Privacy Policy

1. Introduction

Welcome to RouteBloom. We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains what information we collect, why we collect it, how we use it, and the choices you have. By using RouteBloom’s website or mobile apps (collectively, the “Service”), you agree to the practices described here.

2. Information We Collect

3. How We Use Your Data

• To create and maintain your account, authenticate you, and store your media.
• To power features such as AI search, automatic tagging, and album sharing.
• To analyze product usage and improve performance and user experience.
• To send service announcements, security alerts, and support responses.
• To process payments and manage subscriptions (only for paid plans).
• To comply with legal obligations and protect your rights and ours.

4. Legal Bases for Processing

If you reside in the European Economic Area, we rely on the following legal bases under the GDPR:

• Contract: Processing necessary to provide the Service you request.
• Consent: For optional features such as marketing emails.
• Legitimate Interests: For product analytics, fraud prevention, and network security.
• Legal Obligation: When we must retain data to meet regulatory requirements.

5. Cookies & Tracking

RouteBloom uses cookies, local storage, and similar technologies to remember your preferences and gather usage statistics (via PostHog). You may disable cookies in your browser settings, but some features may not work correctly.

6. Third-Party Services

We share data with trusted sub-processors who help us run RouteBloom. They may only use your information as necessary to provide their service and are bound by confidentiality:

• Vercel – hosting & edge network (EU & US).
• Supabase – databases and object storage (EU).
• OpenAI – image & language AI features (US).
• Stripe – payment processing (EU & US).
• PostHog – product analytics (EU).
• Sentry – error monitoring (EU).
• SendGrid – transactional email delivery (US).

7. Data Security

We employ industry-standard encryption in transit (https) and at rest, role-based access control, regular security audits, automated backups, and incident response procedures to safeguard your data.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Backups are held for up to 30 days. We may keep certain information to comply with legal duties, resolve disputes, or enforce agreements.

9. International Data Transfers

Your data may be processed outside your country of residence, including in the United States. Where required, we use the EU Standard Contractual Clauses or other mechanisms to ensure adequate protection.

10. Your Rights

• Access: Obtain a copy of the data we hold about you.
• Correction: Rectify inaccurate or incomplete information.
• Deletion: Request deletion of your data (unless we must keep it by law).
• Portability: Receive your data in a machine-readable format.
• Restriction: Ask us to limit processing under certain circumstances.
• Objection: Object to processing based on legitimate interests or direct marketing.
• Withdraw Consent: Opt out of non-essential emails at any time.

11. Children’s Privacy

RouteBloom is not directed to individuals under 16. We do not knowingly collect personal data from children. If we learn that a child under 16 has provided us personal data, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy periodically. We will post the revised version here and update the Last updated date. Material changes will be announced via email or in-app notification.

13. Contact Us

For privacy inquiries, data requests, or complaints, please email privacy@routebloom.com or write to: RouteBloom OÜ, Sepapaja 6, 15551 Tallinn, Estonia.