Privacy Policy

This Privacy Policy applies to information collected through the GoBonsAI website at gobonsai.ai, the GoBonsAI application, and any related services operated by AlphaBlossom, LLC("AlphaBlossom," "we," "us," or "our"). GoBonsAI is a product of AlphaBlossom, LLC.

This policy works alongside our Terms of Service. Defined terms used here have the meanings given in the Terms.

We collect the following categories of information:

Information you provide

• Account information. Name, email address, password (stored hashed), business name.
• Business profile. Industry, target audience, services, voice DNA setup, founder stories, pillars, frameworks, banned vocabulary, and any other content you submit through onboarding or ongoing profile edits.
• Generated content. The posts, captions, images, and metadata produced by the engine for your account.
• Feedback signals. Ratings, thumbs, soft-deletes, edits, and other input you provide on generated outputs.
• Communications. Messages you send us through support requests, the waitlist form, email, or other channels.
• Payment information. Card and billing information is collected and processed directly by our payment processor. We receive a token, the last four digits, the card brand, and the billing country, but not the full card number.

Information from integrations

• GoHighLevel. When you connect your GHL account, we receive the authentication tokens and account metadata needed to schedule posts on your behalf, plus the social channels you select for publishing.

Information collected automatically

• Usage data. Pages viewed, features used, generation timestamps, error logs, archetype and content-type selections, generation latencies.
• Device and network data. IP address, browser type and version, operating system, approximate location derived from IP, referring URL, language preferences.
• Cookies and similar. Described in Section 8.

We use the information we collect to:

• Provide, operate, and maintain the service
• Generate content tailored to your business profile
• Authenticate your account and keep it secure
• Process payments and manage your subscription
• Send you transactional and service-related messages
• Respond to your requests and provide support
• Improve the service, including refining the engine, the content library, the orchestrator, and our prompt systems using feedback signals and aggregated, de-identified usage metrics
• Detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms
• Comply with legal obligations and enforce our agreements
• Send marketing communications about new features or offerings, only where permitted and with the ability to opt out

To generate content, the service sends elements of your business profile, voice data, and prompt context to AI model providers:

• Anthropic for text generation (the Claude family of models, currently Claude Sonnet 4.6).
• Google for image generation (Gemini-family image models, currently Gemini 3.1 Flash).

These providers receive the inputs needed to perform the requested generation and return the generated output to us. Each provider has its own privacy policy and data-handling terms; we choose providers that offer enterprise-style data terms, including a commitment by default not to use API data to train their foundation models.

Generated outputs are stored in our database (Supabase) and associated with your account. Feedback signals on those outputs are stored alongside them.

We do not provide your User Content or Generated Content to third-party AI providers for foundation-model training. The terms we maintain with our AI providers prohibit such use of API inputs and outputs, and we rely on those commitments.

We do use signals about how the service performs, including aggregated, de-identified product metrics, ratings, and generation telemetry, to improve our own engine, prompts, orchestrator, and content library. This kind of product improvement is internal to GoBonsAI; it is not the same as training an external AI model.

If we ever change this approach, including offering an opt-in program where customer content could be used for fine-tuning or training, we will update this policy and notify you before the change takes effect, with the ability to opt out.

We share information in the following limited circumstances:

• Sub-processors. We share information with the service providers listed in Section 7, who help us operate the service under contracts that require confidentiality and limit use to the purpose we direct.
• Integrations you authorize. When you connect your GoHighLevel account, we share generated content with GHL on your behalf in order to schedule and publish posts.
• Legal compliance. We may disclose information to comply with a subpoena, court order, or other lawful request; to enforce our agreements; to protect the safety, rights, or property of AlphaBlossom, our users, or others; or in connection with fraud or security investigations.
• Business transfers. If AlphaBlossom is involved in a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction, subject to standard confidentiality protections.
• With your consent. We may share information when you direct us to or otherwise consent.

We do not sell your personal information.

We use the following sub-processors to operate the service. We may update this list as we add or change providers; we will keep this section current.

For EU and UK data transfers, where applicable, we rely on the European Commission's Standard Contractual Clauses or another lawful transfer mechanism with each sub-processor.

We use cookies and similar technologies to keep you signed in, remember your preferences, secure the service, and understand how the service is used. Specific categories include:

• Essential cookies. Authentication, session management, security. The service will not function correctly without these.
• Functional cookies. Preferences such as language and UI settings.
• Analytics. Aggregated usage measurement that helps us improve the product.
• Lead capture. Our public website uses GoHighLevel's external tracking script to capture form submissions (such as the waitlist form) and link them to your contact record.

You can control cookies through your browser settings. If you are in the EU, UK, or another region that requires consent for non-essential cookies, we will surface a consent control before such cookies are set.

We retain your information for as long as your account is active and for a reasonable period afterward to comply with legal obligations, resolve disputes, enforce our agreements, and provide continuity if you reactivate. General defaults:

• Account and business-profile data: retained while the account is active; deleted on account closure subject to legal and backup retention.
• Generated content: retained while the account is active; deleted on account closure subject to legal and backup retention.
• Feedback and product telemetry: retained in aggregated, de-identified form for service improvement; not deleted on account closure because it no longer identifies you.
• Billing records: retained for the period required by applicable tax and accounting law (generally seven years in the United States).
• Support communications: retained for up to three years.

Backups are kept for short periods (typically thirty days) for disaster recovery. Deleted data may persist in backups until the backup cycle completes, after which it is removed.

We use industry-standard measures to protect your information, including encryption in transit (TLS), encryption at rest for sensitive data, access controls, authentication, and infrastructure that follows recognized security practices for our hosting providers.

No system is perfectly secure. We cannot guarantee that unauthorized access, hardware or software failure, or other factors will never compromise the security of your information. If we become aware of a breach that affects you, we will notify you as required by law.

AlphaBlossom is based in the United States, and our sub-processors are primarily located in the United States. If you access the service from outside the United States, your information will be transferred to and processed in the United States, where data-protection laws may differ from those of your country.

For transfers of personal data from the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (SCCs) or equivalent mechanisms with the relevant sub-processors and counterparties.

Regardless of where you live, you can:

• Access the personal information we hold about you
• Correct inaccurate information
• Request deletion of your account and associated personal information
• Export a copy of your data
• Opt out of marketing communications

Most of these can be done from your account settings. For anything that cannot, email [email protected] with the request. We will verify your identity before acting on the request and respond within a reasonable time.

If you are in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) or equivalent UK GDPR applies to processing of your personal data. AlphaBlossom acts as the data controller for account data and as a data processor for content you input into the service on behalf of your business.

Legal bases for processing. We process personal data on the following bases: performance of a contract with you (operating the service), legitimate interests (security, fraud prevention, service improvement, marketing to existing customers), consent (where required for non-essential cookies and certain communications), and legal obligation (tax, accounting, response to legal process).

Your GDPR rights. In addition to the rights listed in Section 12, you have the right to restrict processing, the right to object to processing based on legitimate interests, the right to data portability, and the right to lodge a complaint with your local data-protection authority.

To exercise any of these rights, contact us at [email protected]. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you specific rights regarding your personal information.

Categories of personal information. In the last twelve months, we have collected the following categories of personal information described in the CCPA: identifiers (name, email, IP address), commercial information (subscription details), internet activity (usage and device data), and inferences drawn from the above to provide and improve the service. We collect this information for the purposes described in Section 3.

Sale or sharing. We do not sell personal information for money. We do not share personal information with third parties for cross-context behavioral advertising. If this ever changes, we will update this policy and provide an opt-out mechanism.

Your California rights. You have the right to know what personal information we collect, the right to delete personal information, the right to correct inaccurate personal information, the right to limit use of sensitive personal information, and the right not to be discriminated against for exercising your rights.

To exercise these rights, contact us at [email protected]. You may authorize an agent to make a request on your behalf with appropriate documentation.

GoBonsAI is not directed to children. We do not knowingly collect personal information from anyone under 13, or under 16 where applicable under local law. If you believe a child has provided personal information to the service, contact us at [email protected] and we will take appropriate steps to remove it.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make a material change, we will notify you by email or by an in-product notice before the change takes effect.

The "Last updated" date at the top of this policy tells you when it was last revised.

If you have questions about this Privacy Policy or our privacy practices, contact us:

AlphaBlossom, LLC
5647 SW Arctic Drive, Beaverton, OR 97005, United States
Email: [email protected]