Privacy Policy

The data controller for your personal data is Blooomy. For any privacy-related questions, you can contact us at: privacy@blooomy.app.

Email address: We collect your email address when you sign up for the waitlist or create an account. This data is necessary to communicate service updates and manage your access to the platform.

Anonymous usage data: We collect aggregated, anonymous information about website usage, such as the number of pages visited and session duration. This data cannot be traced back to individual users and is used exclusively to improve the service.

Voice recordings: When you use the voice feature of the application, audio recordings are processed through the Whisper API (provided by Groq) for transcription to text. Audio recordings are not permanently stored on our servers once transcription is complete. The transcribed text is saved to your personal knowledge base.

We use the data we collect for the following purposes:

- Service delivery: managing your account, processing voice recordings, maintaining your personal knowledge base, and providing coaching services through Bruno.

- Product improvement: analysing aggregated, anonymous usage data to understand how the service is used and identify areas for improvement.

- Service communications: sending you important service-related updates, waitlist notifications, and communications strictly necessary for the operation of the platform.

The processing of your data is based on:

- Consent (Art. 6(1)(a) GDPR): for waitlist registration and sending communications.

- Performance of a contract (Art. 6(1)(b) GDPR): for providing the requested service.

- Legitimate interest (Art. 6(1)(f) GDPR): for service improvement through aggregated, anonymous analysis.

We rely on the following third-party providers for the operation of the service:

- Fontshare (Indian Type Foundry): We use the Fontshare service for web font loading. Fontshare may collect limited technical data (such as IP address) during font loading. For more information, please refer to the Fontshare privacy policy.

- Vercel: Our website is hosted on Vercel. Vercel may collect technical access logs necessary for the operation of the infrastructure. For more information, please refer to the Vercel privacy policy (https://vercel.com/legal/privacy-policy).

- Google Analytics 4 (Google Ireland Limited): used only with your explicit consent via the cookie banner. Purpose: site usage statistics, traffic sources and conversions (e.g. waitlist sign-ups). IP address is anonymized. Data may be transferred outside the EU (SCC + EU-US Data Privacy Framework). See the Cookie Policy for details.

- Google Search Console (Google Ireland Limited): used to monitor site indexing and search ranking. Does not set cookies in your browser.

- Resend (Resend Inc.): used for transactional emails (account verification, launch updates). Your email address is transmitted for delivery.

- Supabase (Supabase Inc.): used as the backend database and auth for the service. Waitlist and account data are stored in Supabase-managed infrastructure.

We do not sell, share or transfer your personal data to third parties for marketing purposes. We do not run ad retargeting.

We retain your personal data only for as long as is strictly necessary for the purposes for which it was collected:

- Waitlist data: retained until the service launch or until you request deletion.

- Account data: retained for the duration of the contractual relationship and deleted within 30 days of account closure, unless required by law.

- Voice recordings: not permanently stored. Deleted after transcription.

- Anonymous usage data: retained in aggregated form without time limits, as it cannot be traced to individual users.

In accordance with the General Data Protection Regulation (GDPR), you have the following rights:

- Right of access (Art. 15): You may request a copy of the personal data we hold about you.

- Right to rectification (Art. 16): You may request correction of inaccurate or incomplete personal data.

- Right to erasure (Art. 17): You may request deletion of your personal data ("right to be forgotten").

- Right to data portability (Art. 20): You may request to receive your data in a structured, commonly used and machine-readable format.

- Right to object (Art. 21): You may object to the processing of your personal data on legitimate grounds.

- Right to restriction (Art. 18): You may request restriction of the processing of your data in certain circumstances.

To exercise any of these rights, contact us at: privacy@blooomy.app. We will respond to your request within 30 days.

You also have the right to lodge a complaint with the competent supervisory authority (in Italy: Garante per la Protezione dei Dati Personali - https://www.garanteprivacy.it).

We implement appropriate technical and organisational measures to protect your personal data from unauthorised access, loss, destruction or alteration. These measures include: encryption of data in transit (HTTPS/TLS), access to data restricted to authorised personnel, and security procedures for our service providers.

Some of our service providers (such as Vercel) may process data on servers located outside the European Economic Area (EEA). In such cases, we ensure that transfers comply with the GDPR, through standard contractual clauses or adequacy decisions of the European Commission.

We reserve the right to update this privacy policy at any time. In the event of material changes, we will notify you by email or by posting a notice on our website. We encourage you to review this page periodically to stay informed.

For any questions, requests or concerns regarding this privacy policy or the processing of your personal data, you can contact us at: privacy@blooomy.app.