Privacy Policy

1. Introduction

Bloom a Business LLC ("Bloom," "we," "us," or "our") provides Bloom OS, a business operating system for service businesses. This policy describes what we collect through the application, how we use it, and your choices.

By using Bloom OS, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the service. Questions and requests: security@bloomabusiness.com.

2. What We Collect

2.1 Account Data

Your name, email address, authentication data (managed by Supabase Auth), and your organization membership and Position.

2.2 Business Operations Data

The records your organization creates in Bloom OS — customers, jobs, schedules, invoices, documents, time entries, and related work records.

2.3 Communications

Messages, call and voice transcripts, and email and SMS content processed through the platform's communication pipeline on your organization's behalf.

2.4 Financial Data via Plaid (with your consent)

When you choose to connect a bank account, we receive account and transaction data through Plaid. We never receive or store your bank credentials.

2.5 Technical Data

Log and audit-trail data — actions taken in the system, by whom, and when — kept for security and accountability.

We also automatically collect certain information when you use the Service:

• IP address and approximate location
• Browser type, device information, and operating system
• Pages visited, features used, and time spent
• Referring URLs and search terms
• Error logs and performance data

2.6 Payment Data

When you subscribe to a paid plan, our payment processor (Stripe) collects payment card details. We do not store full credit card numbers on our servers. We receive and store limited payment information from Stripe, including the last four digits of your card, card type, and billing address.

3. SMS and Text Messaging

If you opt in to receive SMS messages from Bloom, we collect and use your mobile phone number to send transactional messages including appointment reminders, verification codes, account notifications, and customer care responses.

• Opt-in: You may opt in through our platform (SMS consent checkbox during account setup) or in-person during service appointments.
• Opt-out: Reply STOP to any message to unsubscribe at any time.
• Help: Reply HELP to any message for support information.
• Frequency: Message frequency varies based on account activity, typically no more than 10 messages per month.
• Costs: Message and data rates may apply. Bloom does not charge for SMS messages, but your carrier may.
• No sharing: Your mobile phone number and SMS consent data will not be shared with or sold to third parties or affiliates for marketing purposes.

For complete SMS program details, see our SMS Terms & Conditions.

4. How We Use Information

We use information to operate Bloom OS for your organization: running your business operations, powering the platform's AI assistance (drafting, scheduling, bookkeeping support — with sensitive actions requiring human approval), securing the platform (audit trails, tenant isolation), and billing. We do not use your data for advertising.

More specifically, we use the information we collect to:

• Provide, operate, and maintain the Service
• Process transactions and send billing-related communications
• Power AI features, including AI agents and document processing
• Send you technical notices, updates, security alerts, and support messages
• Respond to your requests, comments, and questions
• Monitor and analyze trends, usage, and activities to improve the Service
• Detect, prevent, and address fraud, abuse, and technical issues
• Personalize your experience and provide recommendations
• Comply with legal obligations

We do not sell your personal information. We do not use your business data for advertising purposes.

5. How We Share Information

We share data only with the processors required to run the service, and we never sell personal or financial data.

5.1 Service Providers

• Supabase — database, authentication, and file storage
• Vercel — application hosting
• Plaid — bank account connectivity (only if you connect an account)
• Stripe — payment processing
• Telnyx — telephony and SMS delivery
• Resend — transactional email delivery
• AI model providers (e.g., Anthropic, OpenAI) — processing to provide AI features; content is sent only as needed to perform the requested function
• Infisical (self-hosted by Bloom) — credential storage; runs on infrastructure Bloom controls

These providers are contractually obligated to use your information only to provide their services to us and are bound by confidentiality obligations.

Each organization's data is isolated from every other organization by database-enforced row-level security.

5.2 Legal Requirements

We may disclose information where required to do so by law, regulation, legal process, or governmental request.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.

5.4 With Your Consent

We may share information with third parties when you explicitly authorize us to do so, such as when connecting third-party integrations (e.g., QuickBooks, Google Calendar).

6. Bank Connections via Plaid

When you connect a bank account to Bloom OS, you grant Bloom and Plaid access to your account information (such as account details, balances, and transactions) via Plaid Inc. Plaid's handling of your information is governed by the Plaid End User Privacy Policy, which you accept when you connect an account.

You can disconnect a bank account at any time in the application. On disconnection we instruct Plaid to remove the connection, and we delete the associated financial data within 30 days.

7. Data Retention

We keep data only as long as needed for the purposes described above. Specific retention periods — including the seven-year retention of financial and ledger records and the 30-day deletion window for Plaid data after disconnection — are defined in our Data Retention & Deletion Policy.

We retain your information for as long as your account is active or as needed to provide the Service. When you delete your account, we will delete or anonymize your personal information within 30 days, except where we are required to retain it for legal, regulatory, or legitimate business purposes (such as resolving disputes or enforcing our agreements).

Backups containing your data may persist for up to 90 days before being fully purged.

8. Security Measures

We implement industry-standard security measures to protect your information, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Row-level security (RLS) to ensure data isolation between organizations
• Regular security audits and vulnerability assessments
• Secure authentication with support for OAuth and magic links
• Access controls and permissions scoped to your Position
• Regular backups with disaster recovery procedures

While we strive to protect your information, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.

9. Your Rights

You may request access to the personal data we hold about you and request its deletion, subject to legal retention obligations (for example, financial records we must keep for tax purposes). Business records belong to the customer organization; requests concerning organization data are fulfilled with the organization owner.

Depending on your location, you may have the following rights regarding your personal information:

• Access — Request a copy of the personal information we hold about you
• Correction — Request that we correct inaccurate or incomplete information
• Deletion — Request that we delete your personal information
• Export — Request a portable copy of your data in a machine-readable format
• Restriction — Request that we restrict the processing of your information
• Objection — Object to our processing of your information in certain circumstances
• Withdrawal of consent — Withdraw your consent at any time where we rely on consent as the legal basis for processing

To exercise any of these rights, contact us at security@bloomabusiness.com. We will respond to your request within 30 days.

10. Cookies and Tracking

We use cookies and similar tracking technologies to operate and improve the Service:

• Essential cookies — Required for authentication, security, and core functionality. Cannot be disabled.
• Analytics cookies — Help us understand how visitors use the Service (via Vercel Analytics). These collect anonymized usage data.
• Preference cookies — Remember your settings and preferences (e.g., theme, sidebar state).

We do not use advertising or third-party tracking cookies. You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent the Service from functioning properly.

11. Children's Privacy

The Service is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If you are between 13 and 18, you must have the consent of a parent or legal guardian to use the Service. If we learn that we have collected personal information from a child under 13, we will take steps to delete that information promptly. If you believe a child under 13 has provided us with personal information, please contact us at security@bloomabusiness.com.

12. International Data Transfers

The Service is operated from the United States. If you are accessing the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States or other countries where our service providers maintain facilities. By using the Service, you consent to the transfer of your information to these locations.

Where required by applicable law, we implement appropriate safeguards for international data transfers, such as standard contractual clauses or other legally recognized transfer mechanisms.

13. California Privacy Rights

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect and how it is used, the right to request deletion, and the right to opt out of the sale of personal information. We do not sell personal information.

14. Changes to This Policy

We will post any material changes to this policy and update the effective date. This policy is reviewed annually and at material change.

When we make material changes, we will notify you by email or by posting a prominent notice on the Service at least 30 days before the changes take effect. We encourage you to review this policy periodically. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated policy.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: