Privacy Policy: Bonsai Manager
Last updated: May 20, 2026
Note: This is a translation of the Portuguese original for convenience. A legal review is recommended. In case of conflict, the Portuguese version prevails.
Bonsai Manager values your privacy. This policy explains transparently how we collect, use, store, and protect your personal data when you use our application and the website https://bonsai-manager-app.web.app/.
1. Data We Collect
For the application to work correctly and to enable new features, we collect the following categories of data:
Identification Data: Name, email address, and password (encrypted) for creating, authenticating, and securing your account.
Transaction and Subscription Data (Premium Plans): To manage your subscription (monthly or annual), we collect information about plan status, purchase history, and renewal dates. Note: Sensitive payment data, such as credit card numbers, security codes (CVV), and billing details, are collected and processed directly by the Stripe platform. Bonsai Manager does not store, view, or have access to your sensitive financial data, which are handled in accordance with Stripe's security and privacy policies.
Cultivation Data: Species, style, age, maintenance history, and the parameters of custom alerts/reminders that you schedule for your bonsais.
Media: Photos of your bonsais that you choose to upload to the system to build a visual history.
Notification and Device Data: Unique mobile device identifiers (Push Notification tokens) to enable delivery of scheduled and automatic alerts on your device screen, as well as records of emails sent.
Technical Data: IP address, device type, operating system version, and error logs for technical support and continuous improvement of the app's performance.
2. Purpose of Processing
Your data are used exclusively for the following purposes:
Service Provision and Contract Performance: Allow you to manage your collection, save data in the cloud, use subscriber-exclusive tools, and sync your information on any device.
Sending Alerts and Notifications:
- Trigger personalized maintenance reminders on the date and time you configured.
- Send automatic notifications created by the system with tips, suggestions, and educational content based on your cultivation context and interests.
Financial Management: Validate your subscription status (active/canceled), manage plan validity periods, and avoid undue interruptions of Premium features.
User Support: Answer questions, process support requests, and resolve technical or billing issues.
Security: Prevent fraud, ensure the integrity of your account, and protect the application's infrastructure.
3. Legal Basis for Processing (LGPD)
Under Brazil's General Data Protection Law (LGPD), we process your data based on the following legal grounds:
- Consent: When you accept this policy for photo processing and sending communications.
- Contract Performance: Essential to provide the application's features, manage contracted subscription plans, and trigger configured alerts.
- Legitimate Interest: For technical improvements, application security, and sending contextualized automatic alerts of interest to the user.
- Compliance with Legal Obligation: For retaining access logs and fiscal/financial subscription data, when applicable.
4. Data Sharing
Bonsai Manager does not sell, rent, or commercialize your personal data with third parties under any circumstances. Sharing occurs strictly with partners and subprocessors essential to providing the service, such as:
- Infrastructure and Cloud Providers: Hosting, processing, and cloud database services (e.g., Firebase/Google Cloud Platform).
- Payment Processing Platform: Data needed for billing and processing recurring subscriptions are shared securely with Stripe and processed under that partner platform's responsibility and terms.
- Notification Services: Tools for sending emails and push notifications (e.g., Firebase Cloud Messaging).
- Advertising and Measurement Platforms: Meta Platforms (Pixel on the website and App Events in the app) and Google (Firebase Analytics / Google Ads), to measure campaigns, optimize ads, and run remarketing. Data is sent according to cookie consent on the website and system tracking permissions in the app.
- Legal Authorities: If we are required by law, regulation, or strict court order.
5. Storage and Security
Location: Your data are stored on highly secure international cloud servers that meet rigorous data protection standards.
Protection: We use state-of-the-art encryption protocols (SSL/TLS) for the secure transit of information. Payment data travel directly to Stripe, which uses the highest security standard in the financial industry (PCI-DSS Compliant).
Data Retention: Your data remain stored while your account is active.
- If you request account deletion, all of your personal data, photos, and cultivation histories will be permanently deleted within 30 days.
- In the case of subscription cancellation, your cultivation data are not deleted; your account simply returns to "Free Plan" status, preserving your history.
- Information relating to financial transactions and billing history held with Stripe may be retained for longer periods to comply with tax, accounting, and legal obligations of the payment platform or the application.
6. Your Rights (Art. 18 of the LGPD)
As a data subject, you have rights guaranteed by the LGPD, which may be exercised at any time free of charge within the application:
- Confirm the existence of processing and access your data.
- Correct incomplete, inaccurate, or outdated information.
- Request permanent deletion of your data (withdrawal of consent).
- Manage your privacy preferences (such as enabling or disabling push notification permissions on the device itself or in the app settings).
7. Use of Cookies (Website)
Our institutional website uses essential technical cookies for the page to work. With your consent, we also use Meta Pixel marketing cookies to measure visits, download clicks, and campaign conversions on Instagram and Facebook, as well as remarketing. You can accept or decline in the cookie banner; without consent, the Pixel is not loaded. The app sends equivalent events to Google (Firebase Analytics) and Meta (App Events), subject to system permissions (such as App Tracking Transparency on iOS).
8. Contact and Data Protection Officer (DPO)
To exercise your data subject rights, ask questions about this Privacy Policy, or about the processing of your subscription and notification data, contact our Data Protection Officer at: bonsaimanagerapp@gmail.com.