Last updated: October 4, 2026
1. Purpose
This Privacy Policy describes how APPY BONSAI collects, uses, stores and protects personal data in connection with:
- the Appy Bonsai mobile application;
- appybonsai.com;
- my.appybonsai.com;
- associated web services and APIs;
- user support;
- communications sent to users.
It applies except where a third-party service, including Apple or Google, processes data under its own responsibility and in accordance with its own privacy policy.
2. Data controller
The data controller is:
APPY BONSAI
Simplified joint-stock company
16 rue Jules Leloup
45200 Montargis – France
SIREN: 988 319 505
Contact email:
For any questions concerning personal data or to exercise your rights, you may use this email address.
3. Principles
APPY BONSAI processes personal data in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, security and confidentiality.
APPY BONSAI does not sell its users' personal data.
4. Data collected
Depending on the features used, the following categories of data may be processed.
4.1. Account data
The following may in particular be processed:
- name or pseudonym;
- first name, where provided;
- email address;
- internal account identifier;
- language;
- preferences associated with the account;
- information required for authentication.
Passwords must not be stored in plain text.
4.2. Collection-related data
Users may record various types of information concerning, in particular:
- bonsai and other plants;
- pots;
- rocks;
- tools;
- accessories;
- other collection items;
- groups and classifications;
- events and cultivation operations;
- observations;
- history;
- financial information voluntarily entered in relation to the collection.
4.3. Photographs and files
The user may add photographs or other files associated with their data.
Photographs may contain visible information or, depending on their technical processing, certain metadata.
Users should avoid transmitting personal data relating to third parties where such data is not necessary.
4.4. Scheduling and notifications
When a user uses scheduling or reminder features, APPY BONSAI may process:
- scheduled events;
- associated dates and times;
- notification preferences;
- technical identifiers required to send notifications.
4.5. Subscription information
When a user subscribes to Appy Bonsai Premium through Apple or Google, APPY BONSAI may receive, in particular:
- the product or subscription identifier;
- a transaction or receipt identifier;
- the subscription status;
- start, renewal or expiry dates;
- certain information relating to the country or store;
- information required to verify and restore a purchase.
APPY BONSAI does not normally receive the full bank card number used on the App Store or Google Play.
4.6. Technical data
In order to provide and secure the service, the following may in particular be processed:
- IP address;
- date and time of a connection or request;
- device type;
- application version;
- operating system;
- technical session information;
- technical logs;
- errors;
- information required to detect abnormal or fraudulent use.
4.7. Diagnostics and error reports
Depending on the application configuration, certain information relating to errors, crashes or performance may be processed in order to identify and correct technical problems.
This information is limited to what is necessary for that purpose.
Where the use of a tracker or SDK requires the user's consent, such consent is requested in advance.
4.8. Support
When the user contacts APPY BONSAI, the following may in particular be processed:
- their email address;
- their identity or pseudonym;
- the content of their messages;
- files or screenshots they provide;
- technical information required to resolve the issue.
4.9. Communications and newsletter
When a user subscribes to a newsletter or agrees to receive promotional communications, APPY BONSAI processes in particular:
- their email address;
- their language;
- their communication preferences;
- information allowing proof of their choice to be retained.
Communications strictly necessary for the operation of the account or service do not constitute commercial communications.
5. Source of the data
Data may come from:
- the user directly;
- use of the application or web services;
- the user's device;
- Apple or Google in connection with the management of a purchase or subscription;
- or another user where they use a feature provided for that purpose.
6. Purposes and legal bases
Account creation and management
Purpose: to create, authenticate and manage the account.
Legal basis: performance of a contract or pre-contractual measures.
Management of collections and Appy Bonsai features
Purpose: to record, synchronise, display and use the information entered in order to provide the requested features.
Legal basis: performance of a contract.
Appy Bonsai Premium
Purpose: to verify a purchase, activate Premium features, manage subscription status and prevent fraud.
Legal basis: performance of a contract and, where applicable, APPY BONSAI's legitimate interest in securing its service and preventing fraud.
Notifications and reminders
Purpose: to provide reminders or notifications requested by the user.
Legal basis: performance of the requested service and, where required by law, consent.
Support
Purpose: to respond to requests, identify issues and provide support.
Legal basis: performance of a contract or APPY BONSAI's legitimate interest in providing support and improving service quality.
Security and technical logs
Purpose: to secure accounts, servers and services, detect abuse, prevent fraud and diagnose incidents.
Legal basis: APPY BONSAI's legitimate interest in ensuring the security of its systems and users and, in certain cases, compliance with legal obligations.
Performance measurement and improvement
Purpose: to understand how the service operates, correct errors and improve its performance.
Legal basis: legitimate interest where consent is not legally required; consent where it is required for the tracker or technology used.
Commercial communications
Purpose: to inform users about Appy Bonsai products, features, offers or news.
Legal basis: consent where required by law or, in situations provided for by law, legitimate interest in relation to certain similar services offered to existing customers.
Users may unsubscribe at any time.
Legal obligations and disputes
Purpose: to comply with legal, tax and accounting obligations and enable the establishment, exercise or defence of legal rights.
Legal basis: legal obligation or legitimate interest.
7. Mandatory or optional nature
Information indicated as required when creating an account is necessary in order to provide the relevant service.
If the user refuses to provide information that is essential to a feature, that feature may not be available.
Data that is not necessary is optional.
8. Recipients
Data may be accessible, to the extent necessary, to:
- APPY BONSAI and authorised persons acting on its behalf;
- hosting and IT infrastructure providers;
- technical providers required for the operation or security of the service;
- Apple or Google where necessary to manage a purchase or subscription;
- messaging or communication service providers;
- authorities or courts where required by law.
Service providers acting on behalf of APPY BONSAI are subject to appropriate contractual data protection obligations.
9. Hosting and processors
APPY BONSAI uses, in particular, hosting and infrastructure services provided by providers such as OVHcloud and DigitalOcean.
Where possible, APPY BONSAI gives preference to hosting user data within the European Union or the European Economic Area.
The list of providers may change where necessary for the operation of the service.
10. International transfers
Some providers may be established or have teams in countries outside the European Economic Area.
Where an international transfer of data subject to the GDPR takes place, APPY BONSAI ensures that it is based on an appropriate legal mechanism, including:
- an adequacy decision by the European Commission;
- the EU–US Data Privacy Framework where applicable;
- the European Commission's Standard Contractual Clauses;
- or any other mechanism authorised by applicable regulations.
Additional safeguards are implemented where necessary in light of the level of protection in the country concerned.
Users may request further information about the applicable safeguards by contacting APPY BONSAI.
11. Retention period
APPY BONSAI does not retain personal data for longer than necessary for the purpose for which it is processed.
Account and collection data
Data required for the operation of the account is retained for as long as the account exists.
After the account is deleted, data is deleted or anonymised within a reasonable period, subject to:
- temporary technical backups;
- legal obligations;
- fraud prevention;
- or the need to establish, exercise or defend a legal right.
Backups
Data deleted from the active database may remain temporarily in secure backups until their normal rotation.
Such data is not reintroduced into active systems except where a technical restoration is necessary.
Subscription and transaction information
Information required for the active management of a subscription is retained for as long as necessary for that management.
Certain information may then be archived for as long as necessary to comply with legal, tax or accounting obligations or to defend the rights of APPY BONSAI or the user.
Support
Support exchanges may be retained for as long as necessary to process the request and, where justified, for a period allowing the issue to be followed up or legal rights to be defended.
Security logs
Technical and security logs are retained for a limited period determined according to security and investigation needs and applicable obligations.
Commercial prospecting
Data used for commercial prospecting may be retained for the duration of the business relationship and, where French law applies, for up to three years after its end or the last relevant contact, unless the user objects or a different obligation applies.
Data enabling proof of an objection to be retained may be stored in order to comply with that objection.
Accounting obligations
Documents subject to a statutory retention obligation are retained for the period required by applicable regulations.
12. Security
APPY BONSAI implements technical and organisational measures appropriate to the level of risk in order to protect personal data, in particular against:
- unauthorised access;
- loss;
- alteration;
- disclosure;
- accidental or unlawful destruction.
For security reasons, APPY BONSAI does not publish details of its architecture, administration mechanisms or security measures.
As no IT system can guarantee zero risk, APPY BONSAI adapts its measures as risks and technologies evolve.
13. Personal data breaches
Where a personal data breach is likely to result in a risk to individuals' rights and freedoms, APPY BONSAI applies the notification procedures required by applicable regulations.
Where the breach is likely to result in a high risk to an individual, that individual is informed where required by law.
14. Public sharing
Certain features allow users to voluntarily make certain information accessible to other people.
Where a record or content is made public, the relevant information may be viewed by people outside APPY BONSAI.
Users should therefore check the information and photographs they choose to make public.
APPY BONSAI does not voluntarily make private account data public outside the sharing features activated by the user.
15. Cookies, trackers and similar technologies
The websites and application may use technologies that are necessary, in particular, for:
- authentication;
- security;
- maintaining a session;
- remembering certain choices;
- the operation of the service.
These strictly necessary technologies may be used without consent where permitted by applicable regulations.
Trackers or SDKs that are not strictly necessary, including certain advertising, measurement or tracking tools, are activated only after consent has been obtained where such consent is required.
Users may change their choices using the tools made available to them.
16. Rights of users in the European Union and the EEA
Subject to the conditions provided for by applicable regulations, users may exercise:
- a right of access;
- a right to rectification;
- a right to erasure;
- a right to restriction of processing;
- a right to object;
- a right to data portability;
- the right to withdraw consent at any time where processing is based on consent.
Withdrawal of consent does not affect the lawfulness of processing carried out before such withdrawal.
Where processing is based on legitimate interest, the user may object on grounds relating to their particular situation, subject to compelling legitimate grounds that may justify continuation of the processing.
17. Exercising your rights
Requests may be sent to:
APPY BONSAI may request information to verify the identity of the applicant where necessary to prevent disclosure of data to an unauthorised person.
18. Complaint to a supervisory authority
A user located in the European Union has the right to lodge a complaint with the competent supervisory authority.
In France:
Commission nationale de l'informatique et des libertés – CNIL
3 Place de Fontenoy
TSA 80715
75334 Paris Cedex 07
France
19. Minor users
Appy Bonsai is not specifically designed as a service intended for young children.
Where processing is based on a minor's consent, the rules concerning the age of digital consent applicable in their country must be complied with.
In France, a minor may independently consent to certain processing relating to the direct offering of information society services from the age of fifteen. Below that age, the conditions laid down by applicable legislation must be complied with.
If APPY BONSAI becomes aware that data has been collected in breach of rules applicable to a minor, appropriate measures will be taken.
20. Automated decision-making
Unless otherwise stated to the user for a specific feature, APPY BONSAI does not make decisions producing legal effects or similarly significantly affecting a user solely on the basis of automated processing of their personal data.
The calculations, cultivation recommendations and assistance tools offered by Appy Bonsai do not, in themselves, constitute automated legal decisions concerning the user.
21. Users located outside the European Union
APPY BONSAI applies the principles of this Privacy Policy to all its users.
Additional or different rights may arise under the laws of the user's country or territory of residence.
Where mandatory local law grants the user greater protection than that provided under this policy, that law remains applicable.
Users may contact APPY BONSAI to exercise rights available to them under applicable local law.
22. Users in Brazil
Where the Lei Geral de Proteção de Dados – LGPD applies, users may in particular have the rights provided for by that legislation concerning confirmation of processing, access, rectification, deletion or anonymisation of certain data, portability and information relating to data sharing.
Relevant international transfers are carried out in accordance with mechanisms authorised by Brazilian regulations where applicable.
Additional information in Portuguese may be made available concerning the relevant international transfers.
23. Users in California
Where the California Consumer Privacy Act or equivalent legislation applies to APPY BONSAI, the users concerned benefit from the rights provided for by such legislation.
APPY BONSAI does not sell its users' personal data.
If a practice legally falling within the concept of "sharing" or "sale" under California law were to be implemented in the future, APPY BONSAI would implement the required information and opt-out mechanisms.
24. Changes
This Privacy Policy may change, in particular, as a result of:
- new features;
- a change in the service providers used;
- a change in processing activities;
- regulatory developments.
The date of the latest update is stated at the beginning of this document.
Where a change substantially affects the way personal data is used, appropriate information will be provided to users.
25. Contact
For any questions regarding this Privacy Policy or the processing of personal data:
Email:
