Privacy policy
DRAFT, not yet published · last edited 29-07-2026
Fill in the marked fields once the business registration is complete and remove this block. This text is based on what the code actually collects.
1. Who processes your data
[trade name of the sole proprietorship], KVK [KVK number], is the controller for the processing of personal data via Bloome. Questions: [contact email address].
2. What data we process
| Data | Purpose | Retention |
|---|---|---|
| Email address, name, password (encrypted) | Account and login | As long as the account exists |
| Journal, tracker and tool content | Bloome's core function | As long as the account exists |
| Avatar (photo) | Recognisability in the portal | As long as the account exists |
| Language preference | Showing the site in the right language | As long as the account exists |
| Payment details | Processed by Stripe; we never see your full card or account number | At Stripe, per their retention period |
| Email address (mailing list) | Keeping you posted about Bloome, if you sign up for it | Until you unsubscribe |
| Visit statistics | Seeing which pages are visited. No cookies, no IP addresses, no individual visitors identifiable | Aggregated, no personal data |
| IP address (when logging in, signing up and the mailing list) | Used briefly to detect and limit automated abuse (rate limiting, bot detection) | A few days at most |
| Session recordings and heatmaps (only with your consent) | Seeing where visitors get stuck: mouse movement, scrolling and clicks, recorded by Inspectlet. Passwords, email fields and free text are not recorded | At Inspectlet, according to their retention period |
3. Legal basis
We process your data to perform the agreement (your membership), and for the mailing list based on your consent, which you can withdraw at any time.
4. Sharing with third parties
- Stripe (payments): processes your payment details, we only receive status and invoice data.
- Cloudflare (hosting and database): stores the data Bloome runs on.
- [email service, e.g. Resend] (email): sends things like password-reset emails on our behalf.
We do not sell data to third parties and do not use it for advertising purposes.
5. Your rights
You can view and update your data via your profile, and delete your account there yourself: after confirming with your password you have 14 days to undo this (just log back in), after which everything is permanently deleted. For access, correction or export of your data you can email [contact email]. We respond within four weeks.
6. Security
Passwords are stored encrypted (never in readable form), connections run over HTTPS, and sensitive APIs explicitly send no caching instructions so data can't linger on a shared device.
7. Cookies
Bloome uses functional, technically necessary cookies: to keep you signed in and to remember your language. On top of that we use Google Analytics to measure which pages are read, and Inspectlet records how visitors move through the site (mouse, scrolling and clicks) so we can see where something does not work. Both only if you allow it. Say no and not a single measurement cookie is placed and nothing is recorded. We remember your choice in your own browser and you can change it any time through "Cookie choices" at the bottom of the page. We do not use advertising cookies.
8. Complaints
If we can't resolve things together, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).