Data Processing Addendum
Effective 2026-10-08 · Part of the Terms of Service
1. Roles
For personal information about your customers and contacts that you put into Bloomly or that reaches you through a website we host ("Client Personal Data"):
- you decide why and how it's used; you are the "controller";
- we handle it on your behalf; we are your "processor" or "service provider".
This addendum is meant to meet the requirements for processor contracts under the New Jersey Data Privacy Act and similar state laws.
2. Following your instructions
- We process Client Personal Data only to provide the services described in the Terms, as you direct through your use of Bloomly, or as the law requires. If the law requires otherwise, we'll tell you first unless the law forbids it.
- We don't sell Client Personal Data or use it for targeted advertising.
- We don't combine it with other businesses' data. We don't use it for our own purposes, except to keep the service secure and working.
- If we think an instruction breaks the law, we'll tell you.
3. Our people
Only people who need access to provide or support the service can see Client Personal Data, and they're bound to keep it confidential. Whenever our staff act inside your account, the change is logged.
4. Security
We keep reasonable technical and organizational safeguards in place, appropriate to the risk:
- encryption in transit;
- hashed passwords and sign-in limits;
- separation between businesses;
- protection against forged requests;
- backups;
- access on a need-to-know basis;
- keeping our software and providers up to date.
5. Subprocessors
You authorize us to use the providers listed below. Each is bound by a written contract with protections at least as strong as this addendum for the data it receives, and we remain responsible for them.
We'll give you at least 15 days' notice by email or in your dashboard before adding a provider that handles Client Personal Data. If you object for a reasonable data-protection reason and we can't address it, you may cancel and receive a refund of any prepaid unused time.
| Provider | Purpose | Location |
|---|---|---|
| Render Services, Inc. | Hosting for the Bloomly app and its database | United States |
| Cloudflare, Inc. | Hosting and security for client websites, domain name service | United States and global network |
| Stripe, Inc. | Subscription billing and card payments (card details go to Stripe, never to us) | United States |
| Google LLC | Public business listings (Places) for preparing website previews; Google Maps when you open directions | United States |
| OpenAI, L.L.C.; Google LLC (Gemini); Groq, Inc. | Writing and checking website preview drafts from public business information only | United States |
| Retell AI, Inc. | Answering phone calls for clients who turn on call answering (caller number, call recording and transcript) | United States |
| Geoapify GmbH; U.S. Census Bureau; OpenStreetMap Foundation (Nominatim) | Turning an address into a map location, only when a user asks | Germany and United States |
| OpenFreeMap; Project OSRM | Map images and approximate driving routes (locations rounded to about 100 meters) | European Union |
| National Weather Service (U.S. government) | Weather forecasts for an approximate location | United States |
6. Helping with people's requests
If one of your customers asks us to see, correct or delete their information, we'll pass the request to you. We'll also help you respond, using the export, edit and delete tools in Bloomly or by doing it for you on request.
7. Security incidents
If we learn of a breach affecting Client Personal Data, we'll notify you without undue delay, and within 72 hours where we can. We'll tell you:
- what happened;
- what data was involved;
- what we're doing about it;
- how to reach us.
We'll help you meet any notice duties you have to your customers or regulators.
8. Information and assessments
We'll give you the information you reasonably need to show you're meeting your own obligations. That includes answering security questionnaires and helping with data protection assessments. Once a year, on reasonable notice, you can ask us to show how we meet this addendum.
9. When you leave
When your account ends, you can download your records for 30 days. After that, we delete Client Personal Data within 60 more days, unless the law requires us to keep it. Copies in backups are overwritten on their normal schedule and aren't restored for any other purpose.
10. Order of precedence
If this addendum conflicts with the Terms on how Client Personal Data is handled, this addendum controls. The limits on liability in the Terms apply to this addendum, to the extent the law allows.
Version 2026-10-08. Questions: hello@bloomlystudios.com · 7324849752 · Ben Katzenberg, doing business as Bloomly Studios, 15 East Waverly Drive East Brunswick NJ