The short version

We collect what we need to run BloomOS for you: your account details, your farm's details, and the growing and selling records you put in.
Your data is yours. You can export all of it any time, and we never sell it.
Your customers' details belong to you too. We only process them so the app works for you, never for ourselves.
We run no analytics or tracking on this site or in the app today, and there are no advertising cookies anywhere.
We're registered with the UK Information Commissioner's Office (registration ZC214077).

The rest of this page is the detail behind those sentences.

Who we are

BloomOS is built and operated by BloomOS Ltd, a company registered in England (registered office in Devon, England). We are the data controller for the personal data described in this policy, except where the section "Your customers' data" says otherwise. We are registered with the Information Commissioner's Office under registration number ZC214077.

If you have any question about this policy or about your data, email us at [email protected]. It reaches the founders directly.

The data we collect

Your account

Your name, email address and sign-in credentials are handled by Clerk, the sign-in service we use. We store the account identifier Clerk gives us so we know which farm is yours. We never see or store your password.

Your farm

The farm profile you set up: farm name, address and postcode, county or state, country, rough size, timezone and currency. If you give us a UK postcode we look up your approximate coordinates (via postcodes.io) so we can fetch a local weather forecast. That lookup sends only the postcode, nothing about you.

Your growing and selling records

What you put into BloomOS to run your farm: beds, sowings, plantings, cut logs, germination checks, tasks, field notes and photos. Field notes can be dictated by voice. The audio is handled by your own device's built-in speech recognition, and only the resulting text reaches BloomOS. Photos you take are stored with our storage provider (Cloudflare) so they can sync between your devices.

Messages you send us

Support requests, founding-farm applications and waitlist signups come to us by email (delivered by Resend, our email provider) and we keep them so we can reply and follow up.

Technical data

Standard server logs and rate-limiting use IP addresses to keep the service secure. If you turn on push notifications, we store the subscription token your device gives us so we can deliver them. Turning notifications off removes it.

What we don't collect: there are no analytics or tracking SDKs in the app or on this website today, and no advertising identifiers. If we ever introduce product analytics we will update this policy first and tell you.

Your customers' data

If you keep customer records in BloomOS (names, contact details, delivery addresses, orders, invoices, subscriptions), you are the data controller for that information and BloomOS processes it on your instructions, solely to provide the service to you. We never use your customers' details for our own purposes, never contact them, and never share them except with the processors listed below that make the app work (for example, storing them in our database). When you delete a record, or your account, that data goes with it.

You are responsible for having a lawful basis to hold your customers' details. For a working flower business invoicing its own customers, that is ordinarily not an onerous bar, but it is yours to meet.

How we use your data, and the lawful bases

Running BloomOS for you: storing and syncing your records, generating invoices, printing. Lawful basis: performing our contract with you.
Weather forecasts and frost alerts: we send your farm's coordinates (only the coordinates, never your name or account) to our weather providers, Tomorrow.io and OpenWeather. Lawful basis: performing our contract.
Service emails: things like replies to support requests. Lawful basis: performing our contract, and our legitimate interest in running the service properly.
Push notifications: succession reminders, sell-by alerts, weather warnings. Lawful basis: your consent, given when you opt in on your device; withdraw it by turning notifications off.
Anonymous benchmarks: aggregated growing statistics across farms, so growers can see how a season compares. These use only a derived region (the first part of a postcode) and never your raw postcode, farm name or identity. Lawful basis: our legitimate interest in making the product useful, balanced against a design that keeps individual farms unidentifiable.
Security and abuse prevention: logs and rate-limiting. Lawful basis: legitimate interests.
Legal obligations: keeping the records tax and company law require us to keep.
Marketing emails: only if you asked for them (the waitlist), with an unsubscribe in every one. Lawful basis: consent.

We share personal data only with the service providers (processors) that BloomOS is built on, each bound by a data-processing agreement:

Clerk: accounts and sign-in.
Cloudflare: hosting for this website and the app, and photo storage.
Railway: hosting for our servers and database.
Resend: sending our emails.
Tomorrow.io and OpenWeather: weather forecasts; they receive farm coordinates only.
postcodes.io: UK postcode lookup; receives the postcode only.
Xero: only if you choose to connect your Xero account, and only the invoice and contact data needed for that sync. Disconnect any time; we then delete the stored connection tokens (which are encrypted while they exist).

We never sell personal data, we share nothing with advertising networks, and nobody else gets access unless the law compels it.

International transfers

Some of the providers above process data in the United States. Where they do, we rely on the safeguards UK GDPR requires: the UK Extension to the EU-U.S. Data Privacy Framework where the provider is certified, or the ICO's International Data Transfer Agreement / standard contractual clauses otherwise.

How long we keep it

While your account is active: your records stay for as long as you use BloomOS; that is the product.
When you delete your account: we delete your personal data within 30 days, except records we must keep for tax and accounting purposes (generally six years in the UK) and short-lived encrypted backups that expire on their own schedule.
Waitlist emails: kept until you unsubscribe or we launch and the list has done its job.

Security

Data travels encrypted (TLS) between your device, our servers and our providers. Xero connection tokens are encrypted at rest. Access to production data is limited to the two founders and granted on need. One more thing worth knowing because BloomOS is offline-first: a copy of your farm's data lives in the app on your own device so it works in the field. Protect the device with a passcode as you would anything else on it.

Your rights

UK GDPR gives you the right to access your data, correct it, delete it, restrict or object to how it's used, and take it elsewhere (portability). In practice:

Export everything yourself, any time: the app can produce a complete export of your farm's data as CSV files in one download.
For anything else: email [email protected] and we'll act on it within one month, usually much faster. Deleting your account currently works this way too: one email, and we handle it.

If you're unhappy with how we've handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113, though we'd be grateful for the chance to put it right first.

Cookies

This website sets no cookies and runs no analytics. The app at app.bloomos.app uses strictly necessary cookies from Clerk to keep you signed in. Nothing for advertising, nothing for tracking.

Children

BloomOS is a business tool for growers and is not directed at children under 16. We don't knowingly collect their data.

Changes to this policy

If the policy changes we'll update this page and the date at the top; if a change is material we'll tell you in the app or by email before it takes effect.

Contact

BloomOS Ltd · Devon, England · [email protected]

Privacy Policy