Privacy Policy

Depending on how you use the Platform, we may collect the following categories of personal data:

• Identity & contact data — such as your name, email address, phone number, date of birth, country of residence, and (where required to arrange insurance) identification details.
• Insurance & trip data — such as trip destinations and dates, travellers, vehicle details, coverage preferences, and information relevant to eligibility, quotes, and claims.
• Transaction data — such as policies you hold, premiums, and payment status. Card and banking details are handled by our payment providers, not stored by us.
• Conversation data — the messages, questions, and documents you share with the Bonsai chat assistant.
• Usage & device data — such as log data, device and browser information, and cookies or similar technologies.

If you provide personal data about another person (for example, a fellow traveller or named driver), you confirm that you are authorised to do so and to share it with us for the purposes set out below.

We collect personal data directly from you when you create an account, interact with the chat assistant, request quotes, arrange cover, or make a claim. We also collect certain data automatically through your use of the Platform, and may receive data from insurers, brokers, and payment providers involved in your transactions.

We use personal data to:

• provide the Platform, including generating quotes, comparisons, and responses;
• arrange insurance through Willy Insurance Brokers and the relevant insurers, and to support claims;
• process payments and manage your account and policies;
• communicate with you, including sending confirmations and service messages;
• improve, secure, and troubleshoot the Platform, and comply with legal and regulatory obligations.

Where the PDPA requires consent, we rely on the consent you provide; in other cases we rely on applicable exceptions or legitimate interests permitted by law.

We share personal data only as necessary to provide the Platform and arrange your insurance, including with:

• Willy Insurance Brokers, the licensed broker that arranges your insurance;
• Insurers, to obtain quotes, issue cover, and assess claims;
• Payment providers, to process transactions;
• Technology service providers (for example, hosting and, where used, AI processing providers) that help us operate the Platform under appropriate confidentiality and data protection obligations; and
• Authorities or third parties where required or permitted by law.

We do not sell your personal data.

The Platform uses automated tools, including AI, to understand your requests and present information and options. Content you share in chat may be processed by these tools to generate responses. AI output is provided for information only and is not financial advice; you should verify important information against the insurer’s policy documents. We take reasonable steps to limit the personal data used for these purposes.

Some of our service providers may process data outside Singapore. Where personal data is transferred overseas, we take reasonable steps to ensure it is protected to a standard comparable to the PDPA, including through contractual safeguards.

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, including to meet legal, regulatory, accounting, or reporting requirements. When data is no longer needed, we take reasonable steps to delete or anonymise it.

We implement reasonable technical and organisational measures to protect personal data against unauthorised access, use, or disclosure. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Subject to the PDPA, you may:

• request access to the personal data we hold about you and information about how it has been used;
• request correction of personal data that is inaccurate or incomplete; and
• withdraw consent to our collection, use, or disclosure of your personal data, on reasonable notice.

Withdrawing consent may mean we are unable to continue providing some or all of the Platform, or to arrange or maintain your insurance. To make a request, contact our Data Protection Officer (below).

We use cookies and similar technologies to operate the Platform, remember your preferences, and understand usage. You can manage cookies through your browser settings, although some features may not work correctly if cookies are disabled.

The Platform is intended for users aged 18 and above. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us so we can take appropriate steps.

We may update this Policy from time to time. If we make material changes, we will take reasonable steps to notify you. The “last updated” date above indicates when this Policy was last revised.

If you have questions about this Policy, or wish to make an access, correction, or consent-withdrawal request, please contact our Data Protection Officer at [dpo@bonsai.example].