animation; that is never sent to us. When sign-in opens, the site will set three cookies that keep you signed in; they cannot be read by the page's scripts and are sent only over an encrypted connection.
To ask what we hold about you, or to have it deleted, write to privacy@alirayale.com. We delete what we can on request. While you hold an account we keep the records the account depends on, and if an admission is withdrawn we keep a minimal record so the withdrawal stays in force.
Our promise
We collect what we need to verify you, move value lawfully, and keep your covenants honest — and no more. We never sell your personal information. No advertiser learns the private details of who saw an offer — never a name, a contact detail, an address or a record. What an advertiser may learn is general: how many keepers with a stated interest or a membership level saw it. You decide what is shared, and sharing improves what you are shown. Inside Benefactor you may see curated offers; whether they are matched to what you are doing is your choice — see Offers below. You can see, correct and export your information, and close your bank from inside the app once everything you began has concluded.
What we collect
Each category maps to a real feature and a lawful basis. Where a third party processes the data, it is named to you at the point of collection.
| Category | Why |
|---|---|
| Identity | Name, date of birth, and government ID — to verify you and prevent fraud and money laundering, as the law requires. |
| Financial | Your covenants, tenders, balances, receipts, and the linked-account totals you choose to show — to run your ledger. |
| Credit · optional | A soft-pull band, only if you ask for it and authorize the pull. Shown to lenders only if you choose to share it. |
| Contact | Email and a mobile number — both are required. Email carries receipts, notices and your sign-in codes; your number carries covenant alerts by text. We send no marketing by text. |
| Your content | Your bank name, Showcase, listings, and messages — visible to other keepers as you choose, moderated for safety. |
| Usage · anonymous | With consent only, in curated categories, never linked to your name or counterparties — to improve the product. |
How we use it
To verify your identity and prevent fraud; to create and service covenants; to maintain your immutable ledger and produce receipts; to provide the optional credit view you ask for; to keep the network safe; and to meet our legal obligations. We do not make lending decisions from public opinion or unverified reviews — your standing is built only from validated covenant records.
Who sees it
Today no identity-verification, screening, money-movement or credit partner receives your data, because none is engaged; the providers that do handle data today are named in the sandbox notice above. When such partners are engaged, we will share data only with the partners who make a covenant possible — identity verification, screening, money movement, and (if you ask) credit checks — and only as much as each needs. Each partner will be named here before any is used. Other keepers see only what you choose to show. We never sell your personal information. Advertisers receive general counts by interest and membership — never a name, contact, address or record (see Offers).
Offers
Benefactor shows curated offers — our own features, and selected third-party offers that appear only inside the app, each marked “Offer · not from Benefactor”. Advertisers receive general counts by interest and membership, never the private details of who saw one.
| If you are | What you see |
|---|---|
| A free keeper who turned matching on | Offers matched to the signals listed below — and only those. |
| A free keeper who has not | Offers chosen without your interests — the same number, in the same places, at the same size. Same for every free keeper. |
| Knight and above | No offers by default — offer-free comes with membership. A member who wants general or matched offers may turn them on. |
What may match an offer to you — and only these:
- The stated purpose of your asks (a van, tuition, inventory)
- Your membership tier
- Your reserve rung
- Which features you have and have not used
- The sectors you have extended into
- Your standing order
- Your metro area (never finer than that)
What never may, because targeting on it would be targeting on creditworthiness or on distress:
- Your ARC Score or band — creditworthiness is not a marketing signal.
- Your kept-word percentage — targeting on repayment history targets distress.
- Any covenant’s health or lateness — the exploitation line — an offer aimed at someone struggling.
- Your balances or amounts owed — financial condition is protected under GLBA and off-limits here.
- Location finer than metro — a redlining proxy; the lending rule already refuses it.
- Any protected characteristic — age, sex, race, national origin, religion, family or marital status, disability, public assistance.
Where an offer may appear: the Offers page; one slot on the Exchange, beside asks of matching purpose. Never in your covenant flow, your ledger, your Home, a notification or a message.
What every advertiser agrees to:
- Receives general counts only — impressions by stated interest and by membership level, each suppressed below five keepers. Never a name, contact detail, address, record, or any figure about an identifiable keeper.
- May not be a lender, a credit product, a debt-collection or debt-settlement service, or a buy-now-pay-later provider.
- May not reference a keeper’s covenant, balance, standing or score in any creative.
- Every offer carries the visible mark “Offer · not from Benefactor”.
- Every creative is approved by us before it is shown.
- Is named in the Privacy Notice from the day its first offer runs.
Turn matching on or off at any time in Settings → Promotion & offers. Turning it off changes what you see, never how much. Advertisers are named here from the day their first offer shows: none yet.
GLBA & Regulation P — the financial privacy notice
Where this notice stands today. The Gramm-Leach-Bliley Act and Regulation P (12 CFR 1016) govern a financial institution's handling of nonpublic personal information. Benefactor is not a bank, and no money moves on this platform yet — so the notice below is given voluntarily, not because a statute currently compels it. The day a chartered partner bank originates covenants and holds funds, GLBA attaches and this becomes the initial privacy notice Regulation P requires. We publish it now so nothing about how we treat your information changes on that day.
The short version, which will not change: we do not sell your nonpublic personal information, we do not share it with anyone for their own marketing, and we do not share it with affiliates for marketing. Because we do no sharing of the kind Regulation P lets you opt out of, there is nothing here you need to opt out of — and if that ever changes, you will be told first and given the choice before it does.
| What Regulation P asks | Our answer |
|---|---|
| What NPI do you collect? | Identity (name, date of birth, government ID), financial (covenants, tenders, balances, receipts, linked-account totals), contact details, and — only if you ask for it — a credit band. Each is listed with its purpose in What we collect. |
| Do you disclose it to nonaffiliated third parties? | Only to the service providers who make a covenant possible — identity verification, sanctions screening, money movement, and a credit bureau if you authorize a pull. This is the service-provider and joint-marketing exception under 12 CFR 1016.13, and each partner is named to you at the point of collection. |
| Do you disclose it for anyone's marketing? | No. Offers shown inside Benefactor are selected by us, on our systems; the advertiser receives aggregate impression counts and nothing about any keeper. No nonpublic personal information is disclosed to them. Because nothing is disclosed, no Regulation P opt-out arises — and we give you the matching control anyway. |
| Do you share with affiliates? | Benefactor is operated by Ali Rayale Company. We share with no affiliate for marketing, so the FCRA §603(d)(2)(A)(iii) affiliate opt-out does not arise. |
| What about former keepers? | The same terms apply after you close your bank as while you hold it. Records we must retain are held tombstoned and access-limited (see Retention & deletion). |
| How do you protect it? | Regulated fields never touch your device's storage. They are held server-side under per-account envelope encryption, so deleting your account destroys the key that reads them. Access is restricted by row-level policy — no keeper can read another's record, and no keeper can write their own verification verdict. |
| Is there an opt-out to exercise? | Under Regulation P, no — because we do no opt-out-eligible sharing. Your real controls are the offers-matching switch (Settings → Promotion & offers) and the analytics and visibility switches (Settings → Privacy & data). |
Identity documents
In the sandbox, identity verification is performed in-house, and nothing is sent to an identity-verification partner. Where you upload a document, we hold it — we do not pass it to a third-party bureau — and we delete it on a dated schedule.
In the current release we hold what you upload. Nothing you upload here is read, scored, or relied on — sandbox identity rests on your email, phone, name and address. Uploads are shown so you can see the flow pilot will require. Do not send a document you would not want held: everything is destroyed at sandbox close. Every identity artifact is destroyed at sandbox close — 77 days after release. The exact date is set when the sandbox opens.
Your rights
- Consent switches. Anonymous analytics, profile visibility, the Shroud and offers matching are each a switch you control — Settings → Privacy & data and Settings → Promotion & offers.
- Access & portability. View every record and receipt in-app. Your full covenant record exports as proof from Settings → Legal & recovery. A personal-data export can be requested from Settings → Privacy & data and is delivered by email.
- Correction. Update your profile; verified identity fields change through re-verification.
- Closing your bank. From inside the app, once nothing you began is still open — see below.
- Regional rights. Depending on where you live (e.g. GDPR, CCPA/CPRA), you may have additional rights to object, restrict, or appeal.
Retention & deletion
- You close your bank at Settings → Security & sign-in → Close your bank. A bank closes only when nothing it began is still open — every sealed covenant settled or concluded, and every pending offer, listing and ask withdrawn. That is accountability, not obstruction: you do not leave the table mid-hand. Closure takes effect after a 30-day grace period during which you can change your mind.
- What closing removes: your profile, Showcase, listings, messages and connections. What stays: the keepers you dealt with keep your bank’s name on the covenant records you share with them — you were here, and their record is theirs. Everyone else sees nothing. We also keep, indefinitely and access-limited: the signed agreements you executed (NDA, Terms of Service, this notice, each with its version), the ledger of covenants and tenders, and the security, fraud and audit trail — because a closed bank is not an erased history, and because the law and the keepers you transacted with are both owed a trace.
| Data | Kept for |
|---|---|
| Covenant & compliance records; security, fraud and audit trail | Retained after closure, access-limited — the statutory period at minimum |
| Signed agreements (NDA, Terms of Service, Privacy acknowledgment) | Permanently — an executed contract is kept as long as either party could rely on it |
| Usage metrics, aggregated | Retained after closure — pseudonymous, never re-linked to you |
| Identity documents you upload | Held by us — deleted on a dated schedule |
| Anonymous analytics | Aggregated; pseudonymous id rotates; never identity-linked |
| Profile, Showcase, messages, connections | Until you delete them, or 30 days after you request closure |
Children
Benefactor is not directed to children, we do not knowingly collect personal information from anyone under 18, and a keeper must be an adult eligible to enter binding agreements. If we learn that an account belongs to a minor we close it and delete the information we hold, subject only to records the law requires us to keep. A parent or guardian who believes we hold a child’s information may write to privacy@alirayale.com and we will act on it.
Contact
Questions, requests, or content concerns: privacy@alirayale.com. We respond within the timeframes the law requires.