Privacy Policy

Introduction

This Privacy Policy explains how Bloomomo ("we", "us") collects, uses, and protects information when you visit our website, create an account, make payments, use credits, and generate AI images or videos. By using Bloomomo, you agree to the practices described in this Policy.

This Policy is designed to comply with applicable data protection laws, including the EU General Data Protection Regulation (GDPR), the UK Data Protection Act, and the California Consumer Privacy Act (CCPA / CPRA). Where local laws provide stronger protections, those laws prevail.

Eligibility

Bloomomo is intended for users aged 18 and over. We do not knowingly collect personal information from individuals under 18. If you believe a minor has provided us with personal information, please contact support@bloomomo.com and we will take steps to delete it.

Data We Collect

We collect the following categories of information:

• Account data — name, email address, OAuth identifiers (when you sign in with GitHub or Google), authentication tokens, and password hash (if applicable).
• Payment data — Stripe customer ID, subscription status, payment history, and billing-related metadata. We do not store full credit card numbers; payment cards are processed by Stripe.
• Generation data — prompts, reference images and other materials you upload, generation parameters, and AI-generated outputs.
• Credit and transaction data — credit balances, credit transaction history (purchases, usage, refunds, monthly distributions).
• Server logs — IP address, user agent, request timestamps, and operational metadata used for security, abuse detection, and troubleshooting.
• Support communications — emails and messages you send to support@bloomomo.com, and our responses.
• Cookie data — see the Cookies section below.

We do not intentionally collect sensitive categories of personal data (such as health information, racial or ethnic origin, or biometric data). If you provide such information through prompts or reference materials, we process it only as part of providing the AI generation service.

How We Use Your Data

We use the information we collect to:

• create and manage your account;
• provide AI image and video generation services;
• process payments, refunds, and credit transactions;
• maintain your generation history and account workspace;
• prevent abuse, fraud, and violations of our Terms;
• respond to your support requests;
• send service-related notifications (such as account verification, password reset, billing, and policy updates);
• comply with legal and regulatory obligations;
• improve the reliability and performance of the service.

We do not use your prompts, reference materials, or generated outputs to train our own AI models. See the Service Providers section below for how third-party AI providers may handle your data.

Legal Basis for Processing

Where the GDPR or similar laws apply, we rely on the following legal bases:

• Performance of a contract — for processing necessary to provide the service you have requested (such as account creation, generation requests, and payment processing).
• Legal obligation — for processing required by law (such as retaining payment records for tax purposes).
• Legitimate interests — for processing necessary for our legitimate operations (such as security monitoring, abuse prevention, and service improvement), where these do not override your rights and freedoms.
• Consent — where we ask for your specific consent (such as opt-in to optional model improvement programs or analytics cookies).

You may withdraw consent at any time, where consent is the legal basis for processing. Withdrawing consent does not affect processing already performed based on previous consent.

Service Providers and Third Parties

We use the following categories of service providers:

• Authentication — GitHub OAuth, Google OAuth.
• Payment processing — Stripe.
• Email delivery — Resend.
• Cloud hosting and storage — Cloudflare.
• Anti-abuse and CAPTCHA — Cloudflare Turnstile.
• AI generation — third-party AI providers including OpenAI, Google, and ByteDance. We may use technical service integrators to connect to these providers, and we may add or replace providers from time to time.
• Analytics — privacy-friendly analytics tools (where enabled).

Affiliate tracking. We use Affonso (https://affonso.io) as our affiliate attribution provider. When you visit Bloomomo via an affiliate link, Affonso sets a first-party cookie (affonso_referral) on our domain to attribute the visit. When you sign up or make a purchase, we share your account email and user ID with Affonso to credit the referring affiliate. Review Affonso's privacy practices at https://affonso.io/privacy. To opt out of affiliate tracking, decline cookies via your browser settings or our Cookie Policy preferences (where applicable).

These providers process your data only as needed to deliver their services and under their own respective terms. We share with them only what is necessary for the agreed purpose. The list of providers may change as we add or replace them; this Privacy Policy will be updated accordingly.

We do not sell your personal data. Where you have rights under the CCPA / CPRA to opt out of "sale" or "sharing" of personal information, those rights are honored.

International Data Transfers

Bloomomo operates globally. Your data may be transferred to and processed in countries other than your country of residence, including the United States. Where data is transferred to countries that do not provide an adequate level of protection under your local law, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission, or other lawful transfer mechanisms made available by our service providers.

Business customers who need a Data Processing Agreement may contact support@bloomomo.com.

Data Retention

We retain your information for the following periods:

• Account data — for as long as your account is active. After you close your account, we delete personal account data within 30 days.
• Generation data (prompts, reference materials, generated outputs) — retained while your account is active. After account closure, we delete this data within 90 days.
• Payment and credit transaction records — retained for 7 years to comply with tax and accounting obligations.
• Abuse and violation records — retained for up to 2 years to prevent repeat violations.
• Server logs — retained for 30 days.
• Backups — retained for 30 days, after which they are overwritten or deleted.
• Support communications — retained for 2 years.

We may retain information for longer where required by law or where reasonably necessary for ongoing investigations, dispute resolution, or compliance.

Your Rights

Subject to applicable law, you have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you.
• Correction — request correction of inaccurate or incomplete data.
• Deletion — request deletion of your data, subject to legal retention obligations (such as the 7-year payment record retention).
• Data portability — request your data in a machine-readable format.
• Restriction of processing — request that we restrict processing in certain circumstances.
• Objection — object to processing based on legitimate interests.
• Opt-out of sale or sharing — we do not sell your data; California residents may confirm this and exercise opt-out rights under the CCPA / CPRA.
• Non-discrimination — exercising your privacy rights will not result in adverse treatment of your account or service.
• Lodge a complaint — if you are not satisfied with our response, you may lodge a complaint with your local data protection authority.

To exercise any of these rights, please contact support@bloomomo.com. We will respond within 30 days; in complex cases, we may extend the response period by up to an additional 60 days and will inform you of the reason. We may ask you to verify your identity before responding to certain requests to protect your data from unauthorized access.

We may decline or limit a request if it is manifestly unfounded, excessive, or where we are required to retain the data by law.

Cookies

We use cookies and similar technologies for the following purposes:

• Strictly necessary cookies — session, authentication, and CSRF protection. These are required for the service to function and cannot be disabled.
• Analytics cookies (where enabled) — privacy-friendly analytics tools to understand site usage. Where these set cookies, they are configured to minimize personal data collection.
• Marketing cookies — we do not currently use marketing or advertising cookies.

You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies may prevent the service from functioning properly.

Security and Data Breaches

We use technical and organizational measures designed to protect your information, including encryption in transit, access controls, and operational logging. No system is perfectly secure, and we cannot guarantee the absolute security of your data.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours where required by law, and we will inform affected users without undue delay.

Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' advance notice through email or in-product notification before the changes take effect. Non-material changes (such as typo corrections, formatting, or clarifications that do not affect your rights) may take effect immediately upon posting. Your continued use of Bloomomo after the effective date constitutes acceptance of the updated Policy.

Where applicable law requires separate consent for a particular change (such as expanded uses of your data), we will seek that consent separately.

Data Controller and Contact

The data controller for Bloomomo is the operating entity of the service. We will update this Privacy Policy to specify the controller's legal name and contact details once our operating entity is established.

For privacy-related questions, requests, or complaints, please contact:

support@bloomomo.com