Privacy Policy

1. Data controller

Bonsai Prep is the data controller responsible for your personal information. For privacy inquiries, please visit our Support page.

2. Information we collect

We collect the minimum data needed to provide our services:

Information you provide

• Account information (name, email address, password)
• Profile details you optionally provide (test date, goal score, grade level)
• Practice activity (answers, timing, question selections)
• Communications you send to us (support messages, feedback)

Information collected automatically

• Device information (browser type, operating system, screen resolution)
• IP address and approximate location (country/region level)
• Usage data (pages visited, features used, session duration)
• Cookies and similar technologies (see our Cookie Policy)

3. Lawful basis for processing (GDPR)

If you are in the European Economic Area (EEA) or the United Kingdom, we process your data under the following legal bases:

• Contract performance — processing necessary to provide you with the Service (account management, practice features, progress tracking)
• Consent — for optional data processing such as analytics cookies, marketing communications, and optional profile details
• Legitimate interest — to improve our Service, prevent fraud, and ensure security, where such interests are not overridden by your data protection rights
• Legal obligation — to comply with applicable laws and regulations

4. How we use your information

• Personalize your practice experience and show progress (dashboard, bonsai growth)
• Provide AI-powered tutoring and adaptive question selection
• Communicate with you about your account, updates, and support requests
• Improve product quality, reliability, and user experience
• Ensure security and prevent fraud or abuse
• Comply with legal obligations
• Generate aggregated, anonymized analytics to improve the Service

5. Data sharing and third parties

We do not sell your personal data. We may share data with the following categories of service providers who assist in operating the Service:

• Hosting and infrastructure — cloud servers for hosting the platform
• Authentication — identity verification and session management
• Payment processing — Stripe processes payments securely; we do not store your full credit card details
• AI services — AI providers that power tutoring features (questions and responses may be processed by these services)

All third-party providers are contractually required to protect your data and use it only for the purposes we specify.

6. Data retention

We retain your personal data for as long as your account is active or as needed to provide you with the Service. If you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required to retain it for legal, regulatory, or legitimate business purposes (e.g., fraud prevention records may be kept for up to 2 years).

7. Your rights (EEA / UK — GDPR)

If you are located in the European Economic Area or the United Kingdom, you have the following rights:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your personal data ("right to be forgotten")
• Right to data portability — receive your data in a structured, machine-readable format
• Right to restrict processing — request that we limit how we use your data
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us through our Support page. We will respond to your request within 30 days.

8. Your rights (California — CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:

• Right to know — request disclosure of the categories and specific pieces of personal information we collect
• Right to delete — request deletion of your personal information
• Right to opt-out of sale — we do not sell personal information, so this right does not apply
• Right to non-discrimination — we will not discriminate against you for exercising your privacy rights

9. Children's privacy

Bonsai Prep is designed for SAT preparation and is intended for students aged 13 and older. We do not knowingly collect personal information from children under 13 without verifiable parental consent, in compliance with the Children's Online Privacy Protection Act (COPPA). If you believe we have collected information from a child under 13 without proper consent, please contact us immediately and we will delete the information.

10. International data transfers

Your data may be processed and stored in the United States or other countries where our service providers operate. When we transfer data outside of the EEA or UK, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the European Commission.

11. Cookies

We use cookies and similar technologies as described in our Cookie Policy. You can manage your cookie preferences through the cookie consent banner or your browser settings.

12. Security measures

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Access controls and authentication requirements for internal systems
• Regular security reviews and monitoring

While we strive to protect your data, no method of transmission over the Internet is 100% secure.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting the updated policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.

14. Your choices

You can review and update your personal information in Privacy Settings. You may also unsubscribe from non-essential communications at any time.

15. Contact us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please visit our Support page.