Privacy Policy (EN)

Effective date: 02/06/2026 · Last updated: 21/09/2026 Version française

This Privacy Policy describes how Bloomcal collects, uses, stores, shares and protects personal data. It applies to all services available through bloomcal.com and app.bloomcal.com. Bloomcal is operated by POTION DIGITALE LLC.

Summary: how Bloomcal handles Google user data

What we access: your Google account name, email address and user ID for sign-in, and your Google Calendar — the events it contains, so we can detect when you are busy and manage the events created by Bloomcal.
Why: to authenticate you, to hide time slots you are already busy in, to create and update the calendar events for appointments booked through Bloomcal, and to generate Google Meet links.
How it is stored: OAuth tokens encrypted at rest in the European Union; calendar data cached temporarily, also in the EU.
Who it is shared with: only the technical subprocessors listed in Section 9. Never sold, never rented, never shared for advertising.
What we never do: no advertising, no profiling, no resale, no training of artificial intelligence or machine learning models on your Google user data.
How to stop it: disconnect your Google account in Bloomcal, or revoke access at myaccount.google.com/permissions. Your tokens are deleted immediately.

Bloomcal’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

1. Data controller

POTION DIGITALE LLC 1209 Mountain Road Pl NE, Ste N Albuquerque, NM 87110 — United States Email: support@bloomcal.com

2. Description of the service

Bloomcal is an online appointment scheduling platform that allows professionals to:

create public booking pages;
manage their calendar and availability;
collect information through booking forms;
synchronize their calendar with third-party services, in particular Google Calendar;
automate appointment confirmations, reminders and follow-ups.

Some features rely on integrations with third-party services, in particular Google services. Connecting a Google account is always optional.

3. Categories of data collected

3.1 Data provided directly by the user — first and last name; email address; phone number; billing information; professional information.

3.2 Appointment data — dates and times; appointment type; form answers; booking history; appointment-related interactions.

3.3 Configuration data — availability; account settings; user preferences; booking page content.

3.4 Incomplete lead data — when the professional enables this feature, Bloomcal may store information entered into a booking form before it is submitted: name, email, phone number, and form completion status. End clients are informed of this collection on the booking page.

3.5 Technical data — IP address, connection logs, device type, browser, operating system, usage and navigation data.

3.6 Data from third-party services — when a user connects a third-party service such as Google, certain data becomes accessible according to the permissions granted. See Section 4.

4. Google user data: access, use, storage and sharing

When a user explicitly chooses to connect their Google account to Bloomcal via app.bloomcal.com, Bloomcal accesses only the data necessary to provide the features the user has requested.

4.1 Consent

Google account connection is optional and is never required to use Bloomcal. It is initiated by the user, through Google’s own OAuth consent screen, which lists the permissions requested. The user may decline, or revoke access later, without losing access to the rest of the service.

4.2 Scopes requested and why

Scope	Data accessed	Why Bloomcal needs it
openid	Google account identifier	Establish an authenticated session
https://www.googleapis.com/auth/userinfo.email	Email address of the Google account	Identify the user and match or create their Bloomcal account; send service emails
https://www.googleapis.com/auth/userinfo.profile	Name and profile picture of the Google account	Display the user’s identity in the Bloomcal interface
https://www.googleapis.com/auth/calendar	Read and write access to the user’s Google calendars and the events they contain: title, date, start and end time, attendees, conferencing data	Read existing events to detect busy time slots and prevent double bookings; create, update and delete the calendar events corresponding to Bloomcal appointments; attach Google Meet links to those events

Scope of actual use. The calendar permission granted by Google is broad. Bloomcal’s use of it is deliberately narrower: Bloomcal reads existing events solely to determine when the user is unavailable, and writes only the events that correspond to appointments booked through Bloomcal. Bloomcal never creates, modifies or deletes any other event, and never creates or deletes calendars.

4.3 How Google user data is used

Google user data is used exclusively to:

authenticate the user;
synchronize calendars in both directions;
prevent scheduling conflicts;
create and manage appointments booked through Bloomcal;
attach video conferencing links to those appointments.

Optional Bloomcal features that affect how many time slots are displayed on a booking page operate only within Bloomcal’s own booking interface. They never create, hide, modify or delete anything in the user’s Google Calendar, and they are configured by the professional on their own availability.

4.4 How Google user data is stored

OAuth access and refresh tokens are encrypted at rest in our PostgreSQL database hosted by Neon Inc. in the European Union;
calendar data required to compute availability is cached temporarily in Redis hosted by Upstash Inc. in the European Union;
API requests transit through Vercel Inc. infrastructure without persistent storage;
all data is encrypted in transit using TLS.

4.5 How Google user data is shared

Google user data is shared only with the technical subprocessors strictly necessary to operate the service, listed in Section 9. Google user data is never sold, rented or transferred to third parties, and is never shared for advertising, profiling, or any purpose unrelated to the features the user explicitly requested.

4.6 No use for artificial intelligence or machine learning

Bloomcal does not use Google user data — including calendar content, event titles, attendees or account information — to develop, train, improve, fine-tune or evaluate any artificial intelligence or machine learning model, whether our own or a third party’s. Google user data is never sent to generative AI services.

4.7 Human access to Google user data

No human at Potion Digitale LLC reads Google user data, except:

with the user’s explicit consent, for a specific support request they have made;
where necessary for security purposes, such as investigating abuse or a suspected incident;
to comply with applicable law;
where the data has been aggregated and anonymized, for internal operations such as capacity planning.

Internal access follows the principle of least privilege and is logged.

4.8 Limited Use commitment

Bloomcal’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: Google user data is not used for advertising; is not sold or transferred to third parties; is not used to build user profiles; is not used to train AI or ML models; and is not used or transferred for any purpose other than providing or improving the user-facing features the user has explicitly requested.

5. Legal basis for processing

Performance of the contract (use of Bloomcal); consent (Google account connection, non-essential cookies); legitimate interest (security, service improvement, abuse prevention); and compliance with legal obligations.

6. Purposes of processing

To provide and operate the platform; manage user accounts; organize appointments; send confirmations and reminders; manage incomplete leads; provide customer support; improve performance and usability; secure our systems; and manage billing and payments.

7. No automated decision-making

Bloomcal does not carry out automated decision-making producing legal effects concerning users, or similarly significantly affecting them, within the meaning of Article 22 GDPR.

8. Data sharing

Personal data may be shared only: with authorized internal staff of Potion Digitale LLC; with the technical subprocessors listed in Section 9; with the professionals using Bloomcal, where data is collected through their booking pages; and with competent authorities where required by law.

9. Subprocessors

Provider	Role	Google user data involved	Location	Safeguards
Vercel Inc.	Frontend & backend (API) hosting	Transit only, no persistent storage	USA / EU (region selected)	DPA + SCCs
Neon Inc.	PostgreSQL database	Google OAuth tokens (encrypted), calendar data	EU	DPA + GDPR
Upstash Inc.	Redis cache	Sessions, temporary calendar data	EU	DPA + GDPR
Clerk Inc.	Identity & authentication	Google user ID and email (OAuth sign-in)	USA / EU	DPA + SCCs
Stripe Inc.	Payments	None	USA / EU	DPA + SCCs
Google LLC	Google APIs (Calendar, Meet, OAuth)	Data sent to and received from Google APIs	USA / worldwide	Google API Policy

SCCs = Standard Contractual Clauses. DPA = Data Processing Agreement. All providers are contractually bound and access data only within the strict limits of their assignment.

10. Data retention

User data: up to 3 years after the last interaction;
billing data: as required by applicable law;
technical logs: for the period required for security purposes;
Google user data (OAuth tokens, calendar data): retained only for as long as the connected feature requires it, and deleted immediately when the user revokes access or deletes their Bloomcal account.

After these periods, data is irreversibly deleted or anonymized.

11. Revoking Google access and deleting your data

11.1 Disconnecting your Google account

At any time, users may disconnect their Google account from Bloomcal → Settings → Integrations → Disconnect Google, or revoke access from myaccount.google.com/permissions.

Once access is revoked: Bloomcal immediately stops accessing Google user data; access and refresh tokens are invalidated and deleted from our database; associated calendar data is deleted or made inaccessible, except where retention is legally required.

11.2 Deleting your account and all your data

Users may delete their account and all associated data at any time from Bloomcal → Settings → Account → Delete my account, or by writing to support@bloomcal.com. Deletion is executed within 30 days and covers all personal data, including any Google user data still held, except data we are legally required to retain (such as billing records).

12. Security

Strict internal access controls; encryption of sensitive data — including Google OAuth tokens — at rest and in transit; continuous monitoring of access and anomalies; least-privilege internal access; infrastructure hosted with certified providers (Vercel, Neon, Upstash).

13. Data breach notification

In the event of a personal data breach likely to result in a risk to the rights and freedoms of data subjects, Bloomcal notifies the competent supervisory authority within 72 hours of becoming aware of it, and informs affected users without undue delay where the breach is likely to result in a high risk to them.

14. International transfers

Some of our providers (in particular Vercel, Clerk and Stripe) are based in the United States. In such cases, appropriate safeguards apply, including Standard Contractual Clauses and Data Processing Agreements. Databases and caches holding Google user data are hosted in the European Union.

15. Cookies

Bloomcal uses cookies that are strictly necessary for the service to function (authentication, session, security), and, subject to consent, cookies for analytics and user experience improvement. Consent can be changed at any time through the cookie settings available on the site.

16. Your rights

Under the GDPR, users in the European Union have the right to access, rectify, erase, restrict and object to the processing of their personal data, the right to data portability, and the right to withdraw consent at any time without affecting the lawfulness of processing carried out beforehand.

Requests should be sent to support@bloomcal.com and are answered within 30 days.

Right to lodge a complaint. Users also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their residence or workplace. In France, this is the CNIL — cnil.fr.

United States residents. Residents of US states with applicable privacy legislation, including California, may request access to, correction of, or deletion of their personal information, and may opt out of any sale or sharing of personal information. Bloomcal does not sell or share personal information as those terms are defined under the CCPA. Requests may be sent to support@bloomcal.com. We do not discriminate against users who exercise these rights.

17. Minors

Bloomcal is intended for professional use and is not directed at children. We do not knowingly collect personal data from persons under the age of 16. If we become aware that such data has been collected, we delete it without undue delay.

18. Data collected through booking pages

Where data is collected from end clients through a professional’s booking page, that professional acts as the data controller and Bloomcal acts as a processor on their behalf, under the terms of our Data Processing Agreement.

19. Changes to this policy

This policy may change to reflect the evolution of the service or legal requirements. The « Last updated » date at the top of this page always reflects the current version. Substantial changes are notified to users by email or in-app notice before they take effect.

20. Contact

POTION DIGITALE LLC — 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, USA support@bloomcal.com