Privacy Policy

This policy covers bloomnetwork.ai, the Bloom platform at app.bloomnetwork.ai, our emails, events and sales outreach, and the matching, bidding and payment work we do between hardware companies (“brands”) and providers. Where a separate agreement with you (for example the network terms you accept when you join) says something more specific about information you share on the platform, that agreement applies too.

We are a business-to-business service. Most of the information we handle is about people acting for a company: founders, operators, engineers, buyers and the teams at providers.

Information you give us

• Contact and requests. Your name, work email, company, role and message when you use the contact form, post a request, or describe a job in a search field.
• Request details. What you need made, moved, stored or serviced, quantities, timelines, drawings and files, and, if you share them, your company’s stage, team size and funding.
• Provider information. If you join as a provider: your company, capabilities, capacity, certifications, locations and the people we’ll work with.
• Account and platform activity. Sign-in details, bids, messages, documents, approvals and job records on the platform.
• Payments and credit. Invoice and payment details, and, if you apply for extended payment terms, the business and financial information needed to assess credit. Extended terms are subject to credit approval.
• Newsletter and calls. Your email if you subscribe; your name, email and notes when you book a call through our Google Calendar page.

Information collected automatically

• Device, browser and usage information, such as pages viewed, links clicked, referring site, approximate location from your IP address, and timestamps.
• Session replay. PostHog records how pages are used (clicks, scrolling, mouse movement). Anything you type into a field is hidden from these recordings.
• Cookies and similar technologies, described in section 5.

Information from other sources

• Business data providers and public sources. Company and professional contact information from providers such as Apollo.io, from company websites and from professional networks, which we keep in our CRM (Attio).
• Our network. Introductions and referrals from brands, providers, investors and partners, and information shared at events.

• Answer your messages and requests, and set up calls.
• Match each request to providers whose capabilities fit, let interested providers express interest, and let the brand approve who bids and compare bids.
• Run the work around a job: contracts, milestones, invoices, payments, and credit decisions for extended payment terms.
• Review provider applications: capabilities, capacity, experience and the network NDA.
• Suggest the service that fits what you typed. Text typed into the site's request and search fields is sent to an AI model through Vercel's AI Gateway with zero data retention, only to pick a service.
• Send the newsletter and, where allowed, sales and marketing emails. You can unsubscribe from any email.
• Understand how the site and platform are used, fix problems and improve them.
• Keep the service secure, prevent fraud and abuse, and meet legal obligations.

• With other members of the network, as the work requires. When a brand posts a request, matched providers see the details they need to decide whether to bid; the brand’s identity and files are shared under the network NDA. Brands see the profiles and bids of providers who express interest. Some provider information, such as services and general location, appears on the public site.
• With service providers who work for us: Vercel (hosting, analytics and AI Gateway), our database host, Resend (email), Attio (CRM), PostHog and Google (analytics), Google Ads and LinkedIn (advertising), Google Workspace (email and scheduling), Apollo.io (business contact data), and our payment processor and any credit or financing partner for extended payment terms.
• For legal reasons: to comply with law, enforce our agreements, or protect the rights, safety and property of Bloom, our members and others.
• In a business transaction, such as a merger, financing or sale of assets, subject to this policy.
• With your direction or consent.

We don’t sell personal information. Outside the EEA, the UK and Switzerland, we let Google use website visits measured by Google Analytics to show our ads to people who have visited the site, which some state privacy laws call “sharing”. We honor Global Privacy Control signals as an opt-out of the sale or sharing of personal information, and a GPC signal turns this off (section 6).

Our website sets Google Analytics’ own cookies to count visits and see how pages are used. Outside the EEA, the UK and Switzerland, Google may also use those visits to show our ads to people who have visited the site, and when you arrive from one of our Google ads it sets one more cookie to connect the visit to the ad. Neither happens when your browser sends Global Privacy Control. LinkedIn’s Insight Tag does the same for our LinkedIn ads, with the same limits.We don’t use visitor-identification tools. PostHog measures visits without cookies, and the other cookies we set are necessary ones for our own team’s sign-in and content tools.

The booking page embeds Google Calendar, which may set its own cookies; see Google’s privacy policy.

• Cookies and storage: your browser’s settings can block or clear cookies, including Google Analytics’ and Google Ads’, and session storage; the site works without them.
• Global Privacy Control: we treat a GPC signal as a request to opt out of the sale or sharing of your personal information; on our website it also stops Google from using your visit for ads and from setting the Google Ads cookie.
• Ads from Google: you can turn off personalized ads, including ours, in Google’s My Ad Center.
• Email: every newsletter and marketing email has an unsubscribe link.
• Do Not Track: there is no common standard for DNT, so we don’t respond to it; we do honor GPC.

Depending on where you live, you may have the right to know what personal information we hold about you and get a copy, to correct or delete it, to opt out of its sale or sharing and of targeted advertising, to limit the use of sensitive information, and to appeal a decision we make about your request. People in the EU, UK and Switzerland may also object to or restrict processing and withdraw consent at any time.

To make a request, email hello@bloomnetwork.ai with “Privacy request” in the subject, or write to us at the address below. We’ll verify the request, answer within the time the law allows (usually 45 days, or one month in Europe), and won’t treat you differently for using these rights. An authorized agent may make a request for you with your written permission.

Where European law applies, we rely on these legal bases: performing a contract with you or your company, our legitimate interests in running and growing a business-to-business network (including measuring how our website is used), your consent where we ask for it, and legal obligations. You may complain to your local data protection authority.

• Messages, requests and provider applications: as long as the relationship is active, then up to three years.
• Platform, contract, invoice and payment records: as long as the account is active and for at least seven years afterwards, for tax and legal reasons.
• Newsletter subscriptions: until you unsubscribe.
• Session replays: 30 days. Analytics data: up to 26 months.
• Sales and CRM records: up to three years after the last contact, unless you ask us to delete them sooner.

We use reasonable technical and organizational measures to protect personal information, including encryption in transit, access controls and limited staff access. No system is perfectly secure, so please tell us right away if you think your account or information has been compromised.

Bloom is based in the United States, and we process information in the U.S. If you use our services from outside the U.S., your information is transferred to and processed in the U.S., where data protection laws may differ. Where required, we use appropriate safeguards for these transfers, such as standard contractual clauses.

Some pages name people with their permission or from public sources, for example customer stories, team bios, and the Hardtech Capital directory of funders. To correct or remove information about you, email us at the address below and we’ll respond promptly.

Bloom is for businesses and isn’t directed to children. We don’t knowingly collect personal information from anyone under 18.

We’ll update this policy as our services change. The date at the top shows the latest version; if a change is significant, we’ll tell you on the site or by email.

Email hello@bloomnetwork.ai, use the contact form, or write to Bloom Inc., 2050 15th St, Detroit, MI 48216, USA.