Privacy Policy

Blommy gives local businesses one morning briefing of what customers say about them, an inbox to reply from, and a place to post to their social accounts. This page explains what personal information we handle, why, and what you can do about it. Questions: hello@blommy.co.

Two kinds of people, two roles

• Business owners who sign up: we decide how your account information is used, so we're responsible for it.
• Customers of those businesses whose reviews, comments, tags or messages reach the business on Google, Facebook, Instagram or TikTok: the business connected its own accounts and decides how to respond, so the business is responsible for that information. We process it on the business's behalf, only to show it to them and help them reply.

What we collect

• Business owners: your email address and Google account ID (you sign in with Google), and the business you pick: its name, address, type, country, time zone and public Google rating.
• From connected accounts: reviews, comments, tags and messages sent to the business, with the name or username, rating, date and link that come with them, whether they've been replied to, and the replies and posts the business sends through Blommy. Before a business connects its Google Business Profile we show a short preview of its newest public Google reviews, which we replace once the profile is connected.
• What we work out: for each review, comment or message, a short summary, its mood (positive, negative and so on), its topics and whether it needs a reply.
• Posts: the text and images a business writes or uploads to post from Blommy.

We never see your social media passwords or card details, and we don't sell personal information.

How we use it

• To run accounts and sign you in.
• To write each business's morning briefing, show its inbox and to-do list, and send the replies and posts it chooses to send.
• To summarise, sort and suggest replies and posts with Google's Gemini AI. Suggestions are never sent without the business pressing send. Google doesn't use this data to train its models.

Who we share it with

Only the service providers we need to run Blommy:

• Google Cloud (hosting, in Belgium, and Gemini on Vertex AI) and Google Maps Platform (business listings, ratings and the review preview).
• Neon (database, in Germany).
• Zernio, which connects to Google Business Profile, Facebook, Instagram and TikTok with the business's permission, fetches its reviews, comments and messages, and delivers the replies and posts it sends.
• Google, for signing in.
• Dodo Payments, which processes subscription payments as merchant of record. Card details go straight to them; we only receive your subscription status.
• The platforms themselves, when a business replies or posts: what it sends is published there under that platform's own privacy policy.

Some of these providers process data outside your country. We use providers that protect it under contract and apply recognised safeguards for international transfers.

Cookies

We use essential cookies only: one to keep you signed in, one to remember which of your businesses is open, and short-lived ones during Google sign-in and while you pick your business. No advertising or analytics cookies.

How long we keep it

Information is kept while the business's account is open. Removing a business in Blommy deletes its briefings, inbox and connections straight away. When an account is closed, we delete its information within 30 days, apart from anything we must keep by law. Disconnecting an account on Google, Facebook, Instagram or TikTok stops us fetching anything new from it.

Your rights

Depending on where you live (for example under South Africa's POPIA, the EU and UK GDPR, or US state laws), you can ask to see, correct or delete your information, or object to how it's used. Email hello@blommy.co. If your review, comment or message reached a business through Blommy, we'll pass your request to that business and help them deal with it. You can also complain to your local data protection authority.

Security

Data is encrypted in transit, secrets are kept in Google Secret Manager, and access to production systems is restricted. No system is perfectly secure, so if something goes wrong we'll tell affected people and authorities as the law requires.

Changes

If we change this policy in a meaningful way, we'll update the date above and tell business owners by email.