Privacy policy

This policy describes what data we collect, why we collect it, and what your rights are. We're Hix Digital Ltd (the "controller"), trading as Kentai Bonsai, registered at 20 Old Bond Street, Bath BA1 1BP, United Kingdom. Contact: info@kentaibonsai.com.

What we collect

• Account data — your name, email and a password hash (we never store the password itself).
• Tree data — names, species, styles, notes, photos and care logs you record.
• Location — the postcode/city you set, and the latitude/longitude we derive from it. Used to fetch local weather for the AI care summary.
• Subscription data — Stripe customer ID, subscription status and the dates of your current billing period. We do not see or store your card details — those stay with Stripe.
• WhatsApp delivery — your phone number and a record of when we last sent a message, if you opt in.
• Marketplace listings — anything you publish on a marketplace listing is, by definition, public.

Why we use it

• To provide the service you signed up for (lawful basis: contract).
• To bill you for a subscription (lawful basis: contract).
• To send you the daily WhatsApp summary and weather alerts you opted into (lawful basis: consent — withdraw any time by replying STOP or disabling on the billing page).
• To detect and prevent abuse of the service (lawful basis: legitimate interest).

Who we share data with

We use a small number of third-party processors strictly to operate the service:

• Anthropic (US) — receives your tree list, care state, location and weather to generate the AI summary. Anthropic's API does not retain data beyond the call itself for the model used.
• Stripe (Ireland / US) — handles all subscription payments. They are the data controller for your card details.
• Twilio (US, via Ireland for EU traffic) — sends WhatsApp messages on our behalf. They receive your phone number and the message body.
• Open-Meteo (Germany) — receives the latitude and longitude of your saved location to return local weather.
• Nominatim / OpenStreetMap (Germany / UK) — receives the location string you entered (postcode/city/address) to convert it to coordinates.
• Microsoft Azure / our hosting provider — operates the servers your data lives on.

We do not sell your data. We do not share it for advertising. We do not train AI models on your data.

Where data is stored

Application data lives in our database in the United Kingdom. Some processors above are based outside the UK; transfers to those processors rely on the standard contractual clauses or equivalent UK adequacy mechanisms.

How long we keep it

While your account is active, we keep your data so the service works. If you delete your account, we delete or irreversibly anonymise your tree data, care logs and photos within 30 days. Some records (e.g. invoices) are retained for up to 6 years to meet UK accounting requirements.

Your rights

Under UK GDPR you can ask us to:

• Give you a copy of the data we hold about you.
• Correct anything that's inaccurate.
• Delete your account and associated data.
• Export your data in a portable format.
• Object to processing, where the lawful basis is legitimate interest.

Email info@kentaibonsai.com and we'll action it within 30 days. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk).

Cookies

We use one cookie: a session cookie (kentai_sid) that keeps you logged in. It's marked Secure and HttpOnly. We do not use analytics, advertising or third-party tracking cookies.

Changes to this policy

If we make material changes we'll email you and update the date at the top of this page.