Effective: 25 October 2026
Who we are
Benchmark Monitor (app.benchmarkhe.com) compares the performance of college and university websites for the organizations that subscribe to it. It is run by Bravery Media LLC, a US company at 5900 Balcones Dr. Ste 20207, Austin, TX 78731, which is the "controller" of the personal data described here. Questions and requests: support@benchmarkhe.com.
This page covers Benchmark Monitor: the app, its sign-in, its emails and its billing. SpeedyU, our public ranking site, has its own policy at speedyu.com/privacy.
What we measure is not personal data. Monitor's reports are built from scans of public web pages that anyone can load without signing in, and from Google's published field data about those pages. We don't collect anything about the people who visit those sites.
What we collect
About people who sign in (the account owner, and on Portfolio, invited teammates)
- Your email address, which is how you sign in. There is no password: we email you a sign-in link and an 8-digit code each time.
- Your name, if you add it on your Account page.
- Your organization and role: which organization you belong to and your role in it (owner, admin or a read-only role).
- Invitations: on Portfolio, the email address an owner or admin invites, who sent the invitation, and whether it was accepted.
- Changes of address: if you change your sign-in email, the old and new addresses and when the change was confirmed. We keep these so that a request to delete your data finds every address you used.
- Which reports you have opened in the app, so we can mark the new ones.
- Sign-in records: our sign-in provider records when you signed in, and the IP address and browser of each session, to keep the account secure.
About report recipients (people a customer adds to a competitor set to receive its reports)
- Their email address, and their name if the customer gives one. The customer chooses recipients and confirms they're allowed to share the address with us (terms, section 5). We don't use a recipient's address for anything but sending that customer's reports.
- For each report email: a private link to the report, when it expires, and how many times it was opened and when first. We store only a scrambled form of the link (a hash), never the link itself. We don't record the IP address or browser of the person who opens it.
- A stop: if a recipient stops reports from an organization, we keep that address and the date, so we don't send that organization's reports to it again.
About the organization's billing (handled by Stripe, our payment processor)
- The billing contact's email address, where Stripe sends invoices and receipts.
- The billing address, which Stripe asks for at checkout to work out sales tax or VAT, and a tax ID (such as a VAT number) if you give one.
- Card details go to Stripe directly. We never see or store your card number; Stripe tells us only whether a card is on file.
- Your subscription and invoices: plan, number of Seats, prices, dates, discounts and payments.
- A tax exemption certificate, if you email us one.
About everyone we email from Monitor
- Email delivery: for each email (sign-in links, billing notices, reports), whether it was delivered, bounced or reported as spam.
- Opens: a small image loads when an email is opened, and we record that it was opened and when. We don't track clicks on links in our emails.
- A do-not-send list: addresses that bounced or complained, so we never email them again.
When you contact us
- Email to support@benchmarkhe.com: your message, your address and anything you attach.
- Help from us inside your account: if we need to look at your account to help you, a person on our side can join your organization for a limited time (at most 24 hours). We record who, when, for how long and with what access. We join only when you ask for help or to fix a problem you reported, and we tell you when we do.
Technical data
- IP address, used briefly to limit how fast one address can make requests to the sign-in, pricing and report pages. It is held in memory only and not logged by the app.
- Cookies that keep you signed in (see "Cookies").
Your contact record. We keep one record per person that links the addresses they have given us themselves (an account, a SpeedyU follow or newsletter sign-up, a request they sent us) with what each address has consented to, the emails we sent it, and a short note a person on our side may write. If you sign in to Monitor, your account is part of that record. A report recipient's address never creates a contact record, because the recipient didn't give it to us.
What we use it for, and on what basis
| Purpose | Data | Lawful basis (GDPR) |
|---|---|---|
| Provide the service: sign you in, show your organization's reports and settings, send reports to the owner and recipients | account and recipient data, report links | Contract with your organization (for the people who sign in on its behalf and its recipients, our and the customer's legitimate interest in delivering the service it bought) |
| Bill the subscription, collect tax and keep the accounting records | billing contact, billing address, tax ID, invoices, exemption certificate | Contract; our legal obligations (tax and accounting) |
| Send service emails: sign-in links and codes, notices about seats, plan changes, renewals, discounts ending, cancellation and changes of address | address, organization, subscription facts | Contract |
| Keep report links private and honor stops: expire and revoke links, stop reports to an address that asked | report links, stops, do-not-send list | Legitimate interests; our obligations under anti-spam law |
| Keep our email deliverable: stop sending to addresses that bounce or complain | address, delivery events | Legitimate interests |
| Measure whether report emails are opened, and how often a report link is opened | open events, link view counts | Legitimate interests — you can object |
| Keep your contact record, and understand how customers use Monitor so we can support them, plan our work and talk to the right people about renewals | contact record, account data, opens | Legitimate interests — you can object |
| Answer support requests and help inside your account | your message, account data, support session record | Contract; legitimate interests |
| Keep the service secure and prevent abuse | sign-in records, IP address | Legitimate interests |
We do not sell personal data, and we don't use recipients' addresses for marketing. A Monitor account does not sign you up for SpeedyU's newsletter or any other list: those always have their own sign-up. We don't make automated decisions about people that have legal or similarly significant effects.
Report text written with AI. Parts of a report's written analysis are drafted by AI language models (terms, section 2). They receive measurements and names of the institutions in the report, never the name or address of anyone who signs in or receives it.
Who we share it with
These providers process data for us under contract. We don't share personal data with anyone else unless the law requires it.
| Provider | What for | Where |
|---|---|---|
| Supabase | the database (accounts, organizations, competitor sets, recipients, reports, report links, the send log and the do-not-send list) and the sign-in system | Ireland (EU) |
| OVHcloud | hosts the app and the system that sends our email | France / Germany (EU) |
| Amazon Web Services (SES) | sends every Monitor email, records delivery and opens, and receives mail sent to support@benchmarkhe.com | United States (Ohio) |
| Stripe | checkout, card payments, invoices and receipts, sales tax and VAT | United States, worldwide |
Your organization sees its own members, their roles, its competitor sets and their recipients, and its reports. Recipients don't see each other's addresses. We don't show a customer which recipient opened a report.
We work on this data ourselves from the United States.
International transfers
Bravery Media LLC is in the United States, and so are Amazon SES and Stripe. If you are in the EU, EEA, UK or Switzerland, your data therefore leaves that area. Where the GDPR applies, we rely on standard contractual clauses or the EU–US Data Privacy Framework, where the provider participates. Email us for a copy of the safeguard that applies.
How long we keep it
- While the subscription runs: account, organization, competitor sets, recipients and reports are kept for as long as the subscription lasts.
- After the subscription ends: we keep the organization's reports and settings for 12 months, so they are there if you come back, then delete them. Ask us to delete them sooner and we will.
- A removed recipient: removing a recipient from a competitor set deletes them from it at once and stops their links working. The record of reports already sent to them stays with the report until the report is deleted.
- Report links: stop working 90 days after the email is sent, or sooner if the recipient stops reports, is removed, or the link is revoked. The delivery record (address, link hash, view count) stays with the report.
- Stops: kept until the recipient resumes reports from that organization, so we don't email them again.
- Pending invitations: until accepted, withdrawn or the organization is deleted.
- The send log (one record per email, with delivery and open events): 12 months, then deleted.
- The do-not-send list: kept, so we never email those addresses again, even after we delete everything else about a person.
- Invoices, payments and tax records: for 7 years after the end of the tax year they belong to, as tax and accounting law requires.
- Mail to support@benchmarkhe.com: the copy our mail system stores is deleted after 30 days; the forwarded copy stays in our mailbox until the request is dealt with.
- Support sessions: the record that we joined your organization is kept as an audit trail while your organization exists.
- Sign-in records: kept by our sign-in provider for a short period.
- IP addresses used to limit requests: at most a few minutes, in memory only.
Your rights
You can ask us to access, correct, delete or restrict your data, to get a copy to take elsewhere (portability), and to object to any use based on legitimate interests.
- Correct it yourself: on your Account page you can set your name and change your sign-in email. A change of email is confirmed from both the old and the new address, and the competitor sets and stops tied to your old address move to the new one. Changing your sign-in email does not change where invoices go: the Account page offers that separately.
- Stop reports: every report email has a link that stops reports from that organization to your address, for every competitor set it has. You can resume from the same page, or from your Account page if you sign in.
- Delete: email support@benchmarkhe.com from the address concerned (or tell us which address you mean). We do it by hand and confirm when it's done. If you are the only owner of an organization with a live subscription, we'll first ask the organization to name another owner or let the subscription end. We keep the do-not-send entry for your address so we never email you again, and invoices and payment records as the law requires.
- A copy: email us and we'll send you what we hold about you in a common format. Reports themselves can be printed or saved as PDF from the app.
If your organization subscribes and you are a recipient or teammate, you can come to us directly or through your organization. We answer within one month. You can also complain to the data protection authority where you live or work.
Cookies
The app sets only the cookies it needs to work: the ones that keep you signed in, one that remembers which organization you're working in, and a short-lived one that links a checkout to your sign-in. It uses no analytics or advertising cookies and no analytics tools, and report pages tell browsers and search engines not to keep or index them. Stripe sets its own cookies on its checkout and billing pages to prevent fraud; its privacy policy covers them.
Children
Benchmark Monitor is a service for organizations. It is not directed at children, and you must be 18 or older to use it.
Changes
We will post changes here with a new effective date. If we change how we use account or recipient data in a way that matters, we will also email account owners at least 30 days before.
Contact
support@benchmarkhe.com
Bravery Media LLC, 5900 Balcones Dr. Ste 20207, Austin, TX 78731