Privacy Policy

Bloom — Privacy Policy

1. Plain-English summary

• Bloom is an AI money coach for Indian users. It helps you track spending, set goals, and plan. Bloom is an education product — not a SEBI-registered Investment Adviser, an IRDAI-licensed insurance broker, or a Chartered Accountant.
• We collect only what the product needs: your email to sign you in, the transactions you add or upload, your assessment answers, and (if you allow it) anonymous usage analytics.
• Your data is stored in India (our hosting provider's Mumbai region, ap-south-1). When you use the AI chat or generate an AI Financial Plan, a redacted snapshot is sent to Anthropic in the United States. We ask for separate consent for that.
• You can export your data, delete your account, or revoke any optional consent at any time, in the app.
• Sign-up is blocked for under-18s.
• We sell nothing, recommend no financial products, and take no commissions. We have no partnership or referral arrangement with any adviser, broker, insurer, or tax-filing service.
• Grievance officer: Sahil Baid, grievance@mybloomapp.com.

2. Who is responsible for your data

• Data Fiduciary: Sahil Baid (sole proprietor), India.
• Founder, Data Protection Officer and Grievance Officer: Sahil Baid.
• Privacy queries: dpo@mybloomapp.com
• Grievances: grievance@mybloomapp.com
• Postal address: Indian Institute of Management Bangalore, Bannerghatta Main Road, Bengaluru, Karnataka 560076, India

3. What personal data we collect

4. Personal data we do NOT collect

• We never read your SMS. Bloom does not request the Android SMS permission at all.
• Aadhaar, PAN, or any government ID. We do not ask for them. If a PAN, Aadhaar, card number, IFSC, UPI VPA, email, phone number, or long account number appears in text you type or in a merchant name, it is automatically redacted before storage and before any AI call.
• Your statement PDF password is never saved. If you upload a password-protected statement, the password is used once, in memory, to unlock the file — and is then discarded. It is not written to our database.
• Photos, contacts, calendar, location, microphone, camera.
• Biometrics.
• Data about anyone under 18 — sign-up is blocked by an 18+ attestation.

5. Why we process your data (purpose limitation — DPDPA Sec 4)

1. Sign-in and account integrity — email one-time-passcode, session management, SIM-swap defence.
2. Core product — storing and showing your transactions, goals, subscriptions, plans and chats.
3. AI chat — generating replies. Requires the ai_data_processing consent.
4. AI Financial Plan — generating your plan. Requires the separate ai_financial_plan consent.
5. Coach memory (optional) — remembering facts you choose to share. Requires coach_memory; off by default; revoking stops collection and use immediately; every stored fact is listed and individually deletable in Settings → Coach memory.
6. Cross-border AI processing — sending a redacted snapshot to Anthropic in the US. Requires the separate cross_border_ai_processing consent. See §8.
7. Statement parsing — reading a PDF you upload. Requires statement_upload.
8. Notifications — daily/weekly summaries, if you enable them. Requires push_notifications.
9. Anonymous product analytics — measuring feature usage. Requires analytics. Optional, revocable.
10. Marketing communications — optional, opt-in only, revocable.
11. Pricing research — Bloom is free today. We show a one-off in-app question asking whether Bloom would be worth paying for, and at what price. Answering is entirely optional and changes nothing about your account or what the app does. We store your answer and the price shown so we can decide fairly whether to ever charge, and how much.
12. Legal and regulatory compliance — consent ledger (DPDPA Sec 6(4)) and audit logs.

We do not sell your data. We do not use your data to train AI models. We show no advertising.

6. Your rights under DPDPA

7. Who we share data with

We share data only with the processors below. We do not share with advertisers, data brokers, or marketing exchanges. We have no commercial, referral, or affiliate arrangement with any financial services provider, and we share your data with none of them.

If we ever add a payment processor or a bank-data provider, this table and the consent list will be updated first, and we will ask for consent before any such data leaves the app.

8. Cross-border transfer to the United States (DPDPA Sec 16)

Three features send data to Anthropic in the United States. In each case PII patterns (PAN, Aadhaar, card number, IFSC, UPI VPA, email, phone, long account numbers) are redacted before sending.

• AI chat — your message, recent conversation turns, and a summary of your last 30 days: totals, per-category spend, top merchant names, your goals and progress, detected recurring payments, and your latest tax-regime result. If coach memory is on, your remembered facts are included.
• AI Financial Plan — a coarser, bucketed snapshot: 30-day totals rounded to the nearest ₹5,000, your top categories, your assessment answers, and the tax-regime result. The plan deliberately sends less detail than chat.
• Statement parsing — the uploaded PDF itself is processed by the model to extract transactions. This is how the statement is read. Covered by your statement_upload consent.

Anthropic's retention: prompts may be retained by Anthropic for a limited period for abuse detection (currently up to 30 days under its published policy) and are then deleted. Anthropic does not use this data to train its models under the commercial API terms that govern our use.

Honest limitation: once data is processed in the United States it is subject to US law, and your Indian statutory rights are harder to enforce against a foreign processor. If you do not consent to this transfer, you can still use Bloom's tracking, statement upload, goals and calculators — but the AI chat and AI Financial Plan will be unavailable.

9. How long we keep your data

The full schedule is in our Data Retention Policy (/data-retention). In summary:

• Transactions, goals, chats, coach memory, plans, and uploaded statement PDFs — kept for as long as your account exists. You can delete any of them sooner, at any time, using Start fresh, per-item delete, or account deletion.
• Consent records — kept for the life of the account and retained in anonymised form afterwards, because DPDPA Sec 6(4) requires us to be able to prove consent existed.
• Audit logs — retained for fraud and security purposes, anonymised when you delete your account.
• Anthropic prompt logs — up to 30 days at Anthropic, then deleted.

10. Security

We apply the following safeguards (IT Act Sec 43A "reasonable security practices"):

• Encryption in transit — TLS on every network call.
• Encryption at rest — the database and file storage are encrypted at rest at the infrastructure level. In addition, your chat message content and coach-memory facts are individually encrypted at the application level, with the key held outside the database — so a raw database dump shows unreadable ciphertext for those fields. To be precise: this additional application-level encryption covers chat and coach memory. Other data, such as your transactions, is protected by infrastructure encryption and strict per-user access control rather than a second layer.
• Per-user isolation — every database table enforces row-level security, so one user can never read another user's rows.
• PII redaction — card, PAN, Aadhaar, IFSC, UPI VPA, email, phone and long account numbers are redacted from your text before storage and before any AI call.
• Statement passwords are never stored — used once in memory, then discarded.
• Authentication — email one-time-passcode; no passwords to steal. Signing out revokes sessions on all devices.
• SIM-swap defence — for 24 hours after any new sign-in, the most sensitive operations (data export, account deletion, statement parsing, plan generation) are blocked, and the AI chat withholds your detailed financial data. A hijacked session cannot immediately exfiltrate everything.
• 18+ enforcement — checked at onboarding, again in the database, and again server-side before AI use.
• Security review — Bloom is subjected to internal adversarial security review and automated security regression tests that run on every change. We do not currently hold a third-party security certification or independent audit; we will say so plainly here if that changes.

No system is perfectly secure. If we become aware of a personal-data breach affecting you, we will notify you and the Data Protection Board as required by DPDPA Sec 8(6).

11. Children

Bloom is for adults aged 18 and over. We require an 18+ attestation at sign-up and enforce it server-side. If we learn that an account belongs to someone under 18, we delete it. Report a suspected under-18 account to grievance@mybloomapp.com.

12. Grievances and response times

Email grievance@mybloomapp.com from your account email address.

• We acknowledge grievances within 72 hours.
• We aim to resolve within 30 days, and will not exceed the maximum period allowed under the DPDP Rules.
• If you are not satisfied, you may escalate to the Data Protection Board of India.

13. Cookies and similar technologies

The Bloom Android app does not use cookies. The mybloomapp.com website uses only what is strictly necessary to serve the page. If we later add analytics to the website, we will ask for your consent first and update this section before doing so.

14. Changes to this policy

We update this policy when features change or regulators issue new requirements. Material changes are notified in the app, and by email if you have opted into communications, at least 7 days before they take effect. The "Last updated" date above is authoritative.

15. Regulatory position

• SEBI — Bloom is not a Registered Investment Adviser and gives no personalised investment advice. We never recommend a specific stock, mutual fund, or scheme. Per SEBI Investment Advisers Regulations 18(9) we disclose that Bloom's replies and plans are generated using an AI model (Anthropic's Claude), and Bloom remains accountable for what it outputs.
• RBI — Bloom does not hold funds, issue credit, or operate as a payment system. Bloom is not currently connected to any bank or Account Aggregator; the only way data enters Bloom is you adding it or uploading a statement.
• IRDAI — Bloom does not sell, distribute or recommend insurance, and has no arrangement with any insurer or broker.
• ICAI / Income Tax — Bloom's tax features are educational calculators. Bloom does not file returns and has no arrangement with any tax-filing service.
• PFRDA — Bloom does not open NPS accounts and is not a PFRDA intermediary.
• ASCI — our marketing states only what the product actually does.

16. Keeping this page true

This policy describes the product as it actually is today, not as planned. Several capabilities are deliberately not described here because they are not available to users: connecting a bank account, real-time spending alerts, and paid subscriptions. If any of those ship, this page, the Data Retention Policy, the consent list and the Play Store data-safety declaration must all be updated before the feature is switched on for users.

This is a description of Bloom's actual data practices. It is not legal advice. For a specific concern about your data, email the grievance officer.