Privacy Policy

AI1952 ("we," "our," "us," or "the Company") develops and operates Bonik AI — an AI-powered business management application for F-Commerce sellers in Bangladesh, available on the Google Play Store. This Privacy Policy describes how we collect, use, store, share, and protect your personal information when you download, install, and use Bonik AI.

This policy explains our data practices clearly so you can make informed decisions about using the app. If Bonik AI introduces new features with unique data practices, those differences will be disclosed within the app and in the Data Safety form on Google Play.

This Privacy Policy is designed to comply with:

• Google Play Developer Program Policies (updated April 2026)
• Google Play Data Safety requirements
• Google Play AI-Generated Content Policy
• Google Play Account Deletion Policy
• Bangladesh Digital Security Act 2018
• General Data Protection Regulation (GDPR) — where applicable
• California Consumer Privacy Act (CCPA) — where applicable

By downloading, installing, or using Bonik AI, you agree to the practices described in this policy. If you do not agree, please discontinue use and uninstall the application from your device.

AI1952 is a modern software development company focused on building innovative AI-powered applications for Bangladeshi businesses. Bonik AI integrates leading AI technologies to help F-Commerce sellers manage orders, generate marketing content, dispatch couriers, track finances, and grow their business — all in one place.

The data collected depends on which features of Bonik AI you use. We may collect the following categories of information:

• Account details — name, email address, username, and password
• Profile information — profile photo, business name, and preferences
• Content you create — product descriptions, marketing posts, prompts, messages, and other text you submit within the app
• Support communications — messages you send to our support team
• Payment details — processed entirely by Google Play Billing; we do not store your card or payment credentials

• Device identifiers — Android Advertising ID (AAID), device model, OS version, unique device ID
• App usage data — features accessed, session duration, button interactions, screen views
• Performance data — app startup time, loading speed, API response times (via Firebase Performance Monitoring)
• Crash and error reports — stack traces, error logs, device state at the time of crash (via Firebase Crashlytics)
• Analytics events — user flows, feature engagement, retention data (via Firebase Analytics)
• Network data — IP address, approximate geographic region (country/city level), connection type
• Language and timezone settings

• If you sign in via Google Sign-In, we receive your name, email address, and Google profile photo through Google's OAuth 2.0 service
• We do not receive or store your Google account password

• If you connect a courier/delivery service (e.g., Pathao, Steadfast, RedX, or other supported couriers), we collect the API credentials, order details, and delivery status you authorize us to access — solely to create and track shipments on your behalf
• If you connect a WordPress/WooCommerce store, we collect the store URL and API keys you provide, along with order, product, and customer data synced from your store — used only to display and manage that information inside the app
• These credentials are encrypted at rest and never shared with unrelated third parties
• You can disconnect any courier or store integration at any time from within the app, which immediately revokes access

• Bonik AI includes an on-device OCR feature that reads text from images you choose to scan or upload (e.g., turning a screenshot into an order)
• This OCR processing happens entirely on your device — the image itself is never collected, uploaded, or stored by Bonik AI or any third party
• Only the resulting text — not the image — may then be sent to an AI model API (see Sections 6 & 10) to generate a response, exactly like any other text you type into the app
• We do not retain a copy of the scanned image

• Precise GPS or real-time location
• Contacts, call logs, or SMS messages
• Audio or video recordings without explicit user action
• Files or photos unless you explicitly upload them within the app
• Sensitive personal data such as health records, financial accounts, biometric data, or government ID data

We use the information collected for the following purposes:

• Deliver our Services: Provide core app functionality, AI-powered features, and personalized content
• Account management: Create, authenticate, and maintain your account and preferences
• AI processing: Route your prompts to third-party AI model APIs to generate responses, marketing posts, or other content
• Analytics (Firebase Analytics): Understand how users engage with Bonik AI to improve features, UX, and retention
• Crash reporting (Firebase Crashlytics): Automatically detect, diagnose, and fix crashes and errors to improve stability
• Performance monitoring (Firebase Performance): Measure app loading times, network latency, and screen rendering to identify bottlenecks
• Customer support: Respond to inquiries, troubleshoot problems, and provide assistance
• Security and fraud prevention: Detect abuse, unauthorized access, or violations of our Terms of Service
• Legal compliance: Meet obligations under applicable laws and regulations
• Marketing communications: Send product updates, new feature announcements, and promotional offers — only with your consent, and you may opt out at any time
• Subscription and billing: Manage your in-app purchases and subscriptions via Google Play Billing

We do not use your data for fully automated decisions that produce significant legal effects without human review.

Where the GDPR applies (e.g., users in the European Economic Area), we process personal data on the following legal bases:

• Contractual necessity: Processing required to provide you the app and services you requested (account creation, AI features, support)
• Legitimate interests: Analytics, crash reporting, performance monitoring, and fraud prevention — balanced against your rights and freedoms
• Consent: Marketing emails, optional personalized advertising, and any additional optional data sharing — you may withdraw consent at any time
• Legal obligation: Processing required to comply with applicable laws, court orders, or governmental requests

For users in Bangladesh, data is processed in accordance with the Bangladesh Digital Security Act 2018 and applicable guidelines issued by the Bangladesh Telecommunication Regulatory Commission (BTRC).

Bonik AI allows you to create, save, and share content within the app — including product descriptions, marketing posts, hashtags, creative copy, and images ("User-Generated Content" or "UGC").

• You retain ownership of the original content you create
• You are solely responsible for ensuring your UGC does not violate any laws, third-party rights, or our Terms of Service
• You must not submit content that is illegal, defamatory, obscene, harassing, or infringes any intellectual property rights

• By submitting UGC, you grant AI1952 a limited, non-exclusive, royalty-free license to use, store, display, and process that content solely to operate and improve the Services
• We do not claim ownership of your content and do not sell it to third parties
• We reserve the right to remove any UGC that violates our policies, without prior notice

• We may use automated tools and manual review to detect policy violations in user-submitted content
• AI-generated outputs based on your prompts are treated as UGC and are subject to the same responsibilities

Bonik AI's Product Link feature allows you to create a public online store or product page ("Shop Page") that you share with customers via a link. This section explains the content restrictions that apply and how related data may be handled.

• Adult (18+) content, sexually explicit, or obscene material
• Illegal drugs or narcotics
• Any other product or service prohibited under the laws of Bangladesh

If any such activity is detected, Bonik AI reserves the right to suspend or permanently terminate the associated account without prior notice.

Where required by applicable law or in response to a valid request from authorized government or law enforcement authorities in Bangladesh, Bonik AI may disclose relevant information — such as account details, Shop Page content, or associated order data — as legally required.

By using Bonik AI's Product Link feature, you acknowledge and agree to comply with this policy. See also Terms of Service Section 9.

Bonik AI uses large language model (LLM) APIs to generate content on your behalf. In compliance with the Google Play AI-Generated Content Policy, we disclose the following:

• Content generated by Bonik AI is powered by AI models, including services from OpenAI, Google, and/or Anthropic
• AI-generated content is clearly labelled within the app wherever applicable
• We do not misrepresent AI-generated content as being created by a human

• AI-generated content is provided as a starting point and may not always be accurate, complete, or suitable for your specific context
• You are responsible for reviewing, editing, and verifying all AI outputs before publishing or sharing them
• AI1952 is not liable for decisions made based solely on AI-generated content

• You may not use our AI features to generate content that is illegal, harmful, deceptive, discriminatory, or violates any third-party rights
• Generating content that impersonates real people, spreads misinformation, or facilitates fraud is strictly prohibited

We do not sell your personal information to any third party. We share data only in the following limited circumstances:

• AI API Providers: Your prompts are transmitted to AI API providers to generate responses. These providers process data under their own privacy policies and terms.
• Firebase (Google): Analytics events, crash reports (Crashlytics), and performance metrics are sent to Firebase. Data is anonymized and aggregated where possible.
• Google Play Billing: Payment transactions are handled entirely by Google Play's billing system. We do not receive or store your payment credentials.
• Cloud Infrastructure Providers: Our backend services are hosted on secure cloud servers (Google Cloud Platform) for data storage and API delivery.
• Legal Authorities: We may disclose data if required by law, court order, or to protect the rights, property, or safety of AI1952, our users, or the public.
• Business Transfers: In the event of a merger, acquisition, or asset sale, user data may be transferred. Affected users will be notified via email and in-app notice.
• Courier & Delivery Partners: If you connect a courier service, order and shipment details you choose to send are shared with that courier's API solely to create and track deliveries on your behalf.
• WordPress/WooCommerce Store: If you connect your own store, order, product, and customer data is exchanged directly between the app and your store's API using the credentials you provide — this data is not shared with any other third party.

All third-party service providers are required to handle your data in compliance with applicable privacy laws and are prohibited from using it for their own independent purposes.

Storage Location: User data is stored on secure cloud infrastructure (Google Cloud Platform) in GDPR-compliant regions.

Retention Period: We retain your personal data for as long as your account is active. Upon account deletion, personal data is deleted or irreversibly anonymized within 30 days, except where retention is required by law.

• All data in transit is encrypted using HTTPS / TLS 1.2+
• Data at rest is encrypted using AES-256 encryption
• Access to user data is restricted to authorized personnel only, with role-based access controls
• Passwords are stored using industry-standard one-way hashing (bcrypt)
• Regular security audits and penetration testing are conducted
• Crash and error logs (via Firebase Crashlytics) are reviewed to detect security anomalies

No system is 100% secure. If you suspect unauthorized access, please contact us immediately at support@bonikai.app.

In compliance with Google Play Account Deletion requirements, Bonik AI provides a clear, accessible mechanism for users to delete their account and associated data.

• In-App: Navigate to Settings → Account → Delete Account and follow the on-screen confirmation steps
• By Email: Send a deletion request to support@bonikai.app with the subject line: "Account Deletion Request" from your registered email address

• Your profile, preferences, saved content, and account history — deleted within 30 days
• AI prompt history and generated content associated with your account
• Your email address and personal identifiers

• Anonymized, aggregated analytics data that cannot be linked to you
• Transaction records required for legal, tax, or financial compliance (retained for the minimum period required by law)
• Crash logs and error reports, stripped of personal identifiers

Account deletion is permanent and irreversible. Active subscriptions must be cancelled via Google Play before deletion to stop future billing.

This section specifically addresses how we handle the prompts and inputs you provide to AI features within Bonik AI, and how the resulting AI-generated content is managed.

• Prompts you submit (e.g., product details, topic requests, instructions) are transmitted to third-party AI model APIs to generate a response
• Your prompt data is sent securely over HTTPS and is not stored permanently on our servers beyond the duration of the session, unless you explicitly save content within the app
• We do not use your prompts to train our own AI models

• OpenAI: May use API input/output data to improve its models unless you opt out. See OpenAI Privacy Policy
• Google: Data handling governed by Google's Cloud Data Processing terms. See Google Privacy Policy
• Anthropic: API usage data governed by Anthropic's usage policies. See Anthropic Privacy Policy

• Prompts are subject to safety filters enforced by both Bonik AI and the AI providers to prevent harmful, illegal, or policy-violating outputs
• We may log flagged or blocked prompts for safety review and platform integrity — these logs are handled with strict access controls
• You must not submit prompts designed to bypass AI safety systems, generate harmful content, or extract model weights or training data

• You may delete AI-generated content saved within the app at any time from your account history or by deleting your account (see Section 9)
• AI1952 does not claim ownership of AI-generated content produced from your prompts
• You are responsible for how you use, publish, or share AI-generated content outside of the app

Bonik AI uses Firebase — Google's mobile development platform — for analytics, crash reporting, and performance monitoring:

• Anonymized usage events (screen views, feature taps, session data) are shared with Firebase Analytics to help us understand user behavior and improve the app experience
• No personally identifiable information (PII) is sent in analytics events
• You can opt out of analytics data collection via your device's Settings → Privacy → Ads → Opt out of Ads Personalization

• When the app crashes, Crashlytics automatically sends a crash report including: device model, OS version, app version, crash stack trace, and app state at the time of crash
• Crash reports do not include personal content, prompts, or identifiable user data — we take care to avoid logging PII

• Performance traces — including screen load times, HTTP request durations, and custom performance metrics — are sent to Firebase Performance to identify and resolve performance bottlenecks
• This data is aggregated and does not contain personal content

Additional detail on storage and security practices by data type:

• Account data (name, email, password hash): Stored in a secured, access-controlled database. Password is hashed and salted — never stored in plain text
• AI prompt history (if saved): Encrypted at rest in our database. Not shared with third parties beyond AI API providers for processing
• Analytics and crash data: Stored in Firebase infrastructure managed by Google, subject to Google's security standards
• Payment records: Managed entirely by Google Play Billing. Bonik AI does not store payment card details
• Uploaded media (photos, images): Stored temporarily during processing; not retained longer than necessary. Users may delete uploaded content at any time
• Courier & store API credentials: Encrypted at rest using AES-256. Only used to communicate with the specific service you connected

Data Breach Response: In the event of a data breach that may affect your personal information, we will notify affected users and relevant authorities within 72 hours of becoming aware, as required under GDPR.

Additional details about how deletion works in Bonik AI:

• The in-app deletion flow is accessible from Settings and meets Google Play's account deletion requirements
• Deleting your account also immediately disconnects all courier and store integrations you have set up
• Any saved AI-generated content, order history, and financial records stored in the app will be permanently removed within 30 days
• If you use Bonik AI in guest mode (if available), simply uninstalling the app removes locally stored data — no deletion request is needed
• Subscription refunds are governed by Google Play's refund policy and are not handled directly by AI1952

For any issues with account deletion, contact us at support@bonikai.app — we will respond within 5 business days.

Depending on your location, you may have the following rights regarding your personal data. To exercise any right, contact us at support@bonikai.app:

• Right to Access: Request a copy of the personal data we hold about you
• Right to Correction: Request correction of inaccurate or incomplete data
• Right to Deletion: Request permanent deletion of your account and personal data (see Sections 9 & 13)
• Right to Portability: Request your data in a structured, machine-readable format (JSON/CSV)
• Right to Object: Object to processing based on legitimate interests, including profiling
• Right to Restrict Processing: Request restriction of processing under certain circumstances
• Right to Withdraw Consent: Withdraw any previously given consent (e.g., marketing emails) without affecting prior processing
• CCPA Rights (California): Right to know, right to delete, right to opt-out of sale of personal information (we do not sell data), and right to non-discrimination for exercising your rights

We will respond to all verified requests within 30 days. We may request identity verification before processing sensitive requests.

Bonik AI is not directed at children under 13 years of age (or under 16 in certain jurisdictions such as the EU). We do not knowingly collect personal information from children.

Bonik AI is designed for adults and business users engaged in e-commerce, content creation, and business operations. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@bonikai.app. We will promptly investigate and delete such information upon verification.

Bonik AI requests Android permissions only when necessary and only at the time the relevant feature is used. The following permissions may be requested:

• INTERNET: Required — needed to connect to AI APIs, sync orders, and deliver app content
• POST_NOTIFICATIONS: Optional (Android 13+) — used to send order alerts, AI completion notifications, and reminders
• CAMERA: Optional — used only when you choose to capture product photos within the app
• READ_MEDIA_IMAGES / READ_EXTERNAL_STORAGE: Optional — used only when you choose to upload images from your device gallery
• BILLING: Required for in-app purchases — processes subscriptions and purchases via Google Play Billing
• VIBRATE: Optional — used for haptic feedback on UI interactions, if enabled in app settings
• RECEIVE_BOOT_COMPLETED: Optional — used for scheduled reminders or background sync, only if enabled by you

You can manage and revoke any permission at any time via Android Settings → Apps → Bonik AI → Permissions. Revoking optional permissions disables related features but does not affect core app functionality.

Bonik AI does not display third-party advertisements inside the app. There are no banner ads, interstitial ads, or rewarded video ads on any plan.

• No ad networks (such as Google AdMob) are integrated in current versions of the app
• Older versions of Bonik AI displayed optional rewarded ads on the former free tier; this has been removed entirely — if you are on an old version, please update to the latest version
• We do not share your name, email, or personal content with advertisers

Bonik AI does run its own app-install marketing campaigns on platforms such as Facebook — see Section 19 (Meta SDK) for how campaign measurement works.

Bonik AI may integrate the Meta (Facebook) SDK for Android to run app-install advertising campaigns and measure ad performance on Meta platforms (Facebook, Instagram, Audience Network).

• App Events: Automatic events such as app install, app open/launch, and in-app purchase events are logged to help measure the effectiveness of Meta ad campaigns
• Device & advertising identifiers: Android Advertising ID (AAID), device model, OS version, app version, and network/locale information
• Install attribution data: Used to determine whether an app install resulted from a Meta ad campaign

• To run and measure app-install advertising campaigns on Facebook and Instagram
• To understand which ad campaigns and creatives drive installs and in-app actions
• To deliver more relevant ads to people who may be interested in Bonik AI

• Event and device data described above is shared with Meta Platforms, Inc., which processes it under its own Meta Privacy Policy and Meta Platform Terms
• We do not send your name, email address, in-app prompts, or any AI-generated content to Meta — only the limited event and device signals described above

• Limit ad tracking by disabling Android Settings → Privacy → Ads → Opt out of Ads Personalization
• Manage how your Facebook/Instagram activity is used for ads at facebook.com/adpreferences
• Uninstalling the app stops further App Events from being logged on that device

This integration is disclosed in Bonik AI's Google Play Data Safety form under "Device or other IDs" and "App activity" shared with third parties.

Bonik AI may generate files on your device — for example, invoices, receipts, or exported reports — that you may want to view, share, or download using other apps (e.g., a PDF viewer, messaging app, or email client).

• We use Android's FileProvider to securely expose these app-generated files to other apps you choose, without giving those apps broad access to your device storage
• Only files explicitly generated by Bonik AI (such as invoice PDFs or order exports) within a designated, restricted app folder are made accessible — never your personal photos, downloads, or unrelated files
• Access is granted temporarily and only to the specific app you select via the Android share/open sheet; it is not exported or accessible to other apps in general
• These files remain on your device and are not uploaded to our servers as part of this sharing mechanism

You can delete app-generated files at any time by clearing the app's cache/storage via Android Settings → Apps → Bonik AI → Storage.

AI1952 is a globally distributed company. When you use Bonik AI, your data may be transferred to and processed in countries other than Bangladesh — including the United States, where our AI API providers and cloud infrastructure operate.

We ensure that all international data transfers are subject to appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) — used with EU/EEA data transfers in compliance with GDPR
• Data Processing Agreements (DPAs) — in place with all third-party processors including Firebase and AI API providers
• Adequacy decisions — where applicable for specific destination countries

By using Bonik AI, you acknowledge and consent to the international transfer of your data as described in this policy.

Bonik AI may contain links to third-party websites, products, or services — including links to Google Play Store listings, social media profiles, or partner websites. This Privacy Policy applies only to Bonik AI.

We are not responsible for the privacy practices, content, or security of any third-party websites or services you access via links within the app. We encourage you to read the privacy policy of any third-party service you visit.

Third-party SDKs and services used in Bonik AI include:

• Firebase (Google) — Analytics, Crashlytics, Performance Monitoring: Firebase Privacy
• Google AI APIs — AI content generation: Google Privacy Policy
• OpenAI — AI content generation: OpenAI Privacy Policy
• Anthropic — AI content generation: Anthropic Privacy Policy
• Meta (Facebook) SDK — App install campaigns & app events: Meta Privacy Policy
• Google Play Billing — In-app payments: Google Play Terms

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, products, legal requirements, or other factors.

• The "Last Updated" date at the top of this page will be revised
• For material changes, we will display an in-app notification prompting you to review the updated policy before continuing to use the app
• We will send an email notification to your registered email address for significant changes that materially affect your rights

Your continued use of Bonik AI after the effective date of the updated policy constitutes your acceptance of the revised terms. If you do not agree with the changes, you may stop using the app and delete your account as described in Section 9.

We recommend checking this page periodically. The current version is always available at bonikai.app/privacy.php.

Bonik AI has a completed Data Safety form on its Google Play Store listing, which provides a transparent summary of data collection and sharing practices. Below is a general overview:

• Account info (name, email) — required, collected from user
• App interactions (feature usage, session data) — required, collected automatically
• Crash logs — required, collected automatically via Crashlytics
• Diagnostics (performance data) — required, collected automatically via Firebase Performance
• Device or other IDs (Advertising ID) — optional, collected for ad campaign measurement (if applicable)
• App activity (install/open events) — optional, collected via Meta SDK for ad campaign measurement (if applicable)

• App interactions and diagnostics shared with Firebase (Google) for analytics and crash reporting
• User prompts shared with AI API providers for content generation — not sold
• Device IDs and app events shared with Meta Platforms, Inc. for app-install campaign measurement — if Meta SDK is enabled

• Data is encrypted in transit (HTTPS/TLS)
• Data can be deleted on request (in-app deletion available)
• This policy is reviewed and updated to maintain Google Play compliance

Refer to Bonik AI's individual Data Safety section on Google Play for the most up-to-date app-specific disclosure.

For any questions, concerns, data requests, or complaints regarding this Privacy Policy or the handling of your personal data, please contact us:

Please use the following subject lines for faster routing:

• "Privacy Request — Bonik AI" — for data access, correction, or portability requests
• "Account Deletion Request — Bonik AI" — for account and data deletion
• "Privacy Complaint — Bonik AI" — for reporting a privacy concern

If you are located in the EU and are not satisfied with our response, you have the right to lodge a complaint with your local Data Protection Authority (DPA).

This section applies specifically to users of Bonik AI located in Bangladesh.

The collection, use, and processing of personal data of Bangladeshi users is subject to the Bangladesh Digital Security Act 2018 and any subsequent amendments or regulations issued by the Bangladesh Telecommunication Regulatory Commission (BTRC) or other relevant authorities.

At present, Bonik AI stores user data on international cloud infrastructure (Google Cloud Platform). By using the app, Bangladeshi users acknowledge that their data may be processed and stored outside of Bangladesh. We are committed to reviewing and complying with any future data localization requirements introduced by Bangladeshi law.

• You have the right to know what personal data Bonik AI holds about you
• You have the right to request correction of inaccurate data
• You have the right to request deletion of your personal data (see Section 9)
• You have the right to withdraw consent for data processing at any time
• You have the right to lodge a complaint with the relevant Bangladeshi regulatory authority if you believe your data rights have been violated

Bangladeshi users should be aware that AI-generated content produced by Bonik AI is created by international AI models and may not always reflect local laws, cultural norms, or regulatory requirements. Users are responsible for ensuring that any AI-generated content they publish or share complies with Bangladeshi law, including the Digital Security Act 2018 and the Information and Communication Technology Act 2006.

Bangladeshi users may direct privacy inquiries in Bengali or English to: support@bonikai.app — subject: "Privacy Request — BD User"