bloomwithcalm.com

Privacy Policy

Last updated: 30 September 2026

1. Controller

The controller responsible for processing personal data is:

Tamara Sommer
Bloom With Calm
Rua Casa Branca 17
9000-113 Portugal
Email: bloomwithcalm@gmail.com
Telephone: +351 964 623 678

This Privacy Policy applies to the website https://bloomwithcalm.com/, the contact and booking options offered through it, and Bloom With Calm Daily.

2. Principles

Personal data is processed only to the extent necessary to operate the website, respond to enquiries, provide Bloom With Calm Daily, or comply with legal obligations. Personal data is not sold.

3. Website access and server logs

When the website is accessed, the hosting provider processes technically necessary data. This may include, in particular, the IP address, date and time of access, page accessed, amount of data transferred, browser, operating system, referrer URL, and error messages.

This processing serves to provide the website securely and reliably, analyse errors, and prevent misuse. The legal basis is the legitimate interest in providing a secure and functional online service pursuant to Article 6(1)(f) GDPR.

The hosting provider is Hostinger International Ltd., 61 Lordou Vironos Street, Larnaca 6023, Cyprus. The server is located in France; backups are stored in Lithuania. Access logs containing information such as time, IP address, request, and response time can be viewed in Hostinger hPanel for periods of up to seven days. Hostinger does not publish a fixed internal retention period beyond this for the underlying raw HTTP/HTTPS logs. Further information: Hostinger – Analytics and access logs.

Hostinger processes customer data stored on the hosting system as a processor. This processing is governed by Hostinger’s Data Processing Addendum. For necessary transfers to third countries without an adequacy decision, it provides in particular for the use of EU Standard Contractual Clauses. According to the Addendum, customer data is generally deleted 30 days after termination of the contract, unless otherwise required for the relevant service or by law. Further information: Hostinger Data Processing Addendum.

The domain was purchased through the Mastermind platform and is managed through its Business Hub. Cloudflare nameservers are used as authoritative nameservers. According to the configuration reviewed, website traffic is not routed through a Cloudflare proxy. The domain management service does not receive form submissions or app content.

4. Contact and appointment booking

If a user contacts Bloom With Calm by email, the information provided is processed in order to respond to the enquiry. The legal basis is Article 6(1)(b) GDPR where the enquiry concerns a service or steps prior to entering into a contract. For other enquiries, the legal basis is Article 6(1)(f) GDPR. The legitimate interest is responding to the enquiry.

An external link to Google Calendar is used for appointment bookings. Google Calendar is not embedded directly in the Bloom With Calm website. Only when the user opens the link do they leave the website and establish a direct connection to Google. In this process, the IP address and device, browser, and access data in particular may be transmitted to Google. Google is responsible for any further processing on its website.

Google states that its consumer services for users in the European Economic Area are generally provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google operates servers worldwide. Personal data may therefore also be processed outside the country in which the user is located. Depending on the recipient country and the processing involved, Google identifies adequacy decisions, the EU-US Data Privacy Framework, and Standard Contractual Clauses as transfer mechanisms. Further information: Google Privacy Policy and Google data transfer frameworks.

5. Requesting access to Bloom With Calm Daily

5.1 Data processed

When a form is submitted to request free trial access or a place on the waiting list, the following data is processed:

  • first name,
  • email address,
  • preferred language,
  • status and time of the request and of any required confirmation,
  • voluntary information and feedback later provided by email,
  • technically necessary security data, to the extent collected by the form system.

No journal entries or voice notes are collected through the form.

5.2 Purposes and legal bases

The information is used to review the request, manage the first 50 genuinely confirmed founding members, manually enable personal trial access, send necessary information about access and material changes, maintain a waiting list after 50 confirmed activations have been reached, and evaluate voluntary feedback to improve the trial version.

The processing of data required for the request, activation, and provision of the free trial is based on Article 6(1)(b) GDPR. The processing of voluntary feedback is based on Article 6(1)(a) GDPR where consent is obtained for this purpose. Consent may be withdrawn at any time with effect for the future.

Necessary access messages are not advertising. Newsletters or other promotional messages are sent only after separate consent has been given. Consent to receive advertising is not a condition of trial access.

5.3 Form and email service providers

The request is transmitted to Bloom With Calm through the encrypted form system. The recipient address is not published in the page source.

Forminator by WPMU DEV is used as the form system. Form data is stored in the WordPress database on the Hostinger system. According to the configuration reviewed, no external Forminator integration is enabled that transmits form entries to WPMU DEV. Further information: WPMU DEV privacy information.

Technical email delivery is handled by FluentSMTP in conjunction with the Gmail API and the OAuth-authenticated mailbox bloomwithcalm@gmail.com. FluentSMTP does not store the Google password. The email service is Google Gmail. The information about Google in section 4 applies.

5.4 Retention periods

  • Form entries in the WordPress database are automatically deleted 365 days after submission.
  • Unconfirmed or rejected requests are deleted no later than 365 days after submission, unless legal grounds require longer retention.
  • Data relating to users whose access has been activated is stored for the duration of active access. Once access ends, personal administration data is deleted within 365 days at the latest, unless statutory retention or documentation obligations require otherwise.
  • Waiting-list data is stored until access is activated, the person unsubscribes, or a maximum of 365 days after registration. Continued storage on the waiting list requires renewed confirmation.
  • Voluntary feedback and related personal correspondence are deleted when they are no longer required, and no later than after 365 days. Anonymised findings that can no longer be attributed to an individual may be used for further development for a longer period.
  • Email notifications generated by form requests are deleted as part of regular mailbox maintenance according to the same periods.

6. Data within Bloom With Calm Daily

6.1 Journal entries and voice notes

Bloom With Calm does not store journal entries or voice notes. If a user voluntarily uses these functions, their browser stores the relevant content solely and locally on their own device. The content is not transmitted to Bloom With Calm or to a Bloom With Calm server. Bloom With Calm can neither access nor restore it.

Anyone with access to the device or the browser profile used may potentially access this content. Users are therefore advised to use a personal device protected by a screen lock. Deleting browser data, changing devices, reinstalling software, or technical faults may result in the permanent loss of locally stored content.

If a user deliberately saves or exports a voice note outside the app, they decide where the file is stored or to which service of their choice it is transferred. Bloom With Calm does not receive or store a copy. The privacy terms of the external storage or sharing service chosen by the user apply.

The app uses local browser storage technologies. Journal entries and voice notes are stored in the local IndexedDB database bloom-with-calm, in the diary and voice stores. The selected language and most recently selected mood are stored locally under bloom-lang and bloom-mood. No connected D1 database or R2 file storage is used for this content. The application code reviewed contains no upload function for journal text or voice recordings and no proprietary analytics, marketing, or social-media trackers.

Individual items and all journal data can be deleted within the app. Alternatively, the local website data can be deleted through the browser or device settings. The app does not encrypt this content itself; protection of local storage depends on the security features of the device, operating system, and browser.

6.2 ChatGPT Sites and technical access data

The trial version of Bloom With Calm Daily is provided through ChatGPT Sites at an address on the chatgpt.site domain. When the site is opened, the device connects to the ChatGPT Sites hosting infrastructure. This may generate technically necessary access, device, account, and log data.

Access is restricted to expressly invited individuals. An invited person must sign in with the ChatGPT account whose email address has been granted access. Sign-in and access control are handled by ChatGPT Sites. The Bloom With Calm Daily application code reviewed does not read or store the visitor’s email address.

According to its official documentation, ChatGPT Sites automatically collects usage metrics such as unique visitors and page views and makes them available to the site owner in an analytics view. No separate analytics SDK has been added to the app for this purpose. ChatGPT Sites currently does not support fixed data or inference residency. This includes deployed sites, site code, any connected storage, generated artefacts, and logs. Further information: Official ChatGPT Sites documentation.

7. Cookies and similar technologies

According to the configuration reviewed on 30 September 2026, no analytics or marketing trackers are used on the publicly accessible Bloom With Calm website. The previously available Hostinger Reach newsletter form and fonts loaded externally from Google have been disabled. A subsequent technical check found no connections to Hostinger Reach, Google Fonts, or the analytics and marketing services reviewed.

Technically necessary cookies or local storage functions are used only to the extent required for a function expressly requested by the user. Within Bloom With Calm Daily, the local browser storage described in section 6.1 is used solely for the selected app functions. Non-essential analytics or marketing technologies will be activated only after valid consent has been obtained.

8. Recipients and transfers outside the EEA

Recipients or technical service providers are, where required for the relevant function, Hostinger for website hosting and form data, Google for Gmail and the externally accessed Google Calendar booking service, and OpenAI for the provision and access control of the trial app hosted through ChatGPT Sites. Public authorities receive data only where there is a legal obligation to provide it.

According to its Data Processing Addendum, Hostinger uses EU Standard Contractual Clauses in particular for necessary transfers. Depending on the recipient country and the processing involved, Google identifies adequacy decisions, the EU-US Data Privacy Framework, and Standard Contractual Clauses. Fixed data or inference residency is not available for ChatGPT Sites. The app is therefore operated with restricted individual access and stores journal entries and voice notes solely and locally on the device.

9. No automated decision-making

Decisions about activation as a founding member are made personally. No decision is based solely on automated processing, and no profiling within the meaning of Article 22 GDPR takes place. Once 50 activations have been confirmed, further requests are placed on the waiting list.

10. Minors

Bloom With Calm and Bloom With Calm Daily are intended for adults. Registrations from persons under the age of 18 are not knowingly accepted.

11. Rights of data subjects

Subject to the applicable legal requirements, data subjects have the right to:

  • access their personal data,
  • rectification of inaccurate data,
  • erasure,
  • restriction of processing,
  • data portability,
  • object to processing based on legitimate interests,
  • withdraw consent with effect for the future,
  • lodge a complaint with a data protection supervisory authority.

Requests may be sent to bloomwithcalm@gmail.com. The competent Portuguese supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD).

12. Data security

Bloom With Calm implements appropriate technical and organisational measures to protect personal data against loss, misuse, and unauthorised access. These include HTTPS, authenticated email delivery, restricted administrative access, regular updates, and secure passwords. Absolute protection cannot be guaranteed when data is transmitted over the internet.

13. Changes to this Privacy Policy

This Policy will be updated when functions, service providers, or legal requirements change. The current version will be published on the website with its effective date. Where material changes affect users whose access has been activated, they will also be informed appropriately by email.