Privacy Policy
Last updated: September 20, 2026
The French version of this document is the only legally binding version.
This Policy tells you the conditions under which BloomVisor collects and processes your personal data when you use our service. It sets out the categories of data processed, the purposes pursued, the retention periods, the recipients, as well as the rights available to you and how to exercise them.
Our commitment: to collect only the data strictly necessary for our activities, in line with the principle of data minimization. We may update this Policy; the date of the last update appears at the top of this page.
Definitions
- "Service" means the BloomVisor application, available at bloomvisor.com, which creates, schedules, and publishes content on your social media accounts.
- "Client" means the professional who subscribes to the Service and connects their accounts.
- "Personal data" means any information relating to an identified or identifiable natural person within the meaning of the GDPR.
- "GDPR" means Regulation (EU) 2016/679 of 27 April 2016 on the protection of personal data.
- "French Data Protection Act" means French law n°78-17 of 6 January 1978, as amended.
Identity of the data controller
Your personal data is processed by [FULL LEGAL NAME, LEGAL FORM], registered under number [SIREN], whose registered office is located at [ADDRESS].
Contact: bloomvisor@gmail.com
We act as data controller within the meaning of the GDPR. No data protection officer has been appointed, as our activity does not fall under any of the cases that would make this appointment mandatory.
Purposes, legal bases, and retention periods
Your data is collected directly from you when you create an account, use the Service, and connect your social media accounts.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Create and manage your account | Name, email, business name | Performance of the contract | Duration of the relationship, then deletion |
| Create and publish your content | Brand style, uploaded photos, descriptions, generated visuals, scheduled posts | Performance of the contract | Duration of the relationship, then deletion |
| Publish to your accounts on your behalf | Technical identifiers and permissions of connected accounts | Performance of the contract | Until the account is disconnected |
| Learn your editorial style | Your posts already published and their photos | Performance of the contract | Duration of the relationship |
| Reply to your private messages and reviews | Replies written by the Service, identifier of the original message | Performance of the contract, once you activate this feature | Duration of the relationship |
| Manage the subscription and billing | Customer identifier, subscription status, invoices | Performance of the contract, legal obligation | Invoices: 10 years (French Commercial Code, art. L123-22) |
| Secure accounts and prevent abuse | IP address, connection logs, device fingerprint | Legitimate interest | 12 months maximum |
| Provide support | Identity, email, content of exchanges | Performance of the contract | 3 years from the last exchange |
| Measure usage and fix errors | Pages viewed, actions in the application, technical errors | Legitimate interest | 13 months maximum |
| Defend our rights | Identity, email, evidence | Legitimate interest | Duration of the applicable statute of limitations |
Some data may be subject to specific retention periods required by law. Where necessary to defend our rights, it may be kept for as long as required for that purpose.
Messages and reviews received by our Clients
The Service may draft replies to the private messages and reviews received by our Clients. These messages and reviews contain data about third parties who are not our Clients. This point is worth explaining in detail.
- This feature is off by default. It only turns on if the Client explicitly activates it. While it is off, no private message is read.
- The text of incoming messages is not kept. We store the technical identifier of the message, so we never reply to it twice, along with the reply drafted by the Service. The content of the original message stays with the messaging platform.
- The Service holds back rather than making things up. When it does not have the requested information, it hands off to the Client instead of composing a reply.
- For this processing, the Client is the data controller and BloomVisor acts on its behalf, following its instructions.
Automated decisions
When the Client activates automatic replies, messages are drafted and sent under their name without prior review. These replies produce no legal effect and do not significantly affect anyone: they provide information and hand off as soon as information is missing. The Client can turn off this feature at any time, and anyone can ask for human intervention by contacting them directly.
Your rights
The regulations give you several rights over your personal data:
- Access: get confirmation that your data is being processed and receive a copy of it.
- Rectification: have inaccurate or incomplete data corrected.
- Erasure: get your data deleted in the cases provided for by law.
- Restriction: temporarily suspend the use of certain data.
- Objection: object to processing based on legitimate interest.
- Portability: retrieve your data in a usable format and pass it on to a third party.
- Post-mortem directives: arrange what happens to your data after your death.
Exercising these rights may be subject to the conditions and limits set out in the regulations. To exercise them, write to bloomvisor@gmail.com. Proof of identity may be requested if there is serious doubt about who you are.
Deleting your account also deletes your content, disconnects your social media accounts, and ends your subscription. Media you have uploaded is deleted within thirty days, a delay meant to protect you against an accidental deletion.
You can also file a complaint with the French data protection authority: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07. Phone: +33 1 53 73 22 22. Website: www.cnil.fr
Data sharing and transfers
For the purposes described above, your data may be shared with the following recipients, none of whom use it for their own purposes:
- Database and authentication provider: storage of your data and management of your sign-in.
- Hosting providers: application server and storage of the media you upload.
- Vercel: hosting of the interface.
- Cloudflare Turnstile: protection of forms against bots.
- Stripe: payments and subscriptions. We never receive your card number.
- Email delivery provider: service-related messages.
- PostHog: usage measurement and error tracking.
- Crisp: support messaging.
- Professional advisors, public authorities where legally required, and third parties involved in a merger or acquisition, subject to confidentiality.
The named, up-to-date list of these providers is available on request at the contact address given below.
Some of these providers are located outside the European Economic Area, in countries without an adequacy decision. In that case, appropriate safeguards are put in place under Article 46 of the GDPR, in particular through standard contractual clauses. You can get information about these safeguards by contacting us.
The Service links to third-party platforms, in particular social networks. How these platforms process your data is governed by their own policies, which we invite you to review.
Cookies and trackers
We set the cookies strictly necessary for the Service to work, in particular to keep you signed in and secure forms. These cookies are exempt from consent.
Audience measurement cookies are only set with your consent. Refusing is as easy as accepting, and you can change your mind at any time. No advertising cookie is set. Our cookies last no longer than thirteen months, in line with the CNIL's recommendation.
The demo videos on our homepage are hosted by Vimeo. The player only loads when you click it, and only then does Vimeo set a third-party cookie: simply opening the page sets none.
Data security
We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, alteration, or disclosure. Access to your data is compartmentalized by workspace.
We do not collect your password. Authentication is handled by our technical provider, the only one to receive and store it, in encrypted form. We never have access to it. We also do not hold your social media passwords or your card numbers.
Contact us
For any question about this Policy or about how we process your data, write to bloomvisor@gmail.com.