This Privacy Policy describes how Bloom AI Pty Ltd ACN 671 399 107 ("we", "our" or "us") collects, uses, and shares your personal information when you use our website at bloom.study and the services provided through our website, applications and services (collectively, the "Services"). We comply with applicable privacy and data protection laws, including the Australian Privacy Act 1988 (Cth), the EU General Data Protection Regulation ("GDPR"), the UK GDPR, and other applicable laws in the jurisdictions where we operate.
Table of Contents
1. What personal data we collect
We collect the categories of data listed below. Providing certain information is necessary to create your account and use the Services. We do not intentionally collect special-category data (e.g., health, religion, ethnicity).
Information you provide
- Account information: Name, email address, role (student/teacher), and password when you create an account.
- Organisation information: School or institution name (for Space Owners).
- Payment information: Card details and billing address (processed via Stripe; we do not store full card numbers).
- User content: Conversations, prompts, file uploads, and feedback you provide to the Services.
- Communication: Messages you send to our support team.
Information collected automatically
- IP address and approximate location
- Device and browser type
- Pages visited and features used
- Date and time of access
- Session recordings of clicks, scrolls, and navigation (sensitive text inputs are masked; you can opt out via profile settings)
2. How we use your information
We use your personal information to:
- Provide and operate the Services;
- Process payments and manage subscriptions;
- Communicate with you about your account and the Services;
- Provide customer support;
- Improve and develop the Services (see Section 3);
- Prevent fraud and maintain security;
- Send marketing communications (with your consent; you can opt out anytime);
- Comply with legal obligations.
Aggregated and irreversibly anonymised data
We may aggregate or irreversibly anonymise personal information so that it no longer relates to an identified or reasonably identifiable individual. We use such data for analytics, research, benchmarking, and product improvement, and we do not attempt to re-identify it.
3. AI Training and Improvement
This section explains how we use data to improve our AI and your controls over that use.
The Improvement Data Toggle
Space Owners control whether Teaching Space data may be used for AI training and improvement through the Improvement Data Toggle in their Space settings.
- Free Tier: Toggle is ON by default. Space Owners may turn it OFF at any time in their settings.
- Paid Tiers: Toggle is OFF by default. Space Owners may opt in if they wish to contribute to improvement.
What "training and improvement" includes
When the Toggle is ON, we may use conversation data to:
- Fine-tuning: Training our AI models on conversation data to improve responses;
- Evaluation: Testing model performance against real examples;
- Quality review: Our team may review conversations to evaluate model quality and refine training approaches.
The activities above are gated by the Improvement Data Toggle. Other types of internal access to your content (for technical support, safety investigations, legal process, and security incident response) are not gated by the Toggle and are described in Section 6.
When changes take effect
- Changes to the Toggle apply prospectively (going forward).
- Data collected while the Toggle was ON may continue to be used for improvement.
- Data collected after the Toggle is turned OFF will not be used for training.
- We cannot "untrain" models on data already processed, but we stop using new data from that point.
Under-13 Teaching Spaces
Where a Space Owner has configured a Teaching Space to indicate it may include students under 13, or where COPPA or other applicable law requires, Bloom will not use Chat Logs from that Teaching Space to train, fine-tune, or build AI or machine learning models for general, commercial, or non-educational purposes, regardless of the Improvement Data Toggle. The Toggle is forced OFF for such Teaching Spaces and cannot be turned ON while the under-13 attestation is in effect.
Chat Logs from such Teaching Spaces may still be processed to provide the Services, to respond to safety concerns, legal process, and security incidents, to perform quality review and evaluation of AI responses, and to contribute to irreversibly anonymised aggregated usage metrics.
Aggregated data
Regardless of the Toggle setting, we may use irreversibly anonymised and aggregated usage metrics for analytics and product improvement. Such data cannot be used to identify you or any individual, and we do not attempt to re-identify it.
4. Children's data
Bloom is designed for educational use by students of various ages. We take children's privacy seriously and comply with applicable laws including COPPA (US), the Children's Code (UK), and the Privacy Act (Australia).
Our age rules
- No self-signup under 13: Users under 13 years of age may not create an Account themselves.
- Under 13 invite-only: Users under 13 may only access Bloom via an Invite from a Space Owner (such as a school or teacher) who has obtained appropriate parental or guardian consent.
- Under 13 no Guest Chat: Users under 13 are prohibited from using Guest Chat.
- Ages 13-17: May create an Account or use Guest Chat with consent from parent, guardian, or school where required.
How we obtain consent for children
When children under the applicable age of digital consent access Bloom through an educational institution, we rely on the institution to obtain and provide appropriate consent on behalf of parents or guardians, in accordance with applicable laws (such as the school official exception under COPPA).
Space Owners warrant that they have obtained all necessary consents before inviting users under 13 to their Teaching Space.
What parents and guardians should know
If your child uses Bloom through their school, please be aware that:
- The school can see your child's conversations. Your child's teacher, school administrators, and the Space Owner may read, download, export, or delete your child's Chat Logs within the school's Teaching Space for educational, pastoral, safeguarding, academic-integrity, and administrative purposes.
- Bloom staff access is limited. Authorised Bloom personnel may access your child's content only for the purposes described in Section 6 (support, safety investigations, legal process, security, quality review, and training where permitted by the Improvement Data Toggle).
- Training on children's data. Where a Space Owner has configured a Teaching Space to indicate it may include students under 13, Bloom will not use Chat Logs from that Teaching Space to train, fine-tune, or build AI or machine learning models for general, commercial, or non-educational purposes, regardless of the Improvement Data Toggle setting. Such Chat Logs may still be processed to provide the Services, respond to safety or legal concerns, perform quality review of AI responses, and contribute to irreversibly anonymised aggregated usage metrics.
- You can request access or deletion. Contact privacy@bloom.study to request a copy of your child's data or to request deletion, subject to identity verification.
5. Cookies & similar technologies
We use cookies and similar technologies for essential functionality, analytics, and marketing. Our cookie banner allows you to accept, reject, or customise non-essential cookies.
We also use session recording tools (classified as analytics) to replay anonymised user interactions such as clicks, scrolls, and navigation. Sensitive text inputs (e.g., chat messages, essays) are masked in recordings. Session recording and other non-essential analytics are active only where you have provided any consent required by applicable law through our cookie banner or privacy controls. Refusing consent does not prevent access to the core Service. You can withdraw consent at any time via the Analytics toggle in your profile settings, the "Cookie Settings" link in our footer, or by contacting privacy@bloom.study.
Children and school-managed accounts.High-privacy defaults apply: non-essential analytics and session replay are disabled for users accessing Bloom through a Teaching Space the Space Owner has configured as potentially including users under 13, unless enabled in a manner permitted by applicable law and the Institution's configuration.
You can change or withdraw consent at any time via the "Cookie Settings" link in our footer. Withdrawal is as easy as giving consent.
6. How we share information
We may share your personal information with:
- Service providers: Hosting (Google Cloud), payment processing (Stripe), analytics, and customer support vendors. These parties process data only on our instructions.
- AI providers: We transmit prompts and AI responses to third-party AI providers (Microsoft Azure OpenAI Service, OpenAI, and Google Vertex AI) solely to generate Outputs. Providers do not use your content to train their models. Providers may retain transmitted content for a limited period for abuse-monitoring and safety purposes in accordance with their published policies, accessible only to authorised provider personnel; content is not shared with other customers. Where Bloom has configured enhanced privacy options with a provider (such as zero-retention or no-abuse-monitoring endpoints), different retention applies. See each provider's published policies for details: OpenAI, Azure OpenAI, Google Vertex AI.
- Space Owners: If you are an End User, your Space Owner and its authorised administrators may access, use, download, export, disclose, share, restrict, and remove your content (including Chat Logs) generated within their Teaching Space, for educational, pastoral, safeguarding, academic-integrity, and administrative purposes.
- Business transfers: In connection with a merger, acquisition, or sale of assets.
- Legal requirements: When required by law or to protect our rights, safety, or property.
Bloom internal access
Authorised Bloom personnel may access your content only for the following purposes:
- Technical support: diagnosing issues reported by you or on your behalf;
- Safety: investigating safety concerns, suspected breaches of our Terms, or suspected unlawful conduct;
- Legal process: responding to valid subpoenas, court orders, and lawful regulatory requests;
- Security: detecting, investigating, and responding to security incidents;
- Quality review: reviewing AI responses for safety, accuracy, and product reliability; and
- Training (Toggle-gated): where the Improvement Data Toggle is ON for the relevant Teaching Space, training and evaluating our AI models (see Section 3).
Access is restricted to authorised personnel, subject to role-based access controls, internal confidentiality obligations, and audit logging. Exports of Chat Logs for operational purposes are recorded with actor identity, scope, and timestamp. Bloom personnel do not browse, read, or monitor Chat Logs outside the purposes listed above.
7. Your rights
Depending on your location, you may have the right to:
- Access your personal data;
- Correct inaccurate data;
- Delete your data;
- Export your data (portability);
- Restrict or object to certain processing;
- Withdraw consent (where we rely on consent);
- Lodge a complaint with your local data protection authority.
To exercise these rights, contact us at privacy@bloom.study.
End Users in Institution Teaching Spaces should direct access, correction, and deletion requests relating to Chat Logs generated in that Teaching Space to the Institution in the first instance, as the Institution is the data controller. If you contact Bloom directly, we will acknowledge your request and, subject to identity verification, liaise with the Institution to action it in accordance with our Data Processing Agreement.
End Users in self-serve Teaching Spaces, account data, and Guest Chat users may request access, correction, or deletion directly from Bloom by contacting privacy@bloom.study, subject to identity verification.
8. Data retention
We retain your data only as long as needed for the purposes described in this policy. Here's how long we typically keep different types of data:
| Data type | Retention period |
|---|---|
| Account and conversation data | While account is active. After closure: 30 days in active systems, then deleted. Backups retained up to 90 days. |
| End User data when a Space Owner's Subscription ends | End User Chat Logs within a Teaching Space remain under the Space Owner's custody for 30 days after their Subscription ends to allow export or reactivation, then follow the deletion timeline above. End Users may request their own data at any time via privacy@bloom.study. |
| Payment records | 7 years (for tax and audit compliance) |
| Server and application logs | 30 days, then aggregated/deleted |
| Security and fraud logs | Up to 24 months |
| Support tickets | 3 years after last contact |
| Irreversibly anonymised analytics | Indefinite (cannot identify individuals; we do not attempt re-identification) |
You can request deletion of your data sooner by contacting us. We may retain some data as required by law.
9. Data security
We implement appropriate technical and organisational measures to protect your data, including:
- Encryption in transit (TLS) and at rest;
- Access controls and authentication;
- Regular security assessments;
- Employee training on data protection.
However, no system is completely secure. Please use strong passwords and notify us immediately if you suspect unauthorised access to your account.
10. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of material changes by updating the date at the top and, for significant changes, by email or in-app notification.
11. Contact us
If you have questions about this Privacy Policy or want to exercise your rights, contact us at:
Bloom AI Pty Ltd ACN 671 399 107
Email: privacy@bloom.study
Address: 56 Dennis St, Lakemba NSW 2195, Australia
12. Supplementary information for EU/UK users
Controller
Bloom AI Pty Ltd ACN 671 399 107 is the controller of your personal data for direct users. When Bloom is contracted by an educational institution, the Institution acts as the controller of Chat Logs and other Teaching Space content, and Bloom acts as processor under Article 28 GDPR and our Data Processing Agreement.
For account administration, billing, service security, fraud prevention, legal compliance, and limited business analytics, Bloom acts as an independent controller regardless of whether another party is a controller of other processing.
Representatives in EU and UK
We've appointed DataRep as our local representative. You can contact DataRep at:
- EU: DataRep, The Cube, Monahan Road, Cork, T12 H1XY, Republic of Ireland
- UK: DataRep, 107-111 Fleet Street, London, EC4A 2AB, United Kingdom
Legal bases for processing
We process your data on the following legal bases:
- Contract: To provide the Services (account creation, tutoring);
- Legitimate interest: Fraud prevention, security, and essential product analytics (where not overridden by your rights);
- Consent: Marketing communications, non-essential cookies, session replay, and non-essential analytics;
- Legal obligation: Tax records, law enforcement requests.
International transfers
We host data primarily on Google Cloud in Australia. When personal data of EEA/UK residents is transferred outside the EEA/UK, we rely on:
- Standard Contractual Clauses (2021) approved by the European Commission;
- UK International Data Transfer Addendum;
- Encryption in transit and at rest;
- Access controls and audit logging.
Automated decision-making
We do not use your personal data to make automated decisions that have legal or similarly significant effects on you. While Bloom uses AI to support learning, this is not "automated decision-making" under GDPR.
Complaints
You have the right to lodge a complaint with your local data protection authority. In the EU, you may contact the Irish Data Protection Commission (DPC), 21 Fitzwilliam Square South, Dublin 2, Ireland. In the UK, contact the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, SK9 5AF.