Privacy

Bonzaii is a passion project. I'm Romaric Delahaie, and I built it to explore AI-native product management.

If you sign up, I store your email address so you can log in. I also store the product content you add, so Bonzaii can show it back to you. I don't sell your email. Service providers process it where needed to run sign-in, send expected messages and host your workspace.

Lovable Cloud hosts the app's database, sign-in service, server functions and file storage. Lovable's email service sends sign-in and app messages; some support, invitation and operational messages still use Resend. These services receive the addresses, message content and delivery details needed for those messages. App-email unsubscribe choices are handled by the sending service; sign-in and password-reset messages are separate.

When you use an AI feature, the relevant workspace content and your request are sent through Lovable's AI gateway to the model answering it, including Google Gemini or OpenAI. Provider retention and training settings have not been independently verified here; I don't promise an unverified deletion period. If you connect Notion or import from GitHub, those services also handle the content and credentials needed for that connection. Those integrations are optional.

Bonzaii uses cookies and browser storage to keep you signed in and remember your settings. To see how the website is used, it also counts visits: the pages you open, your device type, the site you came from (including any campaign tags in the link) and a rough location worked out from your internet address. There's no advertising and no advertising tracking. The analytics service currently asks ip-api.com for a country and city using your IP address. That lookup currently uses HTTP, a limitation recorded for correction. Your IP address itself is not stored: only the country, the city and a scrambled code that changes every week are kept, used to count unique visitors. Browser storage is also used for visit/session identifiers; a complete consent assessment is still pending.

Workspace content stays until it is removed or your account is erased. Deleted uploaded files have a 30-day restore window before stored copies are purged. Data-download links are available for 7 days and their signed download addresses last 10 minutes; automatic removal of expired archive files has not yet been verified. Sign-in, email-delivery, analytics and error logs have separate retention settings that I have not yet fully verified.

Cloud database backups are daily snapshots, normally retained up to roughly 14 days, and do not include stored files. The available snapshots must be checked in the project's backup view. Backup expiry and service-provider retention can mean that deleting active data does not immediately remove every retained copy.

In Settings → Profile, “Download all my data” requests a ZIP of a workspace or product you can export. It includes CSV and JSON records and readable uploaded files, with omitted files listed in the manifest. Large workspaces are prepared in several short steps, so the download can take a few minutes.

To delete your account, email me at romaric.delahaie@gmail.com. You can also request deletion in Settings → Profile. There is a 7-day cancellation window; after processing starts it cannot be cancelled. Work retained in other people's shared workspaces is credited to “Former member”.

To report a security issue, email romaric.delahaie@gmail.com.