Privacy Notice

1. Roles

Bloomod is an infyne.in product. In this notice, “Bloomod”, “we”, “us” and “our” refer to the operator of the Bloomod service. Where you use Bloomod to verify, invite, remind and connect event attendees, your business is the controller of the attendee records you collect or import, and Bloomod is the processor acting on your instructions. Where we handle your own account data, such as the people who sign in, billing details, support correspondence and visits to this website, we are the controller.

The processing terms that govern the first relationship are set out in the data processing agreement.

2. What we collect

Account and workspace data

Name, work email address, profile photo (if added) and sign-in method of each member
Sign-in details. Bloomod is passwordless: you sign in with a one-time email code or with Google or Microsoft. We do not create or store a password. When you sign in with Google or Microsoft, we receive your basic profile (name, email address and account identifier) and do not keep that sign-in token as a calendar credential.
Organisation name, logo, membership and role
Notification preferences and in-app notifications
Session and security records, such as active sessions and sign-in attempts
Support correspondence

Calendar connections

When you connect Google Calendar or Microsoft Outlook, the access and refresh tokens that the provider issues to Bloomod, the connected account’s email address and the permissions granted
These tokens are stored encrypted and used only to create, update and cancel the calendar events you ask Bloomod to send, create meeting links you choose, and read the responses to those events. You can disconnect a calendar at any time.

Event and attendee records

Event details you enter, such as title, description, time, time zone, location and meeting link
Attendee name and email address, and how the attendee was added (event page, embedded form, CSV import or manual entry)
Verification status and the time the verification link was used
Calendar invitation, update, cancellation and reminder delivery status
RSVP responses (Accepted, Tentative, Declined or Awaiting response) received from calendar providers or through response links
An activity log of actions taken on each event

Attendee email addresses are encrypted at rest. A keyed hash of the address is used to find duplicates without reading the address itself.

Bloomod SMTP and sending identity

Sending domains you add, the DNS records we ask you to publish and their verification results
Event sender names and addresses you create
Delivery logs for email sent from your domain, such as recipient, status and time
Calendar replies sent back to your sender address, which are processed to record RSVP responses

Billing data

Your plan (Seed, Stem or Bloom), add-ons, subscription status and billing period
Calendar invitation and email credit balances, purchases and usage
Payment references and status returned by our payment processor. Card and bank details are entered with and held by the payment processor; Bloomod does not receive or store full card numbers.

Technical data

Log data for application requests, including IP address, browser and device information
Rate-limiting and abuse-prevention records for public event pages and registration forms
Delivery, bounce and response events returned by calendar and email providers
For an early access request: the IP address the request was sent from, and an approximate location (typically city, region and country) derived from it. That location is determined by sending the IP address to an external geolocation provider, which acts as a processor for this lookup. The result is an estimate, not a precise position, and we do not store the provider’s raw response.

We do not ask for, and Bloomod is not intended to store, special category data, payment card numbers or government identifiers inside event or attendee records.

3. How it is used

Personal data is processed to provide the Bloomod workflow:

Verify: save attendees to the event they registered for or were imported into, check address quality and send single-use verification links
Invite: deliver calendar invitations, updates and cancellations to verified attendees through your connected calendar or Bloomod’s email delivery
Remind: send the reminder emails you enable, and any reminder you send by hand
Connect: include your meeting link, record RSVP responses, and show contacts, analytics and exports in your workspace

We also process personal data to:

Create and secure accounts, including sign-in codes and session management
Verify and operate sending domains and senders for Bloomod SMTP
Manage subscriptions, credits, invoices and payments
Send workspace notifications you have chosen to receive
Enforce sending limits, verification, anti-spam and acceptable-use rules
Maintain security, prevent abuse and investigate misuse
Provide support and essential service communication

If you choose to use AI assistance to improve an event description, the description text you submit is sent to an AI service provider to generate a suggestion. Attendee records are not sent for this purpose.

We do not sell personal data. We do not use attendee records to build profiles for our own purposes, to train AI models, or to market to your attendees.

4. Legal basis

For account, workspace and billing data we rely on performance of a contract, on legal obligations such as tax and accounting rules, and, for security, abuse prevention and service improvement, on our legitimate interests. Website analytics rely on our legitimate interest in understanding how the website is used, or on your consent where the law requires it. For attendee records processed on your behalf, the legal basis is yours to establish and document. You are responsible for ensuring that your event collection and imports are lawful and that attendees expect to hear from you.

Personal data is shared only with:

Calendar providers: Google and Microsoft, through the connections you authorise, to place and update calendar events and read responses
Email delivery providers: to send verification, invitation, reminder, notification and sign-in emails, and to operate Bloomod SMTP sending domains
Payment processor: to take payments and manage subscriptions
AI service provider: only for event description text you choose to refine
Analytics provider: Google Analytics, for aggregate website visit measurement
Infrastructure providers: hosting, storage, logging and monitoring under contract
Authorities: where we are legally required, and where permitted we will tell you first

Each provider acts under contract and only for the purpose described. A current list of subprocessors is available on request from the address below.

6. Cookies and analytics

The Bloomod workspace uses strictly necessary cookies to keep you signed in and to protect forms against cross-site request forgery. This marketing website uses Google Analytics to understand, in aggregate, how visitors use it; Google Analytics sets its own cookies and processes your IP address and device information. The website also stores your theme and accent colour choice in your browser. You can block or delete cookies in your browser settings; necessary cookies are required for sign-in to work.

7. Retention and deletion

Attendee records are retained while their event and your workspace are active, or until you remove them
Past events may be archived automatically, and remain available to your workspace until deleted
Verification, delivery and activity records are retained for a defined period to support audit, security and dispute resolution
Billing and payment records are retained for as long as tax and accounting law requires
Disconnecting a calendar stops its use, and the stored tokens are removed or revoked
An account owner can request deletion of the account and workspace from Settings. After confirmation, the workspace, its events, attendee records and uploaded files are deleted, except where we must keep limited records by law

8. Your rights

Depending on where you are, you may have rights of access, correction, deletion, restriction, objection and portability, and the right to withdraw consent. If you are an attendee who registered for, or was invited to, an event through Bloomod, the business running that event is the controller. We will pass your request to them and support them in answering it.

If you are an account holder, you can update your profile and preferences in the workspace, or write to the address below. We will respond within the period required by applicable law.

9. Security

Attendee data is available only to members of the organisation that owns it and to authorised Bloomod personnel where operationally required. Attendee email addresses and calendar connection tokens are encrypted at rest, sign-in is passwordless, and data is protected in transit. Relevant controls are described on the security page. No platform can promise perfect security, and this notice does not claim otherwise.

10. International transfers

Data may be processed outside your country by our infrastructure, email, payment and AI providers. Where that happens, transfers are made under a recognised transfer mechanism. Calendar providers necessarily receive the invitation in the region where the recipient’s account is held.

11. Children

Bloomod is a business service and is not directed at children. Organisers who invite students or other young people are responsible for obtaining any parental or guardian consent the law requires before adding them as attendees.

12. Changes to this notice

We update this notice when the service changes. The date at the top shows the latest version, and we will tell account holders about material changes before they apply.

13. Contact

Questions, requests or complaints: [email protected]. If you are not satisfied with our response you may complain to your local supervisory authority.