Privacy Policy

1. Introduction

Welcome to BloomKini. We believe your privacy matters, and we're committed to being transparent about how we handle your personal information.

BloomKini is operated by a Swedish company and provides book summary services through our website (bloomkini.com) and mobile applications. This Privacy Policy explains what information we collect, why we collect it, how we use it, and what rights you have regarding your data.

This policy applies to all users worldwide, with specific provisions for individuals in the European Union (GDPR), California and other US states (CCPA/CPRA), Australia (Privacy Act 1988), and other jurisdictions.

By using BloomKini, you agree to the collection and use of information as described in this policy. If you don't agree with any part of this policy, please don't use our services.

2. Information We Collect

2.1 Information You Provide Directly

When you create an account or use our services, you voluntarily provide us with certain information:

2.2 Information Collected Automatically

When you use BloomKini, we automatically collect certain technical information:

2.3 Information From Third Parties

We receive limited information from third-party services you choose to connect:

• Google OAuth: If you sign in with Google, we receive your name, email address, and profile picture from Google
• Stripe/PayPal: Payment confirmation data and transaction IDs (but never your full payment card details)
• Analytics Providers: Aggregated usage statistics from Google Analytics and Hotjar

3. How We Use Your Information

We use the information we collect for specific purposes, always with a proper legal basis. Here's what we do with your data and why we're allowed to do it:

4. How We Share Your Information

We don't sell your personal information to anyone. We only share your data with trusted service providers who help us operate BloomKini, and only to the extent necessary.

Service Providers We Work With

Other Sharing Scenarios

We may also share your information in these limited circumstances:

• Legal Requirements: When required by law, court order, or government regulation
• Safety & Fraud Prevention: To protect our users, investigate potential violations, or prevent harm
• Business Transfers: If BloomKini is acquired or merged, your data would transfer to the new owner (you'd be notified)
• With Your Consent: Any other sharing would only happen with your explicit permission

5. International Data Transfers

BloomKini operates globally, and here's how we handle your data across borders:

Transfers Outside the EU

Some of our service providers (like Google Analytics and Hotjar) may process data in countries outside the EU, including the United States. When this happens, we ensure appropriate safeguards are in place:

• ✓
  Standard Contractual Clauses: We use EU-approved Standard Contractual Clauses (SCCs) with service providers, which are legal agreements that require them to protect your data according to EU standards.
• ✓
  Adequacy Decisions: Where available, we rely on the European Commission's adequacy decisions that recognize certain countries as providing adequate data protection.
• ✓
  Additional Safeguards: We conduct vendor assessments and implement technical measures like encryption to protect data in transit and at rest.

For Users Worldwide

Regardless of where you're located, we apply the same high standards of data protection. Users in Australia, the United States, and other countries outside the EU benefit from these same safeguards when their data is transferred internationally.

6. Data Retention and Deletion

We only keep your personal information for as long as necessary to provide our services and comply with legal obligations. Here's our retention approach:

When You Delete Your Account

When you request account deletion, here's what happens:

1. 1.
   Immediate deactivation: Your account is immediately deactivated, and you can no longer access BloomKini
2. 2.
   30-day grace period: Your data is retained for 30 days in case you change your mind and want to recover your account
3. 3.
   Permanent deletion: After 30 days, we permanently delete your account information, reading history, and preferences
4. 4.
   Legal exceptions: We may retain certain data (like payment records) for longer periods when required by law

7. Your Privacy Rights

You have significant control over your personal information. The specific rights available to you depend on where you live, but we offer strong privacy protections to all users.

7.1 Rights for EU Users (GDPR)

If you're in the European Union, you have these rights:

• Right to Access: Request a copy of all personal data we hold about you
• Right to Rectification: Correct any inaccurate or incomplete information
• Right to Erasure ('Right to be Forgotten'): Request deletion of your personal data
• Right to Restrict Processing: Limit how we use your data in certain circumstances
• Right to Data Portability: Receive your data in a structured, commonly used format to transfer to another service
• Right to Object: Object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent: Withdraw consent for processing at any time (where consent is the legal basis)
• Right to Lodge a Complaint: File a complaint with your local data protection authority if you believe we've violated your rights

7.2 Rights for California Users (CCPA/CPRA)

If you're a California resident, you have these rights:

• Right to Know: Request information about the categories and specific pieces of personal information we've collected
• Right to Delete: Request deletion of your personal information (with certain exceptions)
• Right to Opt-Out of Sale: We don't sell personal information, but you have the right to opt out if we ever did
• Right to Non-Discrimination: We won't discriminate against you for exercising your privacy rights
• Right to Correct: Request correction of inaccurate personal information
• Right to Limit Use of Sensitive Personal Information: We don't collect sensitive personal information as defined by CPRA

7.3 Rights for Australian Users

If you're in Australia, you have these rights under the Privacy Act 1988:

• Right to Access: Request access to your personal information
• Right to Correction: Request correction of inaccurate, incomplete, or outdated information
• Right to Complain: Lodge a complaint with the Office of the Australian Information Commissioner (OAIC)
• Right to Know: Understand why we collect your information and how we use it

7.4 Rights for All Other Users

Regardless of where you're located, we extend similar privacy rights to all BloomKini users:

• Access and review your personal information
• Update or correct your account details
• Delete your account and associated data
• Opt out of marketing communications
• Export your reading history and preferences

How to Exercise Your Rights

To exercise any of these rights, you can:

• ✓
  Email us: Send a request to privacy@bloomkini.com
• ✓
  Use your account settings: Many actions (like updating info or deleting your account) can be done directly in your BloomKini account
• ✓
  Contact support: Reach out through our in-app support feature

We'll respond to your request within 30 days (or as required by applicable law). We may need to verify your identity before processing certain requests to protect your privacy.

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on BloomKini. Here's what you need to know:

What Are Cookies?

Cookies are small text files stored on your device when you visit our website or use our app. They help us remember your preferences and understand how you use our service.

Types of Cookies We Use

Third-Party Tracking

We use these third-party services that may place cookies on your device:

• Google Analytics: Tracks how visitors interact with our website (anonymized IP addresses)
• Hotjar: Records heatmaps and user session recordings to understand user behavior (personally identifiable information is masked)
• Google OAuth: Enables sign-in with your Google account
• Stripe/PayPal: Facilitates secure payment processing

Managing Your Cookie Preferences

You have several options to control cookies:

• ✓
  Cookie Banner: When you first visit BloomKini, you can accept or reject non-essential cookies
• ✓
  Account Settings: Adjust cookie preferences in your BloomKini account settings
• ✓
  Browser Settings: Most browsers let you block or delete cookies. Check your browser's help section for instructions
• ✓
  Do Not Track: We respect browser Do Not Track signals for analytics cookies

9. Security Measures

We take the security of your personal information seriously and implement industry-standard measures to protect it:

Technical Security Measures

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS/SSL (Transport Layer Security)
• Encryption at Rest: Your data stored on our servers is encrypted using AES-256 encryption
• Password Protection: Passwords are hashed using bcrypt with salt, making them unreadable even to our team
• Secure Payment Processing: We use PCI-DSS compliant payment processors (Stripe, PayPal) and never store full credit card details
• Regular Security Audits: Our systems undergo regular security assessments and vulnerability testing
• Firewall Protection: Our infrastructure is protected by enterprise-grade firewalls

Organizational Security Measures

• Access Controls: Only authorized personnel have access to personal data, on a need-to-know basis
• Employee Training: Our team receives regular privacy and security training
• Data Processing Agreements: All third-party service providers sign agreements committing to data protection standards
• Incident Response Plan: We have procedures in place to detect, respond to, and notify you of security breaches
• Regular Backups: Your data is backed up regularly to prevent loss, with backups stored securely and encrypted

What You Can Do to Stay Secure

Security is a shared responsibility. Here's how you can protect your account:

• Use a strong, unique password for your BloomKini account
• Enable two-factor authentication if available
• Never share your password with anyone
• Log out when using shared or public devices
• Keep your email account secure (it's used for password recovery)
• Report any suspicious activity to security@bloomkini.com

Limitation of Liability: While we implement robust security measures, no system is completely secure. We cannot guarantee absolute security, but we commit to using industry-best practices to protect your data.

10. Children’s Privacy and Parental Controls

BloomKini offers content suitable for all ages, including children's book summaries and activities. We take children's privacy very seriously and comply with COPPA (Children's Online Privacy Protection Act), GDPR, and other international children's privacy laws.

Account Requirements by Age

• Ages 13-17: May create accounts with verifiable parental or guardian consent
• Ages 18+: May create accounts independently
• Under 13: Cannot create their own accounts, but parents/guardians may create a family account and supervise usage

Parental Consent for Children (Under 18)

If you're under 18 and want to use BloomKini, we require verifiable parental consent before collecting any personal information. Here's how it works:

1. 1.
   During signup, you'll be asked to provide a parent or guardian's email address
2. 2.
   We'll send your parent/guardian a consent request explaining what information we collect and how we use it
3. 3.
   Your parent/guardian must provide consent before your account becomes active
4. 4.
   Parents can revoke consent at any time, which will delete the child's account

Information We Collect from Children

For users under 18, we only collect the minimum information necessary to provide our services:

What we DO NOT collect from children:

• Full name (usernames only)
• Photographs or videos
• Precise geolocation data
• Social security numbers or government IDs
• Phone numbers
• Any information beyond what's necessary for the service

Parental Rights and Controls

Parents and guardians have full control over their children's accounts and can:

• ✓
  Review Information: Request to see all personal information we've collected from your child
• ✓
  Refuse Further Collection: Tell us to stop collecting information from your child
• ✓
  Delete Account: Request deletion of your child's account and all associated data
• ✓
  Modify Settings: Adjust privacy settings and content preferences for your child's account
• ✓
  Monitor Activity: View your child's reading history and activity

To exercise these rights, email us at parents@bloomkini.com with proof of parental relationship.

Children’s Data Sharing and Protection

• We never sell children's personal information
• We never share children's data with third parties for marketing purposes
• We only share children's data with service providers essential for operating BloomKini (hosting, payment processing) under strict confidentiality agreements
• Children's accounts have additional security protections and cannot be made public
• We apply the same data retention policies to children's accounts (see Section 6)

If We Discover Unauthorized Child Account

If we discover that a child under 13 has created an account without parental consent, we will:

1. 1.
   Immediately suspend the account
2. 2.
   Contact the parent/guardian (if contact information is available)
3. 3.
   Request verifiable parental consent within 14 days
4. 4.
   Delete the account and all data if consent is not received

Contact Us About Children’s Privacy

For any questions or concerns about how we handle children's information:

• Parents/Guardians: parents@bloomkini.com
• Privacy Questions: privacy@bloomkini.com

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

How We Handle Updates

• ✓
  Notification: For material changes that significantly affect your rights, we'll notify you via email and/or a prominent notice on our website at least 30 days before the changes take effect
• ✓
  Effective Date: The "Last Updated" date at the top of this policy will always reflect when changes were made
• ✓
  Your Choice: If you don't agree with the updated policy, you can delete your account before the changes take effect
• ✓
  Continued Use: By continuing to use BloomKini after changes take effect, you accept the updated Privacy Policy

Types of Changes We Might Make

Updates may include:

• Adding new features or services that require different data processing
• Complying with new privacy laws or regulations
• Clarifying existing practices for better transparency
• Changing third-party service providers
• Improving security measures

Reviewing Previous Versions

You can request previous versions of this Privacy Policy by contacting us at privacy@bloomkini.com. We maintain archives of all policy versions.

12. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, we're here to help.

Response Time

We aim to respond to all privacy inquiries within:

• General questions: 5 business days
• Data access requests: 30 days (as required by GDPR)
• Security incidents: Within 24 hours

Regulatory Authorities

You have the right to lodge a complaint with a data protection authority. Here are the relevant authorities for different regions:

• EU/EEA: Your local Data Protection Authority or the Swedish Authority for Privacy Protection (IMY) - www.imy.se
• United Kingdom: Information Commissioner's Office (ICO) - www.ico.org.uk
• Australia: Office of the Australian Information Commissioner (OAIC) - www.oaic.gov.au
• California: California Privacy Protection Agency - www.cppa.ca.gov

Company Information

Thank You for Reading

We appreciate you taking the time to understand how we protect your privacy. Your trust is important to us, and we're committed to being transparent about our data practices.

If anything in this policy is unclear or if you have suggestions for how we can improve our privacy practices, please don't hesitate to reach out to us at privacy@bloomkini.com.

Happy reading!
The BloomKini Team