Bonsai

GDPR overview

Implementation is real but partial. Bonsai publishes a Data Processing Addendum setting out its commitment to handling personal data in compliance with the GDPR, downloadable as an EU-US addendum dated 5 August 2025 and countersigned on request. The privacy policy, last updated the same day, names lawful bases for European processing (consent, contractual necessity, legal obligation, legitimate interests) and the rights of access, portability, rectification, erasure, restriction, objection, consent withdrawal and complaint to a supervisory authority. Transfers out of Europe rely on adequacy decisions, contractual protections, binding corporate rules or derogations, and a subprocessor list is published through the Trust Center. Two gaps stand out: no Article 27 EU representative is named anywhere, and there is no dedicated privacy mailbox, everything going to the general support address.

Who owns the data?

Ownership stays with you. Bonsai's terms state that you retain the copyright and proprietary rights in the User Content you post. In exchange you grant Bonsai a worldwide, non-exclusive, royalty-free, sublicensable licence to host, store, transfer, display, reproduce, reformat, create derivative works from and distribute that content, including for risk management and collections. Bonsai itself owns the platform: interfaces, code and software. Feedback you send is treated more broadly still, under a perpetual and irrevocable licence. Where your own clients' personal data is concerned, Bonsai acts as processor and you remain the controller. On termination you may lose access to what you posted, so keeping copies is your responsibility.

Reuse rights

You may reuse your own data freely: nothing in the terms restricts it. You choose whether each piece of User Content stays private to your account or is shared publicly, and data exports are a listed feature of the reporting suite. Built-in tools push information to connected third-party services, and using one authorises that transfer, after which Bonsai no longer controls what happens to it. Two cautions temper this. Bonsai may modify or discontinue any part of the service without notice, and closing an account can remove access to what you posted. The terms therefore tell you plainly to keep your own permanent copies of anything that matters.

Data retention & training

Hosting summary

Bonsai hosts its services in the United States. The privacy policy is explicit: if you use the services from Europe or another region, your personal data is processed and stored in the U.S., and Bonsai may transfer it from there to other countries for storage, processing and operating the platform. For European users, Bonsai says it complies with applicable European transfer rules, relying on adequacy decisions, contractual protections, binding corporate rules or an appropriate derogation, and it publishes an EU-US Data Processing Addendum dated 5 August 2025. No EU data residency option is offered. A subprocessor list is published through the Trust Center at trust.hellobonsai.com, and the vendors named in the privacy policy include SendGrid, Customer.io, Intercom, Stripe, Chartmogul, Google Analytics, Mixpanel and Plaid. The marketing site itself sits behind Cloudflare. One caveat: the Trust Center is a JavaScript-rendered page whose subprocessor list and any security certifications could not be read during this review, so that part rests on the link Bonsai publishes rather than on the list itself.