Privacy Policy

Pensy Group ("we," "us," or "our") operates Pensy.AI, an AI-powered self-awareness companion accessible at pensy.ai (the "Service"). The Service is primarily a web-based chat platform with email-based daily reflections and additional integrations. This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you use our Service. By using Pensy.AI, you agree to the collection and use of information in accordance with this Privacy Policy.

We are committed to protecting your privacy and being transparent about our data practices. Please read this Privacy Policy carefully to understand how we handle your information.

1. Information We Collect

We collect the following categories of information when you use Pensy.AI:

Account Information

• Email address (used for account creation and login)
• Password (stored in hashed form; we never store plaintext passwords)
• Username or display name

Phone Number (Optional)

You may optionally provide your mobile phone number to receive SMS coaching messages when that feature becomes available. Your phone number is not required to use the core chat and email features of the Service.

Payment Information

When you subscribe to a paid plan, your payment is processed by Stripe, Inc. We do not store your full credit card number, CVV, or other sensitive payment details on our servers. Stripe may collect your card number, expiration date, billing address, and other payment details directly. We receive and store only a Stripe customer ID, payment status, and transaction metadata (such as the amount and date of your subscription).

Message Content

We store the content of messages you send to and receive from Pensy.AI on every channel you use: web chat and voice, the mobile app, a messaging service you connect (such as Telegram or Slack), an AI assistant you authorize, and any reply you send to one of Pensy's emails. This includes your questions, reflections, and any personal information you choose to share during conversations. Message history is retained to provide continuity in your experience.

AI-Processed Data and Coaching Memory

Our AI system processes your messages to generate personalized coaching responses. During this process, the system may identify and store "memory" items — key details you share such as your profile information, strategic priorities, goals, behavioral patterns, relationship context, and personal preferences. This memory is used to personalize your coaching experience over time and make responses more relevant to your specific situation.

Agent Processing Logs

We store internal logs from our multi-agent AI system that record how your messages were processed, which coaching frameworks were applied, and how responses were generated. These logs include the text of your messages and of Pensy's replies, are linked to your account, and are used to ensure quality and to investigate problems. They are included in your data export and erased with the rest of your data (see Section 6).

Usage Data

We automatically collect information about how you interact with our web application, including pages visited, features used, subscription status and billing history, message frequency, and timestamps of interactions.

Cookies, Analytics and Advertising Measurement

We use a session cookie to keep you signed in to the Pensy.AI web application. It is essential to the Service and is not used to track you on other websites.

On our public marketing pages only — the home page, the pricing, comparison and use-case pages, the sign-up page, and this policy and our Terms — we use Google Analytics to understand how visitors find and use the site, and Google Ads conversion tracking to measure whether our ads lead to sign-ups. These Google tags set cookies and send Google information such as the page you viewed (with anything personal removed from its address), your browser and device type, an approximate location derived from your IP address, how you arrived at the site, and, when you create an account, the fact that a sign-up happened. We switch off Google's ad-personalization and Google-signals features for these tags.

We do not load Google Analytics or Google Ads inside the signed-in app (chat, dashboard and account settings), on the sign-in and password-reset pages, or for visitors who are signed in, and we never send them the content of your conversations, your coaching memory or your account details. If your browser sends a Global Privacy Control or Do Not Track signal, we don't load these tags at all. You can also opt out of Google Analytics with Google's browser add-on (tools.google.com/dlpage/gaoptout) and manage Google ad settings at adssettings.google.com.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Provide AI Coaching Services: To deliver personalized coaching through our web chat interface, process your questions, and generate relevant guidance through our multi-agent AI system.
• Deliver Daily Reflections: To send daily morning coaching emails and, when available, SMS messages personalized to your life.
• Personalize Your Experience: To build and maintain your coaching memory, enabling increasingly tailored and relevant advice based on your priorities, patterns, and goals.
• Process Payments: To manage your subscription, process payments, and handle billing through our payment provider, Stripe.
• Manage Your Account: To create and maintain your account, authenticate your identity, and provide customer support.
• Improve Our Services: To analyze usage patterns, refine our AI coaching models, improve message quality, and develop new features.
• Communicate With You: To send service-related notifications, account updates, and respond to your inquiries or support requests.
• Ensure Security: To protect against unauthorized access, fraud, and other security threats.
• Comply With Legal Obligations: To meet applicable legal requirements, respond to lawful requests, and protect our rights.

3. AI and Automated Processing

Pensy.AI uses artificial intelligence to provide its coaching services. Understanding how your data is processed by AI is important to us, so we want to be fully transparent about these practices.

How AI Processes Your Messages

When you send a message to Pensy.AI (in web chat, by voice, in the mobile app, through a service you connect such as Telegram, Slack or an AI assistant, or by replying to one of Pensy's emails), your message is processed by a multi-agent AI system powered by large language models from OpenAI. Multiple specialized AI agents work together to analyze your message, consider your coaching context, apply relevant decision-making frameworks, and generate a thoughtful response. This process happens in real time to provide you with timely coaching.

Data Sent to OpenAI

To generate responses, we send the following data to OpenAI's API: the content of your current message (including the audio of voice messages and any images you share), relevant portions of your conversation history, your coaching memory (profile information, strategic priorities, and behavioral patterns), and system instructions that define the coaching methodology. OpenAI processes this data to generate responses and, per our agreement with OpenAI, does not use data submitted through the API to train their models. For more information, please refer to OpenAI's privacy policy and API data usage policies.

How Coaching Memory Works

Our AI system automatically identifies important details from your conversations — such as your goals, relationships, recurring challenges, and decision-making patterns — and stores them as memory items. This memory allows Pensy.AI to provide coaching that is contextually aware and builds on previous conversations rather than starting fresh each time.

Your Control Over Memory

You have full visibility into and control over your coaching memory. Through your dashboard, you can view all stored memory items, understand what information Pensy.AI has retained about you, and request deletion of specific memory items or your entire memory profile. You can also download a complete copy of your memory, and everything else stored under your account, yourself: use Export my data in your dashboard account settings or in the mobile app under Settings → Your data.

4. SMS/Text Messaging (Coming Feature)

SMS coaching is a planned feature. When it becomes available, the following terms will apply. Until then, the primary ways to interact with Pensy.AI are through our web chat interface and email.

Consent and Opt-In

By providing your phone number and opting in to SMS on Pensy.AI, you expressly consent to receive SMS text messages from us. These messages may include coaching messages, responses to your incoming texts, and service-related notifications. You must opt in to receive SMS messages; we will never send unsolicited text messages to numbers that have not been registered and opted in through our Service.

Message Frequency

When enabled, you may receive coaching messages and responses to texts you initiate. The total number of messages varies based on your usage and interaction frequency.

SMS Delivery

SMS messages are delivered through Twilio, Inc., our third-party messaging provider. Twilio processes your phone number and message content to facilitate delivery. Standard message and data rates from your wireless carrier may apply. Message frequency varies. Pensy.AI is not responsible for charges imposed by your mobile carrier.

How to Opt Out of SMS

You can opt out of receiving SMS messages at any time by texting STOP to any message from Pensy.AI. You may also opt out by updating your preferences in your account dashboard or by contacting us at contact@pensygroup.com. After opting out, you will receive one final confirmation message. Opting out of SMS does not affect your access to web chat, email, or other features of the Service.

5. Third-Party Services

We use the following third-party services to operate Pensy.AI. Each service receives only the minimum data necessary to perform its function:

OpenAI

OpenAI provides the AI language models that power our coaching responses, voice transcription and spoken replies. We send message content, relevant conversation history, and coaching memory to OpenAI's API for processing. OpenAI processes this data in accordance with their API data usage policy and does not use API inputs to train their models. For details, visit openai.com/privacy.

Twilio

Twilio provides SMS messaging infrastructure for our upcoming SMS feature. When SMS is enabled, Twilio receives your phone number and the content of SMS messages sent between you and Pensy.AI to facilitate message delivery. Twilio processes this data in accordance with their privacy policy. For details, visit twilio.com/legal/privacy.

Stripe

Stripe processes all payment transactions for subscription billing. When you subscribe, Stripe receives your payment card details, billing address, and transaction amount directly. We do not have access to your full card number. Stripe processes this data in accordance with their privacy policy and PCI DSS compliance standards. For details, visit stripe.com/privacy.

Google

Google provides the analytics and advertising-measurement tags used on our public marketing pages (see "Cookies, Analytics and Advertising Measurement" in Section 1) and serves the web fonts our pages use, which means Google receives your IP address and browser details when a page loads. If you connect Google Calendar, Google also exchanges your calendar data with us so Pensy can coach around your schedule. For details, visit policies.google.com/privacy.

Resend

Resend delivers our emails, including your morning messages and account emails, and receives your email address and the content of those emails to do so. For details, visit resend.com/legal/privacy-policy.

Services You Choose to Connect

If you connect Pensy to another service — such as Telegram, Slack, Amazon Alexa, Google Calendar, or an AI assistant you authorize — messages and data you send through that service pass through it under its own privacy policy. Push notifications you turn on are delivered through the push service run by your browser or device maker.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with our Services. Specifically:

• Account Information: Retained while your account is open, and after you delete your account until it is erased (see "Deleting your account" below).
• Message History: Retained while your account is open. You can ask us to delete it at any time by emailing contact@pensygroup.com, and it is erased with the rest of your data when your account is erased.
• Coaching Memory: Retained while your account is open. You can delete individual memory items yourself at any time; the rest is erased with your account.
• Agent Processing Logs: Retained while your account is open and erased with the rest of your data when your account is erased. We may also delete older logs sooner.
• Payment Records: Retained for up to 7 years as required by applicable tax and financial regulations.
• Security Records: A minimal record of security events — such as sign-in attempts to administrative accounts and account deletion requests (the email address, time and IP address involved) — is kept to protect the Service and to show that deletion requests were honored.
• Session Cookies: Expire when you log out, or after 30 days.

7. Data Security

We take the security of your personal information seriously and implement industry-standard measures to protect it:

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS (Transport Layer Security).
• Secure Database Storage: Your data is stored in a secured PostgreSQL database with access controls and encryption at rest.
• Password Hashing: User passwords are hashed using industry-standard algorithms and are never stored in plaintext.
• Access Controls: Access to user data is restricted to authorized personnel and systems on a need-to-know basis.
• Session Security: Authentication sessions are managed through secure, HTTP-only cookies to prevent unauthorized access.
• API Security: Communications with third-party services (OpenAI, Twilio, Stripe) are conducted over encrypted channels using authenticated API keys.

While we strive to protect your personal information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but are committed to promptly addressing any security incidents and notifying affected users in accordance with applicable law.

8. Your Rights and Choices

You have the following rights regarding your personal information:

• Access Your Data: You can view your account information, message history, and coaching memory through your Pensy.AI dashboard at any time.
• Delete Your Account: You can delete your account from your dashboard account settings, in the mobile app under Settings → Your data, or by email — see Deleting your account. Your account closes immediately; permanent erasure of the stored data follows as described in Section 6, and you can ask us at contact@pensygroup.com to complete it right away and confirm.
• Opt Out of SMS: If you have opted in to SMS messaging, you can stop receiving SMS messages at any time by texting STOP, updating your account settings, or contacting us. See Section 4 for details.
• Manage Your Coaching Memory: You can view, review, and request deletion of any or all memory items stored by our AI system through your dashboard.
• Data Portability: You can download your personal data in a machine-readable format (JSON) at any time using Export my data in your dashboard account settings or in the mobile app under Settings → Your data. You can also request an export by contacting us at contact@pensygroup.com, which we will fulfill within 30 days.
• Correct Your Information: You can update your email address, phone number, and other account details through your dashboard or by contacting us.
• Withdraw Consent: Where we rely on your consent to process data, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing conducted prior to withdrawal.

To exercise any of these rights, please contact us at contact@pensygroup.com or call (917) 410-0193. We will respond to all requests within 30 days.

9. Children's Privacy

Pensy.AI is not intended for use by individuals under the age of 18, and everyone creating an account must confirm they are at least 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take immediate steps to delete that information from our servers. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at contact@pensygroup.com so we can take appropriate action.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by posting the updated Privacy Policy on this page with a revised "Last Updated" date. For significant changes, we may also notify you via email or SMS. We encourage you to review this Privacy Policy periodically. Your continued use of the Service after any changes to this Privacy Policy constitutes your acceptance of the updated terms.

11. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

12. California and State-Specific Privacy Rights

California Consumer Privacy Act (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which the information was collected, the business purpose for collecting the information, and the categories of third parties with whom we share the information.
• Right to Delete: You have the right to request that we delete the personal information we have collected about you, subject to certain exceptions provided by law.
• Right to Opt Out of Sale or Sharing: We do not sell your personal information. Our use of Google Ads conversion tracking on our public marketing pages (Section 1) may count as "sharing" for cross-context behavioral advertising under California law; it never involves the content of your conversations or your coaching data. You can opt out by turning on Global Privacy Control in your browser, which our site honors automatically, or by contacting us.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights. We will not deny you services, charge you different prices, or provide you with a different level of service for exercising your rights.
• Right to Correct: You have the right to request correction of inaccurate personal information that we maintain about you.

Categories of Personal Information Collected

Under the CCPA, we collect the following categories of personal information: identifiers (name, email, phone number), commercial information (subscription status, billing history), internet or electronic network activity (usage data, session logs, and analytics data from our public marketing pages), and inferences drawn from the above (coaching memory, behavioral patterns, strategic priorities).

How to Exercise Your Rights

To submit a verifiable consumer request to exercise your California privacy rights, please contact us at contact@pensygroup.com or call (917) 410-0193. We will verify your identity before fulfilling your request and respond within 45 days. You may designate an authorized agent to make a request on your behalf.

Other State Privacy Laws

Residents of other states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, and other states that have enacted consumer privacy legislation) may have similar rights to access, delete, and correct their personal information, as well as to opt out of certain data processing activities. To exercise these rights, please contact us using the information provided in Section 11. We will process your request in accordance with applicable state law.