Bonsai

    powered by Calm Journeys

    Sign in

    Privacy Policy

    Last updated: 10 July 2026

    This Privacy Policy describes how Calm Journeys ("we", "us", or "our") collects, uses, and protects personal data when you use Bonsai — our client workspace for content creation, social publishing, and community management — available at bonsai.calmjourneys.nl.

    1. Who is responsible for your data?

    Data controller: Calm Journeys
    Website: calmjourneys.nl
    Contact: alanvieira@outlook.com

    2. What data we collect

    Account and authentication

    When you sign in to Bonsai, we process:

    • Name and email address (from our identity provider)
    • User identifier and assigned roles
    • Session and authentication tokens required to keep you signed in

    Meta (Facebook and Instagram) connection

    If you choose to connect a Facebook Page and/or Instagram business account, we receive and store data from Meta's APIs, including:

    • Your Meta user identifier
    • Facebook Page ID, name, and Page access token
    • Linked Instagram business account ID and username (when available)
    • User access token and token expiry information
    • Content and engagement data needed for publishing, scheduling, insights, and community management (for example posts, comments, messages, and performance metrics)

    We only request Meta permissions needed for features you use in Bonsai, such as publishing content, reading insights, and managing comments or messages on connected accounts.

    Content and workspace data

    Depending on how you use Bonsai, we may also process:

    • Uploaded images, videos, and reference files
    • Generated content, captions, schedules, and drafts
    • Client workspace settings, branding, and location configuration
    • Usage and audit logs related to platform operations

    3. How we use your data

    We use personal data to:

    • Provide, operate, and secure the Bonsai platform
    • Authenticate users and enforce role-based access
    • Connect to and act on your behalf on Meta platforms when you authorize us to do so
    • Schedule and publish content to connected social accounts
    • Display analytics and insights for connected accounts
    • Assist with community replies and engagement workflows
    • Improve reliability, troubleshoot issues, and prevent abuse
    • Comply with legal obligations

    4. Legal basis (GDPR)

    Where the GDPR applies, we rely on:

    • Contract — to deliver the services you use in Bonsai
    • Consent — when you connect Meta accounts or enable optional features
    • Legitimate interests — to secure, maintain, and improve the platform, balanced against your rights
    • Legal obligation — where required by applicable law

    5. How we share data

    We do not sell your personal data. We may share data with:

    • Meta Platforms, Inc. — when you connect Facebook or Instagram accounts or when we call Meta APIs on your behalf
    • Infrastructure and AI providers — such as cloud hosting, storage, and model providers that process data strictly to operate Bonsai features
    • Professional advisers or authorities — when required by law or to protect rights and safety

    Sub-processors are bound by contractual obligations to protect your data and use it only for the services they provide to us.

    6. Data retention

    We retain personal data only for as long as necessary for the purposes described in this policy, including while your account is active and for a limited period thereafter for security, backup, and legal compliance. Meta tokens and connected account data are removed when you disconnect an account or when we no longer need them to provide the service.

    7. Security

    We apply technical and organizational measures to protect personal data, including access controls, encryption in transit, and restricted access to production systems. No method of transmission or storage is completely secure; please use strong credentials and notify us if you suspect unauthorized access.

    8. Your rights

    Depending on your location, you may have the right to access, correct, delete, restrict, or port your personal data, and to object to or withdraw consent for certain processing. You may also lodge a complaint with your local data protection authority.

    To exercise your rights, contact us at alanvieira@outlook.com. We will respond within the time required by applicable law.

    9. Data deletion instructions

    You can delete data associated with your use of Bonsai in the following ways:

    1. Disconnect Meta accounts: In Bonsai, go to Settings → Connected accounts and remove any connected Facebook Page or Instagram account. This deletes stored Meta tokens and connected account records from our systems.
    2. Revoke Meta authorization: In your Facebook account settings, open Settings & privacy → Settings → Apps and websites and remove the calmjourneys app. This revokes our access via Meta.
    3. Request full deletion: Email alanvieira@outlook.com with the subject line "Data deletion request" and the email address associated with your Bonsai account. We will delete or anonymize your personal data unless we must retain it for legal reasons.

    We aim to complete verified deletion requests within 30 days.

    10. International transfers

    Your data may be processed in the European Economic Area and in other countries where our service providers operate. Where required, we use appropriate safeguards such as Standard Contractual Clauses.

    11. Children

    Bonsai is a business platform and is not directed at children under 16. We do not knowingly collect personal data from children.

    12. Changes to this policy

    We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect the latest version. Material changes will be communicated through the platform or by other appropriate means.

    13. Contact

    Questions about this Privacy Policy or our data practices:
    alanvieira@outlook.com