GDPR Compliance

Additional information for EU residents about how we process personal data in compliance with the General Data Protection Regulation.

Last updated: April 12, 2026

1. Introduction

This GDPR Compliance page provides additional information for residents of the European Economic Area (EEA) about how Bloo, Inc. (“Blue”, “we”, “us”, or “our”) processes personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

This page supplements our main Privacy Policy and should be read together with it. In case of any conflict, the GDPR-specific provisions in this document prevail for EEA residents.

2. Data Controller Information

Bloo, Inc. 2035 Sunset Lake Road Newark, Delaware 19702 United States Email: [email protected]

We are a data controller for the personal data we process about you. In certain circumstances, we may also act as a data processor on behalf of our business customers.

3. Data Protection Officer

Our Data Protection Officer can be contacted at:

Emanuele Faja, CEO Email: [email protected] Subject Line: GDPR Request

We process your personal data under the following legal bases set forth in Article 6 of the GDPR:

4.1 Performance of a Contract (Article 6(1)(b))

  • Creating and managing your account
  • Providing our process management services
  • Processing payments and billing
  • Providing customer support

4.2 Legitimate Interests (Article 6(1)(f))

Our legitimate interests include:

  • Improving and developing our Service
  • Ensuring security and preventing fraud
  • Analyzing usage patterns and trends
  • Sending service-related communications
  • Scanning and reviewing Content for Terms of Service and Acceptable Use Policy compliance, abuse detection, and platform safety

We have conducted legitimate interest assessments to ensure your interests and fundamental rights do not override these interests.

4.3 Legal Obligation (Article 6(1)©)

  • Complying with tax and accounting requirements
  • Responding to lawful requests from authorities
  • Maintaining records as required by law

4.4 Consent (Article 6(1)(a))

  • Sending marketing communications
  • Processing optional data you choose to provide

You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

5. Data Subject Rights

Under the GDPR, you have the following rights:

5.1 Right of Access (Article 15)

You can request a copy of your personal data and information about how we process it.

5.2 Right to Rectification (Article 16)

You can request correction of inaccurate or incomplete personal data.

5.3 Right to Erasure (Article 17)

You can request deletion of your personal data when:

  • It’s no longer necessary for the original purpose
  • You withdraw consent (where consent is the legal basis)
  • You object to processing based on legitimate interests
  • The data has been unlawfully processed

5.4 Right to Restriction (Article 18)

You can request we limit processing while we:

  • Verify accuracy of data you’ve contested
  • Determine if our legitimate interests override yours
  • Establish, exercise, or defend legal claims

5.5 Right to Data Portability (Article 20)

You can receive your personal data in a structured, commonly used, machine-readable format when processing is based on consent or contract and is automated.

5.6 Right to Object (Article 21)

You can object to processing based on legitimate interests or for direct marketing purposes. For marketing, we will stop immediately. For other purposes, we will stop unless we demonstrate compelling legitimate grounds.

5.7 Rights Related to Automated Decision-Making (Article 22)

We use artificial intelligence systems to flag potential violations of our Terms of Service and Acceptable Use Policy for human review. All enforcement decisions, including account suspension or termination, are made by humans. We do not make decisions based solely on automated processing that produce legal or similarly significant effects concerning you.

6. International Data Transfers

All customer data is stored and processed within the European Union. Our infrastructure is hosted in Germany (Hetzner, Falkenstein and Frankfurt) with database services in the EU (AWS eu-central-1, Frankfurt).

Data may be transferred outside the EEA to:

  • United States (our headquarters, for operational and support purposes only — no customer data is stored in the US)

For information about what data is transferred and stored, see Section 3 of our Privacy Policy and the subprocessor list in our Data Processing Agreement.

We ensure appropriate safeguards through:

  • EU Data Residency: All customer data, files, and databases are stored within the EU
  • Standard Contractual Clauses (SCCs): We use the European Commission’s standard contractual clauses for any limited transfers to countries without an adequacy decision
  • Technical Measures: All data is encrypted in transit and at rest
  • Organizational Measures: Access controls and data protection training

7. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

  • Notify the relevant supervisory authority within 72 hours of becoming aware
  • Notify affected individuals without undue delay if the breach is likely to result in high risk
  • Document all breaches and actions taken

8. Data Protection by Design and Default

We implement data protection principles from the outset:

  • Data Minimization: We only collect data necessary for specified purposes
  • Purpose Limitation: We only use data for stated, legitimate purposes
  • Storage Limitation: We follow the retention periods in Section 8 of our Privacy Policy
  • Security: We implement appropriate technical and organizational measures

9. Supervisory Authority

You have the right to lodge a complaint with your local data protection supervisory authority if you believe we have not adequately addressed your concerns.

For a list of supervisory authorities, visit: https://edpb.europa.eu/about-edpb/board/members_en

10. Specific Processing Activities

10.1 Marketing Communications

  • Legal Basis: Consent or legitimate interest (existing customers)
  • Right to Object: You can opt out anytime via unsubscribe links or account settings
  • Data Sources: Information you provide and Service usage data

10.2 Analytics and Improvements

  • Legal Basis: Legitimate interest in improving our Service
  • Data Types: Usage patterns, feature adoption, performance metrics
  • Retention: See Section 8 of our Privacy Policy

10.3 Customer Support

  • Legal Basis: Contract performance and legitimate interest
  • Data Types: Communications, account information, issue details
  • Retention: 3 years for quality and training purposes

10.4 Content Scanning and Compliance Review

  • Legal Basis: Legitimate interest in enforcing our Terms of Service and Acceptable Use Policy, and protecting the integrity and safety of the Service
  • Data Types: File metadata (names, sizes, types, upload dates), file contents, usage patterns, account activity metrics
  • Processing: Content may be processed by third-party AI service providers (OpenAI, Anthropic) using EU-based endpoints. AI systems flag potential violations for human review. All enforcement decisions are made by humans
  • Retention: Scanning logs and flagged content records are retained for the duration of the account plus 12 months following termination, or as required by law
  • Right to Object: You may object to this processing under Article 21. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests

11. Cookies and Tracking

For detailed information about cookies, see Section 4 of our Privacy Policy.

We use only strictly necessary cookies for authentication and session management. No consent is required for these cookies under GDPR.

12. Children’s Data

We do not knowingly process personal data of individuals under 18. If we become aware of such processing, we will promptly delete the data.

13. Changes to This Notice

We may update this GDPR notice to reflect changes in our practices or legal requirements. Changes to this notice are governed by Section 19 of our Terms of Service.

14. Contact Us

For any GDPR-related questions or to exercise your rights:

Email: [email protected]Subject Line: GDPR Request

We will respond to your request within one month, extendable by two months for complex requests. We will inform you of any extension and the reasons.

There is no fee for exercising your rights unless requests are manifestly unfounded, repetitive, or excessive, in which case we may charge a reasonable fee or refuse to act.