Privacy Policy
Last updated: 5 August 2026
01 Introduction and scope
This policy explains how Bloom DevLabs Corp., as controller, handles personal data across BloomCONNECT.
02 Information we collect
Account details, billing information, conversation content you process, usage data and support correspondence.
03 How we use information
To provide and improve the service, bill you, and support you. We do not sell personal data.
04 AI processing transparency
We do not train models on your customer data absent a written agreement, and our enterprise agreements with model providers prohibit training on your data.
05 Legal bases
We rely on contract performance, legitimate interests, consent where required, and legal obligation.
06 Sharing and sub-processors
We share data only with the sub-processors listed at /subprocessors/, under contract.
07 International transfers
Transfers outside the EU rely on Standard Contractual Clauses.
08 Retention
Active accounts: for the life of the account. Conversations: 3 years, configurable. Financial records: 10 years per BIR requirements. Backups: 90 days. Logs: 12 months.
09 Your rights under GDPR/UK GDPR
Access, rectification, erasure, restriction, portability and objection, with a response within 30 days, extendable to 60.
10 Your rights under the Philippine Data Privacy Act
Under RA 10173 you have rights to access, correction, erasure or blocking, damages and data portability, and may complain to the National Privacy Commission. Our Data Protection Officer is reachable at privacy@bybloomlabs.com.
11 California privacy rights (CPRA)
California residents may request access and deletion and may opt out of sale; we do not sell personal data.
12 Other jurisdictions
Residents elsewhere have rights under their local law; contact us to exercise them.
13 Children
The service is for business use; we do not knowingly collect data from anyone under 16.
14 Cookies and tracking
We use essential, functional, analytics and marketing cookies, and honour the Global Privacy Control signal.
15 Security
We apply the measures described at /security/, including EU data residency and encryption in transit.
16 AI-specific disclosures
Where required, AI interaction is disclosed to end users, in line with the EU AI Act.
17 Marketing communications
You can opt out of marketing at any time; transactional messages will still be sent.
18 Legal disclosures
We may disclose data where required by law or to protect our rights and users.
19 Changes
We will post changes here and notify you of material updates.
20 Contact
Privacy questions and data requests: privacy@bybloomlabs.com.
21 Language
This policy is provided in English; a translation may be provided for convenience but the English version governs.