Privacy Policy

Pensy Group ("we," "us," or "our") operates Pensy.AI, an AI-powered self-awareness companion accessible at pensy.ai (the "Service"). The Service is primarily a web-based chat platform with email-based daily reflections and additional integrations. This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you use our Service. By using Pensy.AI, you agree to the collection and use of information in accordance with this Privacy Policy.

We are committed to protecting your privacy and being transparent about our data practices. Please read this Privacy Policy carefully to understand how we handle your information.

1. Information We Collect

We collect the following categories of information when you use Pensy.AI:

Account Information

• Email address (used for account creation and login)
• Password (stored in hashed form; we never store plaintext passwords)
• Username or display name

Phone Number (Optional)

You may optionally provide your mobile phone number to receive SMS coaching messages when that feature becomes available. Your phone number is not required to use the core chat and email features of the Service.

Payment Information

When you subscribe to Pensy Pro, your payment is processed by Stripe, Inc. We do not store your full credit card number, CVV, or other sensitive payment details on our servers. Stripe may collect your card number, expiration date, billing address, and other payment details directly. We receive and store only a Stripe customer ID, payment status, and transaction metadata (such as the amount and date of your subscription).

Message Content

We store the content of messages you send to and receive from Pensy.AI across all channels (web chat, email, and SMS when available). This includes your questions, reflections, and any personal information you choose to share during conversations. Message history is retained to provide continuity in your experience.

AI-Processed Data and Coaching Memory

Our AI system processes your messages to generate personalized coaching responses. During this process, the system may identify and store "memory" items — key details you share such as your profile information, strategic priorities, goals, behavioral patterns, relationship context, and personal preferences. This memory is used to personalize your coaching experience over time and make responses more relevant to your specific situation.

Agent Processing Logs

We store internal logs from our multi-agent AI system that detail how your messages were processed, which coaching frameworks were applied, and how responses were generated. These logs help us ensure quality and improve our coaching methodology.

Usage Data

We automatically collect information about how you interact with our web application, including pages visited, features used, subscription status and billing history, message frequency, and timestamps of interactions.

Cookies and Session Data

We use session cookies to authenticate your identity when you log into the Pensy.AI web application. These cookies are essential for maintaining your login session and do not track you across other websites. We do not use advertising cookies or third-party tracking cookies.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Provide AI Coaching Services: To deliver personalized coaching through our web chat interface, process your questions, and generate relevant guidance through our multi-agent AI system.
• Deliver Daily Reflections: To send daily morning coaching emails and, when available, SMS messages personalized to your life.
• Personalize Your Experience: To build and maintain your coaching memory, enabling increasingly tailored and relevant advice based on your priorities, patterns, and goals.
• Process Payments: To manage your subscription, process payments, and handle billing through our payment provider, Stripe.
• Manage Your Account: To create and maintain your account, authenticate your identity, and provide customer support.
• Improve Our Services: To analyze usage patterns, refine our AI coaching models, improve message quality, and develop new features.
• Communicate With You: To send service-related notifications, account updates, and respond to your inquiries or support requests.
• Ensure Security: To protect against unauthorized access, fraud, and other security threats.
• Comply With Legal Obligations: To meet applicable legal requirements, respond to lawful requests, and protect our rights.

3. AI and Automated Processing

Pensy.AI uses artificial intelligence to provide its coaching services. Understanding how your data is processed by AI is important to us, so we want to be fully transparent about these practices.

How AI Processes Your Messages

When you send a message to Pensy.AI (via web chat, email, or SMS), your message is processed by a multi-agent AI system powered by OpenAI's GPT-4o-mini model. Multiple specialized AI agents work together to analyze your message, consider your coaching context, apply relevant decision-making frameworks, and generate a thoughtful response. This process happens in real time to provide you with timely coaching.

Data Sent to OpenAI

To generate responses, we send the following data to OpenAI's API: the content of your current message, relevant portions of your conversation history, your coaching memory (profile information, strategic priorities, and behavioral patterns), and system instructions that define the coaching methodology. OpenAI processes this data to generate responses and, per our agreement with OpenAI, does not use data submitted through the API to train their models. For more information, please refer to OpenAI's privacy policy and API data usage policies.

How Coaching Memory Works

Our AI system automatically identifies important details from your conversations — such as your goals, relationships, recurring challenges, and decision-making patterns — and stores them as memory items. This memory allows Pensy.AI to provide coaching that is contextually aware and builds on previous conversations rather than starting fresh each time.

Your Control Over Memory

You have full visibility into and control over your coaching memory. Through your dashboard, you can view all stored memory items, understand what information Pensy.AI has retained about you, and request deletion of specific memory items or your entire memory profile. You can also download a complete copy of your memory, and everything else stored under your account, yourself: use Export my data in your dashboard account settings or in the mobile app under Settings → Your data.

4. SMS/Text Messaging (Coming Feature)

SMS coaching is a planned feature. When it becomes available, the following terms will apply. Until then, the primary ways to interact with Pensy.AI are through our web chat interface and email.

Consent and Opt-In

By providing your phone number and opting in to SMS on Pensy.AI, you expressly consent to receive SMS text messages from us. These messages may include coaching messages, responses to your incoming texts, and service-related notifications. You must opt in to receive SMS messages; we will never send unsolicited text messages to numbers that have not been registered and opted in through our Service.

Message Frequency

When enabled, you may receive coaching messages and responses to texts you initiate. The total number of messages varies based on your usage and interaction frequency.

SMS Delivery

SMS messages are delivered through Twilio, Inc., our third-party messaging provider. Twilio processes your phone number and message content to facilitate delivery. Standard message and data rates from your wireless carrier may apply. Message frequency varies. Pensy.AI is not responsible for charges imposed by your mobile carrier.

How to Opt Out of SMS

You can opt out of receiving SMS messages at any time by texting STOP to any message from Pensy.AI. You may also opt out by updating your preferences in your account dashboard or by contacting us at contact@pensygroup.com. After opting out, you will receive one final confirmation message. Opting out of SMS does not affect your access to web chat, email, or other features of the Service.

5. Third-Party Services

We use the following third-party services to operate Pensy.AI. Each service receives only the minimum data necessary to perform its function:

OpenAI

OpenAI provides the AI language model (GPT-4o-mini) that powers our coaching responses. We send message content, relevant conversation history, and coaching memory to OpenAI's API for processing. OpenAI processes this data in accordance with their API data usage policy and does not use API inputs to train their models. For details, visit openai.com/privacy.

Twilio

Twilio provides SMS messaging infrastructure for our upcoming SMS feature. When SMS is enabled, Twilio receives your phone number and the content of SMS messages sent between you and Pensy.AI to facilitate message delivery. Twilio processes this data in accordance with their privacy policy. For details, visit twilio.com/legal/privacy.

Stripe

Stripe processes all payment transactions for subscription billing. When you subscribe, Stripe receives your payment card details, billing address, and transaction amount directly. We do not have access to your full card number. Stripe processes this data in accordance with their privacy policy and PCI DSS compliance standards. For details, visit stripe.com/privacy.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with our Services. Specifically:

• Account Information: Retained for the duration of your active account and for up to 30 days after account deletion to allow for recovery.
• Message History: Retained for the duration of your active account. Deleted upon account deletion or upon request.
• Coaching Memory: Retained for the duration of your active account. You may delete individual memory items at any time, and all memory is deleted upon account deletion.
• Agent Processing Logs: Retained for up to 90 days for quality assurance purposes, then automatically purged.
• Payment Records: Retained for up to 7 years as required by applicable tax and financial regulations.
• Session Cookies: Expire when you log out or after a period of inactivity.

You may delete your account yourself at any time — Delete my account in your dashboard account settings, or in the mobile app under Settings → Your data. Deletion takes effect immediately: your account is closed, you are signed out on every device, and neither you nor anyone else can reach the data again. It is then permanently erased from our systems within 30 days, subject to any legal retention obligations. You may also request deletion by contacting us at contact@pensygroup.com.

7. Data Security

We take the security of your personal information seriously and implement industry-standard measures to protect it:

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS (Transport Layer Security).
• Secure Database Storage: Your data is stored in a secured PostgreSQL database with access controls and encryption at rest.
• Password Hashing: User passwords are hashed using industry-standard algorithms and are never stored in plaintext.
• Access Controls: Access to user data is restricted to authorized personnel and systems on a need-to-know basis.
• Session Security: Authentication sessions are managed through secure, HTTP-only cookies to prevent unauthorized access.
• API Security: Communications with third-party services (OpenAI, Twilio, Stripe) are conducted over encrypted channels using authenticated API keys.

While we strive to protect your personal information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but are committed to promptly addressing any security incidents and notifying affected users in accordance with applicable law.

8. Your Rights and Choices

You have the following rights regarding your personal information:

• Access Your Data: You can view your account information, message history, and coaching memory through your Pensy.AI dashboard at any time.
• Delete Your Account: You can delete your account and all associated data from your dashboard account settings, or in the mobile app under Settings → Your data. Your account closes immediately and cannot be restored by you; the data is permanently erased within 30 days. You can also request deletion by contacting us at contact@pensygroup.com.
• Opt Out of SMS: If you have opted in to SMS messaging, you can stop receiving SMS messages at any time by texting STOP, updating your account settings, or contacting us. See Section 4 for details.
• Manage Your Coaching Memory: You can view, review, and request deletion of any or all memory items stored by our AI system through your dashboard.
• Data Portability: You can download your personal data in a machine-readable format (JSON) at any time using Export my data in your dashboard account settings or in the mobile app under Settings → Your data. You can also request an export by contacting us at contact@pensygroup.com, which we will fulfill within 30 days.
• Correct Your Information: You can update your email address, phone number, and other account details through your dashboard or by contacting us.
• Withdraw Consent: Where we rely on your consent to process data, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing conducted prior to withdrawal.

To exercise any of these rights, please contact us at contact@pensygroup.com or call (917) 410-0193. We will respond to all requests within 30 days.

9. Children's Privacy

Pensy.AI is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take immediate steps to delete that information from our servers. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at contact@pensygroup.com so we can take appropriate action.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by posting the updated Privacy Policy on this page with a revised "Last Updated" date. For significant changes, we may also notify you via email or SMS. We encourage you to review this Privacy Policy periodically. Your continued use of the Service after any changes to this Privacy Policy constitutes your acceptance of the updated terms.

11. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

12. California and State-Specific Privacy Rights

California Consumer Privacy Act (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which the information was collected, the business purpose for collecting the information, and the categories of third parties with whom we share the information.
• Right to Delete: You have the right to request that we delete the personal information we have collected about you, subject to certain exceptions provided by law.
• Right to Opt Out of Sale: We do not sell your personal information to third parties. We do not share your personal information for cross-context behavioral advertising purposes.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights. We will not deny you services, charge you different prices, or provide you with a different level of service for exercising your rights.
• Right to Correct: You have the right to request correction of inaccurate personal information that we maintain about you.

Categories of Personal Information Collected

Under the CCPA, we collect the following categories of personal information: identifiers (name, email, phone number), commercial information (subscription status, billing history), internet or electronic network activity (usage data, session logs), and inferences drawn from the above (coaching memory, behavioral patterns, strategic priorities).

How to Exercise Your Rights

To submit a verifiable consumer request to exercise your California privacy rights, please contact us at contact@pensygroup.com or call (917) 410-0193. We will verify your identity before fulfilling your request and respond within 45 days. You may designate an authorized agent to make a request on your behalf.

Other State Privacy Laws

Residents of other states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, and other states that have enacted consumer privacy legislation) may have similar rights to access, delete, and correct their personal information, as well as to opt out of certain data processing activities. To exercise these rights, please contact us using the information provided in Section 11. We will process your request in accordance with applicable state law.