Legal

Privacy Policy

Last updated: 10 May 2026

1. Who we are

BloomVest Ltd (“BloomVest”, “we”, “us”, “our”) is a company registered in England and Wales. We operate the digital gifting platform at bloomvest.co.uk.

We are the data controller for personal information collected through our platform. If you have any questions about this policy or how we handle your data, contact us at: hello@bloomvest.co.uk

2. What data we collect

If you send a gift (sender)

  • Name and email address (used to create your account)
  • Payment information - processed directly by Stripe. BloomVest does not store your card details
  • The occasion, personal message, and gift amount you choose
  • IP address and basic device/browser information for fraud prevention

If you receive a gift (recipient)

  • Email address (entered by you when claiming your gift)
  • Bank account details - entered directly into Stripe Connect. BloomVest does not see or store your bank details
  • Identity verification data collected by Stripe during onboarding

All visitors

  • Anonymous analytics data (pages visited, device type, approximate location)
  • Cookie data - see Section 8 below

3. How we use your data

We use your personal data to:

  • Provide the BloomVest service - creating, sending, and delivering gifts
  • Send transactional emails: gift notifications, redemption confirmations, expiry reminders, and refund notifications
  • Verify your identity and prevent fraud
  • Process refunds for expired or cancelled gifts
  • Improve our platform and fix technical issues
  • Comply with our legal and regulatory obligations

We will only contact you with marketing communications if you have given explicit consent. You can opt out at any time.

4. Legal basis for processing

Under UK GDPR, we process your personal data on the following lawful bases:

  • Contract performance - processing necessary to deliver the gifting service you have requested
  • Legitimate interests - fraud prevention, platform security, and improving our service
  • Legal obligation - complying with applicable laws and regulations
  • Consent - for marketing communications (where applicable)

5. Who we share your data with

We share data with the following third parties only to the extent necessary to operate our service:

  • Stripe Inc. - Payment processing and recipient bank account verification. Stripe is authorised and regulated by the FCA (Firm Reference Number 900461). Stripe’s Privacy Policy governs how they handle payment and identity data.
  • Brevo (Sendinblue) - Transactional email delivery. We share your name and email address to send gift notifications and service emails.
  • Supabase - Secure database hosting in the EU West (London) region. Your data remains within the UK/EEA.

We do not sell your personal data to third parties. We do not share your data with advertisers.

6. Data retention

  • Gift records are retained for 7 years for tax and accounting purposes, then securely deleted
  • Your account data is retained for as long as your account is active. You may request deletion at any time
  • Unredeemed gifts expire after 365 days and are automatically refunded - recipient data associated with unclaimed gifts is deleted after refund processing
  • OTP verification codes expire after 10 minutes and are deleted after use

7. Your rights

Under UK GDPR, you have the right to:

  • Access - request a copy of the personal data we hold about you
  • Rectification - ask us to correct inaccurate or incomplete data
  • Erasure - request deletion of your personal data (subject to legal retention obligations)
  • Portability - receive your data in a structured, machine-readable format
  • Restriction - ask us to restrict processing of your data in certain circumstances
  • Objection - object to processing based on legitimate interests
  • Withdraw consent - where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, email us at hello@bloomvest.co.uk. We will respond within 30 days.

If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

8. Cookies

We use a small number of essential cookies to operate the platform:

  • Authentication cookies - set by Supabase to keep you signed in. These are session cookies deleted when you close your browser, or persistent cookies lasting up to 7 days if you choose “Remember me”
  • Security cookies - used by Stripe to prevent fraud during payment

We do not use advertising, tracking, or third-party analytics cookies. We do not use cookies to build profiles of your browsing behaviour across other websites.

9. Data security

We take reasonable technical and organisational measures to protect your personal data, including:

  • All data transmitted over HTTPS (TLS encryption)
  • Database access restricted by row-level security policies
  • Payment data handled entirely by Stripe - we have no access to raw card numbers or bank details
  • OTP verification for recipient gift claims

No method of transmission over the internet is 100% secure. If you believe your data has been compromised, contact us immediately at hello@bloomvest.co.uk.

10. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by email or by a prominent notice on our website. The “Last updated” date at the top of this page reflects when the policy was last revised.

Continued use of BloomVest after changes are posted constitutes your acceptance of the revised policy.

11. Contact

For any privacy-related queries, to exercise your rights, or to make a complaint:

BloomVest Ltd
Email: hello@bloomvest.co.uk
Website: bloomvest.co.uk

Terms of service →← Back to home