This policy explains what data we process when you use Bengala, why, and what rights you have. Version dated 4 November 2026.
In short: we ask for as little as possible. Your playlists and what you watch stay on your devices; if you sync, they travel encrypted with a key we do not have. We don’t use your data for advertising and we don’t sell it.
1. Data controller
Manuel Roldán Pérez, whose Spanish tax ID (NIF) and address are given in the legal notice. For any question about your data: support@bengala.tv.
2. What stays on your device
None of this ever reaches our servers:
- Your playlists and guides, with their addresses, usernames and passwords. They are stored encrypted on the device itself.
- What you watch: your history, favourites, progress, profiles, PIN and settings, unless you turn on sync (section 3.3).
- The technical playback log (when a video started or failed), which is only there so you can look at it in Settings. It does not include titles, channels or addresses.
- What you send from your phone using the QR code (a playlist, a guide, subtitles, a backup): it goes from your phone to the device over your Wi-Fi network, without passing through any server.
3. What we process, why and for how long
3.1. Account and licence
- Data: your email address; a device identifier that is worked out on the device itself and irreversibly transformed before it is sent; the device type and app version; your licences, the seats in use, and the dates of activations and device changes.
- Purpose: creating your account, sending you sign-in codes, activating your devices, checking your licence and applying the device limits.
- Legal basis: performance of the contract.
- How long: for as long as you have the account. Sign-in codes are stored only as an irreversible hash, stop working after 15 minutes or as soon as they are used, and are deleted no more than two days later.
3.2. Free trial
- Data: the transformed device identifier and the date its trial started.
- Purpose: making sure each device gets only one trial.
- Legal basis: our legitimate interest in preventing abuse of the free trial.
- How long: for as long as Bengala is on sale.
3.3. Sync between devices (if you use it)
If you sign in with your account, your playlists, profiles, favourites and progress are synced between your devices. They are encrypted on the device with a key that only your devices have: we store a document we cannot read, and keep its last ten versions so that we can help you recover it if something goes wrong. When a new device asks to join, we keep its type (for example, ‘LG TV’) for one day at most so that you can recognise it on your other devices.
- Legal basis: performance of the contract.
- How long: for as long as you have the account, or until you start sync again from scratch.
3.4. Payments
Payments are processed by Stripe. Stripe receives your card or other payment method details, your email address and your country, and processes them under its own privacy policy, including to prevent fraud. We never see your card details: from Stripe we only receive the result of each payment, the customer, subscription and payment identifiers, and the invoices.
- Legal basis: performance of the contract and compliance with legal obligations (tax and accounting).
- How long: invoices and the details of each sale, for as long as the law requires (up to six years).
If you buy on Google Play, payment is handled by Google under its own terms and privacy policy.
3.5. Emails
We only email you when we need to: sign-in codes, purchase receipts, renewal reminders and replies to your questions. We don’t send advertising. Codes are sent through Brevo; receipts and payment notices, through Stripe.
If you email us, we keep the conversation for as long as we need to help you and for two years afterwards at most.
3.6. Server logs
Like any internet service, our server provider logs the IP address and time of each request. We use this only to keep the service running and secure, and it is deleted after a few days. Legal basis: our legitimate interest in keeping the service secure.
4. Artwork and information about films and series
To show artwork, synopses and cast lists, the device may look up the titles of the films and series in your playlists directly with TheTVDB (TheTVDB, LLC, United States) and download the images from there. These lookups do not go through our servers. TheTVDB sees your connection’s IP address and the titles looked up, and processes them under its own privacy policy.
5. The website
This website does not use cookies, analytics tools or advertising, and does not load resources from other companies. There are more details in the cookie policy.
6. Who else processes your data
We work with these providers, who process the data only to provide their service to us:
- Cloudflare (Cloudflare, Inc., United States): servers, database and website hosting.
- Brevo (Sendinblue SAS, France): sending codes by email.
- Stripe (Stripe Payments Europe, Ltd., Ireland): payments. For some purposes, such as fraud prevention and its own legal obligations, Stripe processes the data as an independent controller.
We don’t sell your data or pass it on to anyone, except where the law requires us to.
7. Transfers outside the European Economic Area
Cloudflare and TheTVDB are in the United States. Transfers to Cloudflare are covered by the EU-US Data Privacy Framework and the European Commission’s standard contractual clauses.
8. Your rights
You can ask us at any time to give you access to your data, correct it or delete it, to object to or restrict our processing of it, or to send it to you in a format you can take elsewhere. Email us at support@bengala.tv from your account’s email address.
Deleting your account: email us from that address and we will delete it, along with its licences, devices and sync document. We will only keep the sales data the law requires us to keep.
If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or to the data protection authority in your country.
9. Children
You must be at least 14 to create an account, or older if the law in your country requires it. Bengala includes kids profiles and parental controls so that the adult on the account can decide what children in the household can watch.
10. Security
Your playlist addresses are stored encrypted on the device; sync is end-to-end encrypted; sign-in codes expire after 15 minutes and are stored only as an irreversible hash; and licences are signed so that they cannot be forged.
11. Changes
If we change this policy, we will say so on this page with a new date and, if the change is significant, we will let you know by email.