Privacy Policy

This Privacy Policy explains how Vincent Filippi (“we”, “us”), operator of Bonavi (“the Service”), collects, uses, and protects personal information. We are committed to complying with Québec’s Act respecting the protection of personal information in the private sector (as amended by Law 25) and applicable Canadian privacy law.

Person responsible for the protection of personal information: Vincent Filippi — contact@bonavi.ca

1. Information we collect

From the business owner (our customer):

• Account details: name, email address, password (stored encrypted).
• Business details: business name, Google review link, default language.
• Billing information: handled by our payment processor (Stripe); we do not store your full card number.

About your customers (that you provide):

• Contact details you enter to send review requests (e.g., a customer name and email).

Automatically:

• Basic technical and usage data (e.g., log data) needed to operate and secure the Service. If we use non-essential cookies or analytics, we ask for consent — see our Cookie Notice.

Reviews: Review text is public content hosted on Google. When you paste a review to generate a reply, that text is processed to draft a response.

Automatic review import (if you opt in): If you turn on automatic review import, we give you a unique Bonavi email address. When you forward an email to it — typically a Google review notification — we receive and process the contents of that email, including the reviewer’s name (if included) and the review text, using AI to extract the review and draft a suggested reply. We use this content only for that purpose. We do not retain the original forwarded email itself beyond what is needed to process it; only the extracted review and drafted reply are kept, as described in Section 4. You are responsible for only forwarding emails you have the right to forward, and for not forwarding content unrelated to a review.

2. Why we use it (purposes)

• To provide and operate the Service (accounts, review requests, AI reply drafting).
• To process payments and manage subscriptions.
• To communicate with you about your account and support.
• To secure the Service and prevent misuse.
• To comply with legal obligations.

We do not sell your personal information, and we do not use it for advertising.

3. Who we share it with (subprocessors)

We use trusted third-party providers to run the Service. Personal information may be processed by:

• Supabase — database, authentication, and storage.
• Vercel — application hosting.
• Anthropic — AI processing to draft review replies.
• Resend — sending review-request and transactional emails.
• Mailgun — receiving forwarded emails for the automatic review-import feature.
• Stripe — payment processing.

Some of these providers may process or store data outside Québec or Canada (including the United States). We take reasonable steps to ensure appropriate protection. By using the Service, you acknowledge this cross-border processing.

4. How long we keep it

We keep personal information only as long as needed for the purposes above or as required by law. When you close your account, we delete or anonymize your personal information within a reasonable period, except data we must retain for legal, accounting, or security reasons. Forwarded emails processed under automatic review import are handled as described in Section 1 — we do not keep the original email, only the extracted review and drafted reply.

5. Your rights

Under Québec law, you may:

• Access the personal information we hold about you;
• Correct inaccurate information;
• Withdraw consent or request deletion, subject to legal limits;
• Port certain information;
• File a complaint with the Commission d’accès à l’information du Québec.

To exercise any right, email contact@bonavi.ca. We will respond within the timelines required by law.

Customers you add: If you provide us with your customers’ contact details, you confirm you have the right to do so. Requests from those individuals about their data will be forwarded to you as the business responsible for that relationship, and we will assist as required by law.

6. Security

We use reasonable technical and organizational measures to protect personal information, including encryption in transit, access controls, and row-level database security. No system is perfectly secure, but we work to protect your data and will notify you and the authorities of a confidentiality incident as required by law.

7. Changes

We may update this Policy. We will post the new version with an updated date and communicate material changes where reasonable.

8. Contact

Vincent Filippi — Person responsible for personal information
contact@bonavi.ca