Privacy Policy

1. Introduction

BloomPin (“Company,” “we,” “us,” or “our”), operated by BloomPin Limited, a company incorporated on 3 February 2026 with registered office in London, City of London (company number 17010691), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, mobile applications, browser extensions, and related services (collectively, the “Service”).

By accessing or using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Service.

This Privacy Policy should be read alongside our Terms of Service, which govern your use of the Service. Terms defined in the Terms of Service have the same meaning when used in this Privacy Policy.

2. Information We Collect

We collect information in the following ways:

2.1 Information You Provide

• Account information — name, email address, profile photo, and authentication credentials (including data from third-party sign-in providers such as Google or Apple)
• User content — collection names, descriptions, notes, and product saves
• Communications — messages you send us via email or in-app support

2.2 Information Collected Automatically

• Device information — device type, operating system, browser type and version, unique device identifiers
• Usage data — pages viewed, features used, search queries, products saved, time spent in the app, and interaction patterns
• Log data — IP address, access times, referring URLs, and crash or error reports
• Location data — approximate geographic location derived from your IP address (we do not collect precise GPS location)

2.3 Information from Third Parties

• Social sign-in providers (e.g., Google, Apple) may share your name, email, and profile picture when you choose to sign in with their service
• Retailers and data partners may provide product information, pricing, and availability data displayed within the Service

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide, operate, maintain, and enhance the Service, including personalized product recommendations, search results, collection suggestions, and any new features or services we may develop
• Create and manage your account, authenticate your identity, and verify your eligibility
• Improve, personalize, and expand the Service based on usage patterns, feedback, and aggregated analytics, including training and improving our AI and machine-learning models
• Communicate with you, including sending service-related notifications, updates, promotional materials, and marketing communications (with your consent where required by applicable law)
• Monitor and analyze usage trends, performance, effectiveness, and engagement across the Service
• Detect, investigate, prevent, and address fraud, abuse, security incidents, and technical problems, including enforcement of our Terms of Service
• Comply with legal obligations, respond to lawful requests, and protect BloomPin’s legal rights, property, and safety
• Create aggregated, de-identified, or anonymized data that can no longer be reasonably linked to you, which we may use for any lawful business purpose without restriction

4. Information Sharing & Disclosure

We do not sell your personal information. We may share your information in the following limited circumstances:

• Service providers — trusted third-party vendors who perform services on our behalf (e.g., cloud hosting, analytics, email delivery, customer support, AI model providers), bound by contractual obligations to protect your data. We are not responsible for the independent privacy practices of these providers beyond our contractual requirements
• Business transfers — in connection with a merger, acquisition, reorganization, financing, sale of assets, or bankruptcy, your information may be transferred as part of the transaction. You acknowledge and agree that such transfers may occur and that the acquirer may continue to use your data as described in this Privacy Policy
• Legal requirements — when we believe in good faith that disclosure is necessary to comply with applicable law, legal process, government request, or to establish, exercise, or defend our legal rights
• Safety and rights — to investigate, prevent, or take action regarding suspected or actual illegal activities, violations of our Terms, threats to the rights, property, or safety of BloomPin, our users, or the public
• With your consent — when you explicitly authorize us to share your information
• Aggregated and de-identified data — we may share aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you for any purpose, including research, analytics, marketing, and business development, without restriction

5. Cookies & Tracking Technologies

We use cookies, pixels, local storage, and similar technologies to operate and improve the Service. These technologies help us:

• Maintain your session and remember your preferences
• Understand how you interact with the Service to improve features and performance
• Measure the effectiveness of our communications and marketing

5.1 Types of Cookies We Use

• Strictly necessary cookies — required for the Service to function (e.g., authentication tokens, session management). These cannot be disabled.
• Functional cookies — remember your preferences and settings (e.g., theme, language, recently viewed products)
• Analytics cookies — help us understand how visitors interact with the Service so we can improve performance and features (e.g., Google Analytics, Firebase Analytics)

We do not currently use advertising or marketing cookies.

5.2 Managing Cookies

You can control cookies through your browser settings. Note that disabling cookies may affect the functionality of certain features. Most browsers allow you to block or delete cookies, and you can typically find these settings in your browser’s “Preferences” or “Settings” menu.

5.3 Do Not Track Signals

Some browsers transmit “Do Not Track” (DNT) signals. There is currently no industry standard for how companies should respond to DNT signals. At this time, BloomPin does not respond to DNT signals. However, you can use the cookie controls described above to manage your tracking preferences.

We may use third-party analytics services (such as Google Analytics or Firebase Analytics) that use cookies and similar technologies to collect and analyze usage information. These services have their own privacy policies governing their use of your data.

6. Data Security

We implement industry-standard technical and organizational security measures to protect your personal information, including encryption in transit (TLS/SSL), encryption at rest, access controls, and regular security assessments. However, no method of electronic transmission or storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee its absolute security.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users and relevant authorities as required by applicable law.

7. Data Retention

We retain your personal information for as long as your account is active or as reasonably needed to provide the Service, comply with our legal and regulatory obligations, resolve disputes, enforce our agreements, maintain business records, and pursue legitimate business interests. When you delete your account, we will delete or anonymize your personal data within a reasonable period (generally 30 days), unless we are required or permitted by law to retain it for a longer period — for example, for tax, legal, audit, or security purposes.

Aggregated, de-identified, or anonymized data that can no longer be reasonably linked to you may be retained indefinitely for analytics, product improvement, AI model training, research, and any other lawful business purpose.

Backup copies of data may persist in our systems for a reasonable additional period after deletion due to standard backup and disaster-recovery processes.

8. Your Rights & Choices

Depending on your jurisdiction, you may have some or all of the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Correction — request that we correct inaccurate or incomplete data
• Deletion — request that we delete your personal data (subject to certain legal exceptions)
• Portability — request your data in a structured, commonly used, machine-readable format
• Restriction — request that we limit the processing of your data in certain circumstances
• Objection — object to the processing of your personal data for certain purposes, including direct marketing
• Withdraw consent — where processing is based on your consent, you may withdraw it at any time

To exercise any of these rights, please contact us at hello@kikipin.com. We will respond to your request within 30 days (or sooner if required by applicable law). Please note that we may request verification of your identity before processing any request, and we reserve the right to deny or limit requests where permitted by law — for example, if complying with your request would be technically infeasible, would require disproportionate effort, would infringe on the rights of others, or would conflict with our legal obligations or legitimate business interests.

You may also opt out of promotional emails by clicking the “unsubscribe” link in any marketing email. Note that you may still receive transactional or service-related communications.

9. AI & Automated Decision-Making

BloomPin uses artificial intelligence and machine-learning algorithms to provide personalized product recommendations, search results, and collection suggestions. These systems process your usage data (such as saved products, search queries, and browsing patterns within the Service) to generate results tailored to your preferences.

This automated processing is used solely to improve your experience and does not produce legal or similarly significant effects. No automated decisions are made about you that would affect your legal rights, financial standing, or access to services.

Under the GDPR and the EU AI Act, you have the right to:

• Receive meaningful information about the logic involved in automated processing
• Request human review of any automated decision that significantly affects you
• Object to profiling for direct marketing purposes

To exercise these rights or learn more about how our AI systems work, contact us at hello@kikipin.com.

10. International Data Transfers

Your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate. These countries may have data protection laws that differ from those in your jurisdiction. By using the Service, you explicitly consent to the transfer, storage, and processing of your data in these locations and acknowledge that your data may be subject to the laws of those jurisdictions, including lawful access by courts, law enforcement, or regulatory authorities.

Where required by applicable law (such as the GDPR), we ensure that appropriate safeguards are in place for international transfers, including Standard Contractual Clauses or other approved mechanisms.

11. Children's Privacy

The Service is not directed to individuals under the age of 13 (or the applicable minimum digital-consent age in your jurisdiction). We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal data from a child without verified parental consent, we will take steps to delete that information as quickly as possible. If you believe we may have collected data from a child, please contact us immediately.

12. California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to know what personal information we collect, use, disclose, and sell
• Right to delete personal information we hold about you
• Right to opt out of the sale or sharing of your personal information (we do not sell your personal information)
• Right to non-discrimination for exercising your privacy rights
• Right to correct inaccurate personal information
• Right to limit use and disclosure of sensitive personal information

12.1 Sensitive Personal Information

Under the CPRA, “sensitive personal information” includes data such as precise geolocation, racial or ethnic origin, religious beliefs, biometric data, and health information. BloomPin does not intentionally collect sensitive personal information as defined by the CPRA. If we ever need to process sensitive personal information, we will provide additional notice and obtain your explicit consent.

To exercise these rights, contact us at hello@kikipin.com. We will verify your identity before processing your request.

13. European & UK Residents (GDPR / UK GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data on the following legal bases:

• Performance of contract — processing necessary to provide you with the Service
• Legitimate interests — processing for our legitimate business interests, such as fraud prevention, security, and service improvement, balanced against your rights
• Consent — where you have given explicit consent to specific processing activities (e.g., marketing communications)
• Legal obligation — processing necessary to comply with applicable laws and regulations

You have the right to lodge a complaint with your local data protection authority if you believe your data has been processed unlawfully. For EEA residents, a list of supervisory authorities is available at edpb.europa.eu. For UK residents, the supervisory authority is the Information Commissioner’s Office (ICO) at ico.org.uk.

13.1 EU & UK Representative

As required by Article 27 of the GDPR and the UK GDPR, we have appointed a representative in the European Union and the United Kingdom to act as a point of contact for data protection authorities and data subjects. You may contact our representative at hello@kikipin.com with the subject line “GDPR Representative Inquiry.” We will update this section with a named representative and postal address once appointed.

13.2 Data Protection Officer

Given the current scale of our data processing activities, we have not yet appointed a formal Data Protection Officer (DPO) as contemplated by Article 37 of the GDPR. We continuously assess whether appointment of a DPO becomes necessary. In the meantime, all data protection inquiries can be directed to hello@kikipin.com.

14. Browser Extension Privacy

Our browser extensions (Safari and Chrome) allow you to save products while browsing third-party websites. The extension may access the current page URL and product metadata (title, price, image) on retailer pages when you actively choose to save a product. The extension does not track your general browsing activity, record keystrokes, or access data from non-retailer pages unless you explicitly interact with the extension.

15. Changes to This Policy

We may update this Privacy Policy from time to time at our sole discretion to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the “Last updated” date at the top of this page and may provide additional notice where we deem appropriate (such as via email or an in-app notification). Your continued use of the Service after any changes to this Privacy Policy constitutes your acceptance of the updated policy. We encourage you to review this Privacy Policy periodically.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: hello@kikipin.com

We will do our best to respond to your inquiry within 30 days.