CANOPYby Bonsai Global

Privacy Policy

Effective date: September 15, 2026

Who operates CANOPY

CANOPY is operated by Bonsai Global, LLC, 1871 44th Avenue, San Francisco, CA 94122, United States. Contact niko@bonsaiglobal.io with questions or privacy requests.

This policy describes the public CANOPY website and the processing used to provide CANOPY. For customer-controlled information, the customer determines its business purposes and authorizes connected sources. Bonsai processes that information to provide the instructed service. Bonsai separately handles business inquiries, service administration, security and legal matters for its own operational purposes where applicable. A customer's written agreement may further define these responsibilities.

Information used by the service

Depending on the sources a customer authorizes, CANOPY processes:

The currently approved sales-email processing is limited to relevant engagement metadata, such as timestamps, direction, sales-inbox involvement and associated CRM records. Email subjects, bodies, HTML, attachments, full headers and unrelated correspondence are outside that processing scope.

Customer source fields can contain personal information. Customers should not intentionally use CANOPY for sensitive personal-data processing outside an expressly agreed scope.

Purposes and authorization

CANOPY uses connected information for reporting, supported buyer journeys, known-company context, inspectable deterministic findings and customer-authorized exports. Known and anonymous activity remain distinct unless supported linkage is available. Observed acquisition and research do not establish causal attribution.

Customers must have authority to connect selected resources and provide appropriate notices and permissions for their use. Customer-authorized CANOPY intelligence may be written to designated CRM properties and Notes. Google source authorization does not authorize those CRM writes or unrelated changes to source records.

Google connection and data use

Google reporting data supports the website, search and advertising analysis described above. The intended standard source-only connection requests OpenID and email to identify the authorizing account, Analytics and Search Console read access, and the Google Ads permission needed for reporting. Google's Ads scope includes management capabilities, while CANOPY's source-reporting operations are read-only.

This intended source-only connection is separate from cloud-infrastructure access. Existing customer connections may have a different previously authorized configuration until migrated. Permissions shown during authorization and the customer's agreed configuration determine access; this policy does not expand them.

CANOPY's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Bonsai Global does not sell Google user data accessed through CANOPY, use it for unrelated advertising or profiling, or use customer Google data to train general-purpose AI models. Google user data is used only for CANOPY's disclosed customer-facing functionality; transfers and other uses remain subject to Google's applicable restrictions.

Humans may read connected Google data only with the user's affirmative agreement to access specific data, when necessary for security or legal obligations, or for permitted aggregated internal operations under the applicable Google User Data Policy. Routine support or maintenance alone does not authorize human reading of connected Google data.

Storage and security

The current customer-deployment architecture uses Google Cloud services, including BigQuery for evidence, Secret Manager for connection material, and Cloud Run for application processing. Access is controlled through application authentication, roles and cloud permissions. Managed encryption and HTTPS help protect information, but no system can eliminate all risk.

Storage and processing locations depend on the deployment and provider service. They may include Canada, the United States and other locations used by providers. A regional reporting database does not mean every credential, log, support operation or backup is confined to that region.

Providers and access

Google Cloud provides hosting, storage, credential and operational infrastructure. Firebase Hosting serves the public site. Google Analytics, Search Console, Google Ads and HubSpot are customer-connected services with their own terms and privacy practices. Customer-directed exports or CRM synchronization make information available to the authorized recipients and systems involved.

For non-Google customer data, access by authorized Bonsai personnel or service providers is governed by the applicable customer authorization, service agreement and privacy requirements, and is limited to the information needed for the authorized purpose. Access to connected Google data is subject to the narrower human-access rule above; ordinary support or maintenance is not an independent basis. Contact Bonsai for the processing arrangements relevant to a particular deployment.

Retention, disconnection and deletion

Information is retained according to the service purpose, customer instructions, applicable agreement, source-specific settings and operational or legal requirements. Retention varies by information category; not all historical reporting, exports or operational records share a single expiration period.

Disconnecting a source stops its use through the stored connection but does not automatically revoke the provider's authorization, erase previously collected evidence, delete retained credential versions or remove source-system records. Provider-side revocation is a separate action and may affect other connections using the same grant.

An authorized customer may request return or deletion by contacting Bonsai. Requests are verified and scoped to the correct customer, data categories and systems. Bonsai will explain the applicable process, expected timing and any necessary exceptions. Native records in the customer's CRM, Google services or website are not automatically deleted. Removal of CANOPY-owned CRM intelligence requires a specific instruction.

Backups, provider recovery copies, security logs and records required by law may remain for their applicable retention periods. Deletion does not necessarily mean immediate physical erasure from every recovery system. Customer-held exports and third-party copies may require action by their respective custodians.

Public website and inquiries

The CANOPY public site does not include analytics tags, advertising pixels or client-side tracking scripts. Its hosting provider still processes technical request information, including IP addresses, to deliver and secure the site. A contact link opens your email application; information you send is used to handle your inquiry.

Privacy requests and updates

Depending on applicable law and the circumstances, individuals may have rights concerning access, correction, deletion, restriction, objection or portability, and may contact the relevant privacy authority. Requests about a customer's underlying records should ordinarily be directed to that customer; Bonsai can help identify the appropriate route. Identity or authority may need to be verified before information is disclosed or changed.

This policy may be updated to reflect service or legal changes. The effective date identifies the version. Material changes in connected-data use may require additional notice or authorization before they take effect.

Optional AI Analysis Packages

An authorized CANOPY user may choose to download an AI Analysis Package containing evidence available to that user's role, relevant comparison history, CANOPY findings, source information and analysis instructions. CANOPY generates the package on request. Generating or downloading it does not automatically send it to an AI provider.

CANOPY applies export rules intended to exclude direct personal identifiers and prohibited free-text content. These rules are not a guarantee of anonymity. A package may still contain commercially sensitive company information, deal context, campaign performance, search terms and de-identified journey records. Users should inspect the package before sharing it and must have authority to disclose its contents to the chosen recipient.

If a user chooses to upload a package to a third-party AI service, that service's applicable terms, privacy practices, retention settings and data-use settings govern its processing. Users must choose a service and configuration permitted by their organization and applicable data-use restrictions. Downloading or de-identifying Google user data does not remove applicable Google API Services User Data Policy or Limited Use obligations, including restrictions applying to derived or aggregated data. This feature does not authorize sale, unrelated advertising or profiling, general-purpose AI training, or human access outside CANOPY's stated Google-data-use commitments.

For security and operational traceability, CANOPY records limited package-generation metadata, such as the time, authorized actor reference, selected route and period, file and record counts, package size and generation duration. Package contents and connected credentials are not included in this metadata log. CANOPY temporarily stores the prepared package in protected server-side storage so the requesting user can download it after preparation. Current user access is checked before download. The download window expires 30 minutes after preparation completes. An automatic cleanup process is scheduled every 15 minutes to delete expired packages and request metadata; a separate one-day storage lifecycle rule provides a deletion backstop. These schedules do not guarantee immediate physical deletion during a service failure. CANOPY does not keep a permanent server-side archive of completed packages as part of this feature. The downloaded copy is controlled by the recipient.