1. Purpose

The purpose of this Information Security Policy is to establish standards and responsibilities for protecting the confidentiality, integrity, and availability of company information systems, customer data, and business assets.

This policy applies to all employees, contractors, systems, applications, and third-party services used by the company.

2. Scope

This policy covers:

• Customer and user data
• Company intellectual property
• Application infrastructure
• Third-party services and integrations
• Internal systems and access credentials

This policy applies to all production, staging, and development environments.

3. Roles & Responsibilities

Information Security Officer (ISO)

The Information Security Officer is responsible for:

• Overseeing the company's information security program
• Ensuring appropriate safeguards are implemented
• Reviewing vendor security practices
• Managing incident response and reporting
• Maintaining and updating security policies

Employees & Contractors

All personnel are responsible for:

• Protecting company and customer data
• Following access control and authentication requirements
• Reporting suspected security incidents immediately

4. Data Classification

Company data is classified into the following categories:

• Confidential: Customer data, authentication credentials, financial data, API keys
• Internal: Internal documentation, operational data
• Public: Marketing materials and publicly released information

Confidential data must be protected with appropriate technical and organizational controls.

5. Access Control

• Access to systems and data is granted on a least-privilege basis
• Role-based access control (RBAC) is enforced where supported
• Administrative access is restricted to authorized personnel only
• Multi-factor authentication (MFA) is required for privileged access where available
• Access is reviewed periodically and revoked upon role change or termination

6. Authentication & Credential Management

• Strong passwords are required for all systems
• Passwords and secrets are never stored in plaintext
• API keys and service credentials are stored securely and rotated periodically
• Production credentials are restricted from client-side exposure

7. Data Protection & Encryption

• Data is encrypted in transit using TLS
• Sensitive data is encrypted at rest where supported by infrastructure providers
• Third-party platforms (e.g., Supabase, Stripe, Plaid) are relied upon for secure data storage and processing according to their published security standards

8. Application Security

• Secure development practices are followed
• Dependencies are kept reasonably up to date
• Production systems are separated from development and testing environments
• Changes to production systems follow controlled deployment processes

9. Third-Party & Vendor Security

The company uses reputable third-party service providers for infrastructure and functionality, including but not limited to:

• Cloud hosting and databases
• Payment processing
• Banking integrations
• AI services

Vendors are selected based on security posture, industry reputation, and compliance commitments. Vendor access is limited to the minimum required.

10. AI & Data Processing

• AI functionality is provided through trusted third-party providers
• User inputs are processed solely for providing application functionality
• The company does not sell user data
• AI usage is disclosed to users and governed by the company's Privacy Policy

11. Logging & Monitoring

• System activity is logged where supported
• Errors and security-relevant events are monitored
• Logs are protected from unauthorized access

12. Incident Response

In the event of a suspected security incident:

1. The issue is promptly investigated
2. Impacted systems may be isolated
3. Affected users or partners are notified when legally or contractually required
4. Remediation steps are taken to prevent recurrence

All incidents are documented and reviewed.

13. Data Retention & Deletion

• Data is retained only as long as necessary for business or legal purposes
• Users may request account and data deletion
• Account deletion requests are processed through internal workflows

14. Business Continuity & Availability

• Cloud infrastructure is designed for reasonable availability
• Backups are maintained where supported by service providers
• Recovery procedures are documented and tested periodically

15. Policy Review & Updates

This policy is reviewed at least annually or upon significant changes to systems, regulations, or business operations.

16. Compliance

This policy supports compliance with:

• Applicable data protection and privacy laws
• Platform requirements (Apple App Store, payment processors, banking partners)
• Contractual security obligations

Acknowledgment

All personnel are expected to comply with this Information Security Policy. Violations may result in disciplinary action or termination of access.

1. Purpose

The purpose of this Data Retention and Disposal Policy is to define how Bloom Industries retains, manages, and securely disposes of data in accordance with business needs, legal requirements, and platform obligations.

This policy is designed to protect the confidentiality and integrity of personal, financial, and operational data throughout its lifecycle.

2. Scope

This policy applies to:

• All customer and user data
• Financial and transactional data
• Application data and logs
• Third-party data accessed or processed on behalf of users
• All systems, environments, and service providers used by Bloom Industries

3. Data Retention Principles

Bloom Industries follows these guiding principles:

• Data is retained only as long as necessary to provide services
• Retention aligns with legal, contractual, and operational requirements
• Access to retained data is limited to authorized personnel
• Data retention practices are periodically reviewed

4. Categories of Data & Retention Practices

4.1 Account & User Data

Includes: User identifiers, contact information, account preferences

Retention:

• Retained for the duration of the active account
• Deleted or anonymized upon verified account deletion request, subject to legal obligations

4.2 Financial & Subscription Data

Includes: Subscription status, transaction metadata, payment confirmation records

Retention:

• Retained as required for accounting, dispute resolution, and compliance
• Payment credentials are handled by third-party processors and are not stored by Bloom Industries

4.3 Financial Account Data (Plaid)

Includes: Account balances, transaction data, account metadata retrieved via Plaid

Retention:

• Retained only while an active connection exists and data is required to provide requested services
• Access tokens are revoked and data access terminated when a user disconnects their financial account

Bloom Industries does not store consumer banking credentials.

4.4 AI-Processed Data

Includes: User-submitted inputs processed by AI services

Retention:

• Retained only as necessary to provide application functionality and improve service performance
• AI providers process data according to their own retention policies and contractual obligations

4.5 Logs & System Data

Includes: Application logs, error logs, security-related event logs

Retention:

• Retained for operational monitoring, troubleshooting, and security purposes
• Logs are periodically reviewed and purged in accordance with system capabilities

5. Data Disposal & Deletion

Bloom Industries disposes of data securely when it is no longer required.

Disposal methods may include:

• Secure deletion via infrastructure providers
• Logical deletion or anonymization
• Revocation of access tokens and credentials

Data disposal is performed in a manner designed to prevent unauthorized recovery.

6. Account Deletion Requests

Users may request account deletion directly from within the application or through support channels.

Upon verified deletion:

• Account data is deleted or anonymized
• Active integrations are disconnected
• Residual data is retained only as required by law or legitimate business obligations

7. Third-Party Data Handling

Bloom Industries relies on reputable third-party service providers for infrastructure and integrations.

Third-party providers are required to:

• Maintain reasonable data protection practices
• Dispose of data in accordance with contractual and regulatory requirements

8. Legal & Regulatory Obligations

Certain data may be retained longer if required to:

• Comply with legal obligations
• Resolve disputes
• Enforce agreements
• Meet regulatory or audit requirements

When retention is legally required, access is restricted to authorized personnel only.

9. Policy Review

This policy is reviewed at least annually and updated as needed to reflect changes in:

• Business operations
• Legal or regulatory requirements
• Platform or vendor obligations

10. Contact

Questions regarding data retention or disposal may be directed to:

Bloom Industries
Email: contact@bloomindustries.com

1. Acceptance of Terms

These Terms and Conditions ("Terms") govern access to and use of all websites, applications, software, and services operated by Bloom Industries, Inc. ("Bloom Industries," "Company," "we," "us," or "our"), and any other Bloom Industries products.

By accessing or using our services, you agree to be bound by these Terms. If you do not agree, you may not access or use the services.

2. Scope of Services

Bloom Industries provides digital tools and subscription-based software services, including financial tools and AI-enabled features.

Services may be updated, modified, suspended, or discontinued at any time at our discretion.

3. Eligibility

You must be at least 18 years of age to use our services. By using the services, you represent that you meet this requirement and have the legal capacity to enter into these Terms.

4. Accounts & User Responsibilities

Some features require account registration.

You agree to:

• Provide accurate and complete information
• Maintain the confidentiality of your login credentials
• Promptly notify us of unauthorized access or security incidents

You are responsible for all activity occurring under your account.

5. Subscriptions & Payments

Certain services require payment through a subscription.

Payment Processing

Subscriptions are processed through third-party platforms, including:

• Apple App Store (iOS)
• Google Play Store (Android)
• Stripe or other providers (web)

Bloom Industries does not store full payment card or banking credentials.

6. Refunds & Cancellations

App Store & Google Play Purchases

Subscriptions purchased through the Apple App Store or Google Play Store are subject to the respective platform's refund and billing policies.

Bloom Industries does not process, approve, or deny refunds for purchases made through Apple or Google. Refund requests for mobile app purchases must be submitted directly to the applicable app store.

Web Purchases

Subscriptions purchased through the web are processed by third-party payment providers (such as Stripe) and are subject to the refund terms presented at the time of purchase.

Unless otherwise required by law, fees paid for subscriptions are non-refundable. Users may cancel subscriptions at any time to prevent future billing.

Cancellation does not retroactively refund previously paid fees.

7. Use of AI Features

Certain services include AI-powered functionality.

You acknowledge and agree that:

• AI-generated outputs are produced algorithmically
• Outputs may be inaccurate, incomplete, or non-specific
• AI outputs are provided for informational purposes only

You are solely responsible for how you use AI-generated content.

8. Financial Disclaimer

Bloom Industries does not provide financial, legal, or investment advice.

Any financial insights, summaries, or projections are for informational purposes only and should not be relied upon as professional advice. You should consult qualified professionals before making financial decisions.

9. Third-Party Services

Bloom Industries integrates with third-party services (including Plaid, OpenAI, payment processors, and app marketplaces).

Your use of third-party services may be governed by their own terms and policies. Bloom Industries is not responsible for third-party services or content.

10. Acceptable Use

You agree not to:

• Use the services for unlawful purposes
• Interfere with system security or integrity
• Attempt unauthorized access to systems or data
• Abuse or misuse AI features

Violations may result in suspension or termination of access.

11. Intellectual Property

All content, software, trademarks, and materials provided by Bloom Industries are owned by or licensed to Bloom Industries and are protected by applicable intellectual property laws.

You may not copy, modify, distribute, or create derivative works without prior written consent.

12. Privacy & Data Protection

Your use of the services is subject to our:

• Privacy Policy
• Information Security Policy
• Data Retention and Disposal Policy

These policies are incorporated by reference.

13. Account Termination & Deletion

You may terminate your account at any time. Bloom Industries reserves the right to suspend or terminate accounts for violations of these Terms or applicable laws.

Account deletion requests may be initiated within the application or through support channels.

14. Disclaimer of Warranties

Services are provided "as is" and "as available."

Bloom Industries disclaims all warranties, express or implied, including warranties of merchantability, fitness for a particular purpose, and non-infringement.

15. Limitation of Liability

To the maximum extent permitted by law, Bloom Industries shall not be liable for indirect, incidental, consequential, special, or punitive damages, including loss of profits or data.

Bloom Industries' total liability shall not exceed the amount paid by you for the services during the twelve (12) months preceding the claim.

16. Indemnification

You agree to indemnify and hold harmless Bloom Industries and its affiliates from claims arising out of your use of the services or violation of these Terms.

17. Changes to Terms

Bloom Industries may update these Terms from time to time. Continued use of the services after updates constitutes acceptance of the revised Terms.

18. Governing Law

These Terms are governed by the laws of the State of [Your State of Incorporation], without regard to conflict-of-law principles.

19. Contact Information

For questions regarding these Terms, contact:

Bloom Industries, Inc.
Email: contact@bloomindustries.com