Privacy Policy

Last updated: October 2026

EZBunny ("we," "us," or "our") is a product of Easy Synergy Corp. This policy explains what personal information we collect when you use ezbunny.com and app.ezbunny.com (the "Service"), how we use it, and what choices you have.

1. Information We Collect

In short: we only collect what we need to run your training and keep your account working.

Email address: you give us this when you create an account or join our waitlist. It's how we send you sign-in links.
Name: you provide this during setup or waitlist signup.
Payment information: handled entirely by our payment processor. We never see or store your credit card number, bank details, or other payment credentials.
Training progress and quiz results: we track which modules you've completed and your quiz scores so you (and your admin) can see your progress.
Device and browser information: our servers automatically log your IP address, browser type, operating system, and referral URL. This is standard for any website.
Analytics and error data: we collect page views, the actions you take in the product, screen recordings of the app with anything you type masked out, error reports when something breaks, and (on ezbunny.com) first-touch marketing signals such as which page or campaign referred your visit, and the click identifier Google attaches to the link when you arrive from one of our ads. After you create an account or sign in, we may link that analytics and attribution data to your EZBunny account.
Security and audit logs: we log sign-in events, admin actions taken on your account, and the IP address behind them, so your organization can see who did what.
Bot protection signals: we use a privacy-friendly bot detection service to keep automated scripts from abusing our forms. It may collect browser interaction data to tell humans from bots.

We don't collect Protected Health Information (PHI). EZBunny is a training platform. We don't store, process, or transmit any patient data.

Our free HIPAA tools do not collect consumer health data. The interactive tools on our site (for example the BAA decision tool, cost calculator, and audit-ready scorecard) ask about your organization's compliance practices, not any individual's health, and your answers are scored in your browser. If you ask us to email your report, we receive your email address and a general category of your result (for example a readiness band). We never receive your individual answers, patient information, or the free text of anything you type.

2. How We Use Your Information

In short: we use your info to run the service, send you what you need, fix problems, and see which marketing pages lead to signup.

Run the training platform: track your progress and issue certificates.
Process payments and manage your subscription through our payment processor.
Send you sign-in links, training reminders, and certificate notifications.
Let waitlist members know when the product is available.
Fix technical problems and prevent abuse.
Measure first-touch marketing attribution. After you create an account or sign in, we may link analytics from ezbunny.com and the app to your account so we can see which pages and campaigns led to signup. When a trial starts from one of our Google ads, we may tell Google Ads so it can count the trial for that ad.

3. Third-Party Services

In short: a handful of service providers help us run EZBunny, and we never sell your information.

Payment processing: We send your email and payment details to our payment processor so they can handle your subscription. Your card number never touches our servers.
Email delivery: We share your email address with our email provider so you get sign-in links, reminders, and notifications.
Waitlist CRM: If you join our waitlist, we share your email and name with our CRM provider to keep you updated.
Cloud hosting: Your account data lives on our cloud provider's servers, encrypted both in transit and at rest.
Content delivery and DNS: Our CDN provider processes IP addresses and request logs to serve the website.
Bot protection: Our bot detection service checks browser interaction data to verify form submissions come from real people.
Authentication: Your login sessions use secure, HTTP-only cookies.

We name four more tools directly, so you can see what each one collects:

PostHog: our product analytics tool. It captures page views, the actions you take in the product, and screen recordings of the app with anything you type masked out, so we can see which parts of EZBunny confuse people. After you create an account or sign in, we may link analytics events (including first-touch marketing attribution from ezbunny.com) to your EZBunny account so we can see which pages and campaigns led to signup. We do not sell this data or use it for advertising on other companies' sites.
Affonso: our affiliate attribution tool. It records that your visit arrived through a partner link, using a cookie that lasts 60 days, so the partner gets credit if you sign up.
Sentry: our error monitoring tool. It receives crash and error reports and page-load timing so we can find and fix faults.
Google Ads: our advertising measurement tool. When you reach ezbunny.com from one of our Google ads, Google adds a click identifier to the link. We keep that identifier in the first-touch cookie described in section 4. If you then start a trial, we may send Google Ads that identifier, the date and time the trial started, and a reference number, so Google can count the trial for the ad you clicked. We do not send your name, your email address, or your organization's name, and nothing about your training.

We don't sell your personal information. Period. If you want to know exactly which providers we use, email us at the address below.

4. Cookies

In short: some cookies keep you signed in. Others tell us how the product is used and which page or campaign brought you here. Your browser can clear any of them. We do not show a separate cookie banner on the marketing site for this soft launch.

Here is what each kind of cookie does:

Authentication: secure, HTTP-only cookies that keep you signed in to the app.
Product analytics: cookies PostHog sets on the marketing site and the app so we can see how pages and the product are used. Section 3 says what PostHog collects and when we link it to your account.
First-touch attribution: a first-party cookie we set on ezbunny.com that records which page or campaign referred your visit and, when you arrive from one of our Google ads, the click identifier Google attached to the link. It lasts up to 90 days. We use it to connect that first touch to your account after you sign up or sign in, and to report a trial back to Google Ads as described in section 3.
Affiliate referral: a cookie Affonso sets, lasting 60 days, that records the partner link your visit arrived through.

Your browser is where you control them. Every major browser lets you see the cookies a site has set, delete them, and block new ones, usually under Settings and then Privacy. Clearing the authentication cookie signs you out. Clearing analytics, attribution, or affiliate cookies does not erase your training records. Those live in your account.

5. Data Retention

In short: we keep your data while your account is active, and some records stay longer. The table says which, and why.

Here is what we keep, for how long, and what an erasure request removes. Where the answer is no, the reason sits in the same row. Section 6 explains how to ask.

How long we keep each kind of information, and what an erasure request removes.
What we hold	How long	What decides that	Erased if you ask?
Account and profile	While your account is active	We keep it while there is an account to serve.	Yes
Training records your organization assigned (completions, quiz results, certificates, signed training statements)	While your organization subscribes: up to 10 years from the date of each record. After a subscription ends: at least 30 days, and then we may delete them.	They are your organization's training records, and your organization is their custodian and keeps its own copies. Laws such as HIPAA (45 CFR 164.530) and Texas Health and Safety Code 181.101(d) require organizations to keep them. We hold them for your organization while it uses EZBunny, and the name and email they carry stay inside them.	No. Your organization's admin can ask us to delete them. You can get a copy.
Progress and quiz results in optional library courses	While your account is active	We keep it while there is an account to serve.	Yes
Email records	1 to 10 years, by kind	We keep the record of what we sent you in full, your address included, to establish, exercise or defend legal claims. Contract and billing email, 10 years. Invitations, training reminders and certificate notices, 6 years, because your organization owes six years of documentation that its workforce was trained and reminded, and our send log is part of that evidence. Routine product email, 1 to 3 years.	No
Payment and billing	About 7 years	Invoices, the payment method and the billing address are your organization's financial records, held by our payment processor. We keep them to answer questions about past charges and to support tax filings for earlier years.	No
Sign-in history	While your account is active	A security record of who signed in to your account, and when.	Yes
Admin and audit records	Kept as a security record	Retained by design, so there is a lasting record of who did what to an organization's account.	No
Analytics and error data	Kept while useful for product improvement, or while linked to an active account for attribution	Some stays as aggregate product metrics. When linked to your account for attribution, that link is account-related personal information.	Aggregate-only: No. Account-linked analytics: Yes (we unlink or erase the personal link on request; aggregate counts may remain).

Deleted data leaves our backups within 30 days.

6. Your Privacy Rights

In short: you can ask us what we hold, get a copy, fix it, have it erased, or opt out of sharing. One email starts any of it.

Everyone gets the same privacy rights here, wherever you live. This is a commitment we make to you in this policy, and we keep it for anyone who asks.

Know what we hold: ask us what personal information we have about you.
Get a copy: ask us for a copy of your account data.
Correct it: ask us to fix personal information that's wrong.
Have it erased: ask us to delete your personal information. The table in section 5 says what an erasure removes, what stays, and why.
Opt out of sale or sharing: we don't sell your personal information. One thing we do may count as "sharing" under some state laws. The next paragraph says what it is and how to opt out.

We don't sell your personal information. When you start a trial after clicking one of our Google ads, we may send Google Ads the click identifier described in section 3, so Google can count the trial for that ad. Some state privacy laws may treat that as "sharing" your personal information for cross-context behavioral advertising, which is the legal term for targeting ads based on your activity across other companies' sites.

How to opt out of sharing. Use the Do Not Sell or Share My Personal Information link at the bottom of any page on ezbunny.com, where one button opts out the browser you're using. Or turn on Global Privacy Control (GPC) in your browser, and we won't send the click identifier from that browser. Or email privacy@ezbunny.com, and we'll remove the click identifier from your account so we don't send it. We send it only once, when your trial starts. Opt out before then, and we never send it.

How to ask, and how we check it's you. Email privacy@ezbunny.com. We confirm that you control the email address on your account, and that's the only check we run: we will never ask you for a driver's license, a passport, or any other ID document. Asking for a passport to act on a privacy request would mean collecting more sensitive information about you than we started with, which defeats the point.

We'll respond within 45 days. We won't treat you differently for exercising your rights.

If we say no. You can appeal within 60 days of our decision by replying to the same address. If we turn down your appeal, we'll tell you how to contact your state Attorney General.

Training records your organization assigned. An organization admin can take you off their roster and free up your seat. Training records your organization assigned are your organization's records. We keep them for the period in section 5 even when we erase the rest of your account, and only your organization's admin can ask us to delete them. You can always ask us for a copy.

7. Data Security

In short: your data is encrypted everywhere, and we don't touch patient information.

All data is encrypted in transit using HTTPS/TLS.
Data at rest is encrypted by our cloud provider.
Login sessions use secure, HTTP-only cookies with magic link verification.
We don't collect or store Protected Health Information (PHI).

If we discover a security incident affecting your personal information, we will notify you and applicable authorities as required by law.

8. Children's Privacy

EZBunny isn't built for children under 13, and we don't knowingly collect their information. If we find out we have, we'll delete it right away. If you think a child under 13 has given us personal information, please let us know at privacy@ezbunny.com.

9. Changes to This Policy

We may update this policy from time to time. If we make a material change (for example, linking analytics to your account for attribution), we will email you if you have an account and post a notice on our site before the change takes effect. If you keep using the Service after that, you accept the updated policy.

10. Contact Us

Questions about this policy or want to exercise your privacy rights? Reach out:

Easy Synergy Corp
Email: privacy@ezbunny.com