Privacy Notice

Bloom for Mums Ltd (Company No. 17208397), the controller of your personal data, is registered with the UK Information Commissioner's Office (ICO) under registration number ICO:00014027338.

Contact: hello@bloomformums.com

• Bloom is anonymous by design. No name, email, phone number or account is required to use the app.
• We do not sell, share or advertise on your data.
• The 2am Club community rooms use anonymous flower nicknames (e.g. Wildflower-7a3b) generated for you. We never know who you are.
• Posts in community rooms are automatically deleted after 30 days.
• Bloom is a peer-support companion, not a medical service. For clinical care speak to your GP, midwife or health visitor. In an emergency call 999.

From the Talk to Bloom AI chat: the text of your messages, sent transiently to Anthropic to generate a reply. No name, email, IP-linked profile or device ID is sent.

From the 2am Club community rooms: the text of posts you publish, your randomly-generated flower nickname, the room name, and a timestamp. These are stored in our backend (Supabase, EU region) for up to 30 days, then permanently deleted.

If you report a post: the report reason, an optional note, and a link to the reported post. Reports are visible only to moderators.

If you submit an appeal: the post being appealed and your appeal message. Visible only to you and moderators.

Technical data: standard request metadata (IP address, user agent) handled by our hosting provider Cloudflare for security and routing. Not stored by Bloom.

• Consent (Art. 6(1)(a)) — for sending your chat text to Anthropic, and for opt-in voice replies via ElevenLabs.
• Legitimate interests (Art. 6(1)(f)) — for running the community rooms safely, including content moderation, safeguarding, and keeping a moderator-only audit log.

We do not rely on any special-category processing (UK GDPR Art. 9). Bloom is not a medical service and we do not record health data tied to an identifiable individual.

We use the following sub-processors. Transfers outside the UK rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

• Supabase, Inc. — EU-region database for community posts and reports. Privacy: supabase.com/privacy
• Anthropic, PBC (USA) — AI chat replies. Contractually bound not to use Bloom conversations to train its models. Privacy: anthropic.com/legal/privacy
• ElevenLabs, Inc. (USA) — opt-in text-to-speech for AI replies. No user voice is sent. Privacy: elevenlabs.io/privacy
• Resend, Inc. (USA) — transactional email to the Bloom team only. Privacy: resend.com/legal/privacy-policy
• Cloudflare, Inc. — edge hosting and DDoS protection. Privacy: cloudflare.com/privacypolicy

• Community room posts: 30 days, then automatically purged.
• Moderation evidence (posts removed for safeguarding reasons): retained in a moderator-only archive for up to 12 months.
• AI chat messages: not stored by Bloom. Anthropic's transient processing is governed by their policy.

You have the right to access, rectify, erase, restrict and object to the processing of your data, and to data portability. Because Bloom is anonymous, in most cases we hold no data linked to you as an identifiable individual.

To exercise a right, email hello@bloomformums.com. We respond within one calendar month.

You have the right to complain to the ICO: ico.org.uk · 0303 123 1113.

Posts in the 2am Club are screened before they appear. Posts containing crisis or harmful content may be hidden automatically and replaced with crisis-support resources.

If your post is hidden, you can challenge the decision via the in-app Appeals page. We aim to review appeals within 10 working days.

Bloom community rooms are restricted to users aged 18 or over. We do not knowingly process data from children. If you believe a child has used the rooms, contact us and we will remove the relevant posts.

Database access is protected with row-level security so that posts and reports can only be read by their author or by trained moderators. Service-level credentials are kept server-side and never exposed to the browser.

We will update this notice when we change how we process data. The "Last updated" date at the top tells you when it last changed.