Privacy Policy

Banyan.ai is an early-stage product. This policy describes what we collect in the current MVP and why. We do not sell personal data, and we do not show advertising.

What we collect

• Account data — your name, email address, and a hashed password (bcrypt). We never store your password in readable form.
• Workspace content — product profiles, audience notes, campaigns, content, approvals, and results you record. This is your data; workspace isolation is enforced in the application.
• Analytics you create via our links — when a visitor clicks a tracked distribution link (a /t/ link), we record the click, the UTM parameters of the link, and the time. If that visitor later signs up, we record that the signup followed a tracked link. This is observed attribution, not inferred identity matching.
• Session cookie — one httpOnly cookie (`banyan_session`) keeps you signed in. One optional cookie (`banyan_vis`) records the tracked link you arrived through so signups can be attributed. No third-party tracking cookies.

Third-party services

• Publishing connections — when you configure a Postiz connection, your API key is stored encrypted (AES-256-GCM) and sent only to the Postiz instance you specify, to publish posts you approve.
• AI providers — content generation may call a model provider if you configure one. Without configuration, no external AI calls are made and a clearly-labeled template fallback is used.

What we do not do

• We do not sell or share personal data with data brokers or advertisers.
• We do not fabricate analytics. Reports show measured facts or nothing.
• We do not publish anything to external platforms without recorded human approval.

Your choices

• You can delete workspace content at any time within the app.
• Ask questions about your data at privacy@banyan.ai (we are a small team; replies may take a couple of business days).

This policy covers the MVP as implemented. Material changes will be reflected here with a new "last updated" date.