PRIVACY POLICY

Last Updated: February 19, 2026

Bonsai Data Solutions Inc. ("Bonsai," "Company," "we," "us," or "our") is committed to maintaining robust privacy protections for its users. This Privacy Policy ("Privacy Policy") is designed to help you understand how we collect, use, and safeguard the information you provide to us and to assist you in making informed decisions when using our Site and Service.

For purposes of this Privacy Policy, "Site" refers to bonsai.llc, bonsaidata.io, and any other media form, media channel, mobile application, or other website related or connected thereto. "Service" refers to the Company's services accessed via the Site, including professional data solutions, services, and appointment requests. By accessing our Site or Service, you acknowledge the collection, storage, use, and disclosure of your Personal Information as described herein, and you agree to be bound by this Privacy Policy. If you do not agree to this Privacy Policy, you must not access or use the Site or Service.

I. INFORMATION WE COLLECT

We collect "Personal Information" and de-identified information. Under modern regulations, identifiers like IP addresses and cookie IDs are generally classified as Personal Information, as are certain online identifiers and information reasonably capable of being associated with a particular consumer or household.

1. Information You Provide to Us

We collect information you voluntarily submit through our contact forms, including:

• Identifiers: First and last name, email address, phone number (if you choose to provide it).
• Professional Information: Company of employment, business title, and business category.
• Inquiry Details: Service type and details pertaining to your request, as well as any other information you choose to provide in free-text fields.

We may also collect information if you contact us directly (for example, via email), including the contents of your message and any attachments you send us.

2. Information Collected via Technology

To improve the quality of our Service, we track information provided by your browser or device, such as:

• Referring URLs: The website you came from before visiting our Site.
• Device Information: Browser type, device type, and time/date of access.
• Cookies & Tracking: We use cookies and third-party analytics (e.g., Google Analytics) to capture page visits and traffic patterns, and to understand how users interact with the Site over time. Some of this information may be considered Personal Information under certain state privacy laws.

3. Data Retention

We retain Personal Information only for as long as necessary to fulfill the purposes for which it was collected, or as otherwise permitted or required by applicable law:

• Inquiry Data: Retained for the duration of our business relationship plus three (3) years.
• Technical Logs: Retained for up to five (5) years.
• Contractual Records: Retained for seven (7) years following contract termination.

When we no longer need Personal Information for the purposes described in this Privacy Policy, we will delete, de-identify, or aggregate it, unless we are required to retain it for longer (for example, to comply with legal, tax, or accounting requirements).

II. HOW WE USE AND SHARE INFORMATION

1. Use of Information

We use your Personal Information to communicate with you, respond to inquiries, and provide the Service, including to schedule and manage appointments, and to operate, maintain, and improve the Site. We use de-identified information and aggregated data to analyze trends and improve Site performance.

We may also use Personal Information to: (a) personalize your experience on the Site; (b) maintain the security and integrity of the Site and our systems; (c) comply with legal obligations and enforce our Terms of Use; and (d) protect the rights, property, and safety of the Company, our users, and the public.

2. Sharing Information with Third Parties

• Service Providers: We share information with vendors (e.g., email servers, CRM hosting) who perform services for the Company. They use your data only at our direction and are contractually required to protect your Personal Information and use it only for the services they provide to us.
• Legal Requirements: We may disclose information if required by law or to protect the safety and rights of our users, the Company, or others, including to comply with subpoenas, court orders, or other legal processes.
• Business Transfers: In the event of a merger or acquisition, your Personal Information may be transferred to the successor entity as part of the transaction, subject to the terms of this Privacy Policy or a successor privacy policy that provides materially similar protections.

Note on "Selling" vs. "Sharing": We do not sell your Personal Information for money. However, our use of analytics cookies may be considered "sharing" for cross-context behavioral advertising under certain state laws. You may opt-out as described in Section IV, and we will honor your opt-out choices to the extent required by applicable law.

We do not use or disclose your Personal Information for purposes that are materially different, unrelated, or incompatible with the purposes described in this Privacy Policy without providing you with notice and, where required, obtaining your consent.

III. SENSITIVE PERSONAL INFORMATION

The Company does not collect "Sensitive Personal Information" (such as Social Security numbers, precise geolocation, or biometric data) for the purpose of inferring characteristics about a consumer, nor do we use or disclose Sensitive Personal Information for any purposes that would require offering consumers a right to limit under applicable state privacy laws. Because we do not use Sensitive Personal Information for secondary purposes, we do not offer a "Limit the Use of My Sensitive Personal Information" link at this time.

If this changes in the future, we will update this Privacy Policy and, where required by law, provide you with additional notice and choices regarding our use of Sensitive Personal Information.

IV. YOUR PRIVACY RIGHTS AND CHOICES

Depending on your state of residency (e.g., California, Virginia, Colorado), you may have the following rights:

• Right to Know/Access: Request details on the categories and specific pieces of data we have collected.
• Right to Correct: Request that we fix inaccurate personal information.
• Right to Delete: Request the deletion of your personal information, subject to legal exceptions.
• Right to Opt-Out of Sharing: Request that we stop "sharing" your data for targeted advertising.
• Right to Appeal: If we deny your privacy request, you may appeal our decision by emailing us.

These rights are not absolute and may be subject to certain conditions and exemptions under applicable law. We will not discriminate against you for exercising any of your privacy rights.

How to Exercise Your Rights

Email us at requests@bonsaidata.io. We will verify your identity before processing the request, which may include matching information you provide with information we maintain about you. We also honor the Global Privacy Control (GPC) signal; if your browser sends a GPC signal, we will treat it as a valid opt-out of "sharing," to the extent required by applicable law.

V. COOKIES AND ANALYTICS

A cookie is a small data file stored on your hard drive. We use them to improve user experience and analyze traffic patterns, including to remember your preferences and understand how you interact with the Site over time.

• Google Analytics: We use Google Analytics to understand site usage. You can opt-out via the Google Analytics Opt-out Browser Add-on. Google Analytics may set its own cookies and collect information such as your IP address, device identifiers, and interaction with our pages, which may be used by Google in accordance with its own privacy policies.
• Control: You can adjust your browser settings to refuse cookies, though some Site features may be disabled or may not function as intended. Depending on your location, you may also have additional choices regarding cookies and tracking technologies, which we will honor to the extent required by applicable law.

VI. CHILDREN'S PRIVACY

The Site and Service are not directed to anyone under the age of 13 (or 16 in certain jurisdictions). We do not knowingly collect information from children. If we learn we have collected such data, we will delete it immediately and take reasonable steps to disable any associated accounts or access.

If you are a parent or guardian and believe that your child has provided Personal Information to us without your consent, you may contact us using the information in the "Contact Us" section below so that we can take appropriate action.

VII. NOTICE TO EUROPEAN UNION RESIDENTS (GDPR)

Bonsai is the data controller for information provided via our Site.

• Lawful Basis: We process data based on Consent (for inquiries) and Legitimate Interest (for site analytics and security), and, where applicable, Performance of a Contract (when we provide services you request) and Compliance with Legal Obligations (for record-keeping and regulatory purposes).
• International Transfer: Your data is stored and processed in the United States and may be transferred to other jurisdictions where our service providers are located. We implement appropriate safeguards, such as standard contractual clauses approved by the European Commission, where required by applicable law.
• Your Rights: You have the right to data portability, erasure, and to lodge a complaint with a supervisory authority, as well as the rights of access, rectification, restriction of processing, and objection to certain processing, in each case as provided under the GDPR. You may exercise these rights by contacting us using the details in the "Contact Us" section below, and we will respond in accordance with applicable data protection laws.

VIII. SECURITY

We implement encryption, firewalls, and SSL technology to protect your information. However, no security measure is 100% secure. By using the Service, you acknowledge and assume these inherent risks, and you understand that we cannot guarantee absolute security of your Personal Information.

We limit access to Personal Information to those personnel and service providers who have a business need to know it and who are subject to confidentiality obligations. If we become aware of a data incident affecting Personal Information, we will take appropriate steps to investigate and, where required by applicable law, notify you and relevant authorities.

IX. CONTACT US

If you have questions regarding this Privacy Policy, please contact us at:

Email: requests@bonsaidata.io

Address: 111 E Front Street, Wheaton, IL 60187

If you are located in a jurisdiction that grants you the right to lodge a complaint with a data protection or consumer protection authority, you may also contact that authority. However, we encourage you to contact us first so that we can attempt to address your concerns directly.