Privacy Policy (draft)

Oct 15, 2026 · @Ashu

1. Overview and who we are

This Privacy Policy explains what personal information Bonssai collects, how we use it, and the choices you have. [LEGAL ENTITY NAME] ("Bonssai," "we," "us") operates the Bonssai app and the website at bonss.ai. This Policy is part of our Terms of Service Terms of Service. Effective date: [EFFECTIVE DATE].

Journal entries can reveal health, mood, relationships, and other sensitive details. We treat everything you write or say in Bonssai as sensitive personal information.

2. Information we collect

• Account information: name, email, phone number, date of birth, and sign-in credentials.
• Your Content: journal entries, check-ins, voice recordings, call transcripts, and corrections you give Bonssai.
• Derived information: summaries, themes, and patterns the AI generates from Your Content. These can relate to your mental or physical health.
• Phone information: the number you call from and the time and length of each call.
• Payment information: handled by our payment processor, [PROCESSOR NAME]. We do not store full card numbers. [DELETE IF BONSSAI IS FREE.]
• Device and usage information: device type, operating system, IP address, app version, crash reports, and which features you use.
• Messages you send us, such as support requests.

3. How we use information

We use your information to run the Service for you: generating responses, transcribing calls, saving check-ins, and finding patterns in your entries. We also use it to show crisis resources when we detect certain language, to secure the Service and prevent abuse, to answer your requests, to meet legal obligations, and to improve the Service using usage data that does not include the text or audio of Your Content.

We do not use Your Content for advertising, and we do not use it to build profiles for anyone but you.

4. AI processing and model training

We send Your Content to AI model providers so Bonssai can respond to you, summarize your entries, and transcribe your voice. Responses and patterns are generated automatically.

[CONFIRM BEFORE PUBLISHING: We do not use Your Content to train or fine-tune AI models, and our agreements with our AI providers prohibit them from using it to train theirs. Check each provider's current terms, including any retention or abuse-monitoring period, and edit this paragraph to match what really happens.]

[CONFIRM BEFORE PUBLISHING: No employee reads your entries except to investigate abuse or a security incident, to meet a legal obligation, or when you ask for support and give permission.]

5. Service providers

We use outside companies to deliver the Service: AI model providers, speech and telephony providers, cloud hosting and storage, payment processing, error monitoring, and email and support tools. [LIST EACH PROVIDER BY NAME, OR LINK TO A CURRENT LIST.] They may use your information only to provide services to us, under contracts that require confidentiality and security.

We do not allow advertising or analytics tools to receive Your Content. [CONFIRM BEFORE PUBLISHING: no advertising SDKs, tracking pixels, or third-party analytics receive entries, transcripts, or health-related data from the app or from pages where you are signed in. The FTC has penalized wellness apps for sharing this kind of data with ad platforms.]

6. Phone and voice recording

At the start of every phone or voice session, we tell you that you are speaking with an AI and that the session is recorded. You can end the session before anything is captured. If you continue, you consent to the recording and transcription.

Recordings and transcripts are part of Your Content. We keep them until you delete them, and you can delete them in the app. If you do not want a session recorded, do not use the phone features. [CONFIRM: text journaling stays available without them.] If other people can be heard on your call, you are responsible for telling them about the recording.

7. Sharing and disclosure

We do not sell your personal information, and we do not share it for advertising across other companies' services. We share it only with the service providers described above, at your direction, and in these situations: when a valid legal request such as a subpoena or court order requires it, when needed to protect someone's safety or the security of the Service, and as part of a merger, acquisition, or sale of assets, in which case we will tell you if your information will be handled under a different policy.

We review legal requests for validity before responding. Conversations with Bonssai are not covered by medical confidentiality or clinician-patient privilege.

8. Retention and deletion

We keep Your Content until you delete it or close your account. In the app you can delete individual entries, recordings, and transcripts, or your whole account. Summaries and patterns derived from deleted content are deleted with it.

After you delete, we remove the data from our active systems within [30] days and from backups within [90] days, and we instruct our service providers to delete their copies. We keep limited records only where the law requires it, such as billing records for tax purposes, or where needed to resolve a dispute or prevent fraud.

9. Your rights

Depending on where you live, including California, Washington, and other states with privacy laws, you may have the right to know what we collect, access and correct it, delete it, get a portable copy, limit our use of sensitive information, withdraw consent, and not be treated worse for using these rights. We do not sell or share personal information for advertising, so there is nothing to opt out of.

Washington residents have additional rights under the My Health My Data Act, including the right to confirm whether we collect consumer health data, to see the third parties it has been shared with, to withdraw consent, and to have it deleted. We collect and share consumer health data only with your consent, which we ask for separately from the Terms. [COUNSEL: build this consent as its own screen at sign-up, not a line in the Terms.]

To use a right, open your settings in the app or email [PRIVACY EMAIL]. We may need to verify your identity, and we respond within the time the law requires, usually 45 days. If we deny a request, you can appeal by replying to our response, and you can also contact your state attorney general. [COUNSEL: add the California notice-at-collection details and category tables if Bonssai meets the CCPA thresholds. Washington's health data law applies regardless of company size.]

10. Security

We protect your information with [encryption in transit and at rest], access controls, and limits on which staff can reach Your Content. No system is perfectly secure, so we cannot promise that your information will never be accessed without permission. If a breach affects you, we will notify you and regulators as the law requires. [CONFIRM BEFORE PUBLISHING: every security statement here must match what you actually do. A security claim that turns out to be untrue is treated as deceptive.]

11. Children

Bonssai is for adults 18 and older. We do not knowingly collect information from anyone under 18. If we learn that we have, we will delete it and close the account.

12. Changes and contact

We may update this Policy. We will tell you about material changes in the app and by email at least [30] days before they take effect, and where the law requires it we will ask for your consent again. The effective date at the top shows the current version.

Contact: [LEGAL ENTITY NAME], [MAILING ADDRESS], [PRIVACY EMAIL]