Privacy Policy

1. The short version

• We do not sell personal information, and we do not use it for targeted advertising.
• We use no advertising or third-party analytics cookies. We use the cookies needed to keep you signed in, and one first-party cookie that remembers which campaign link first brought you to our site.
• Card payments are handled by Stripe. BrokerBloom never sees or stores your full card number.
• AI drafts are written by OpenAI from your brand profile and prompts. Your CRM data is not sent to OpenAI.
• Facebook and Instagram access tokens are stored encrypted. You can disconnect at any time, and our data deletion instructions explain how to remove that data.
• You can ask to access, correct, or delete your data at any time by emailing hellobrokerbloom@gmail.com.

2. Information we collect

Information you give us

• Account information: your name, email address, and password. Our sign-in system (better-auth, open-source software that runs on our own servers) stores your password only as a one-way hash.
• Waitlist information: your email address, and where on our site you signed up.
• Brand profile: your business name, logo, brand colors, font, voice and tone, target audience, and insurance lines.
• Content: your designs and template text, the photos you upload, captions, scheduled posts and their status, and the goals and topics you type into the AI builder.
• CRM data: information about your leads and clients. This includes names, email addresses, phone numbers, lead source, pipeline stage, notes, consent settings, assignments, and activity history, such as logged calls, notes, logged texts, and the subject and body of emails you log or send to leads. It also includes spreadsheets (CSV or XLSX) you import to create leads.
• Team information: your team name, members and their roles, and the email addresses you invite. We store invitation links only in hashed form.
• Referral information: your referral code, the accounts that signed up through your link, and your referral earnings. Once payouts are available, it will also include the ID of your Stripe Connect account and its payout status.
• Messages to us: anything you send us when you email us for support or with a question.
• In-app feedback: the rating and any comment you send through the in-app feedback prompt, stored with your account email, plan, the page you were on, and your browser type. We use it to improve the Service.

Billing information

Stripe processes all payments, and you enter your card details directly with Stripe. We do not receive or store full card numbers. From Stripe we keep your customer and subscription IDs, your plan, your subscription status, your trial and billing period dates, and whether you have canceled. For referrals, we keep the invoice, charge, and amount records we need to calculate earnings.

Connected Facebook and Instagram accounts

When you connect through Facebook Login, Meta gives us the list of Facebook Pages you manage and the Instagram professional accounts linked to them, including their IDs, names, and usernames, together with access tokens for those Pages. We save each Page, and each linked Instagram account, that you allow BrokerBloom to access in Facebook's connection screen. We ask Meta for these permissions: pages_show_list, pages_manage_posts, pages_read_engagement, instagram_basic, and instagram_content_publish.

We store each connected account's ID and name, and its Page access token, encrypted with AES-256-GCM. We never store your Facebook password. We use your personal Facebook login token only during the connection step, to find your Pages, and we do not keep it. We also store the post IDs that Meta returns and any error messages Meta sends when a post fails.

We also store the app-scoped Facebook user ID Facebook gives us when you connect, which we keep only so we can match and complete data-deletion requests sent from Facebook.

Information collected automatically

• Sign-in sessions: when you sign in, we record your IP address and browser type (the “user agent”) with your session.
• Server logs: our hosting provider records requests and errors, such as time, page or address requested, and IP address. We use these to run and secure the Service.
• Usage records: for example, when you use an AI generation (to count it against your plan's AI limit), and when a post publishes or fails.
• Campaign attribution: if you first arrive through a link with campaign tags, we record those tags, your landing page, the referring website, and the time in the bb_ft cookie (see Cookies), and save them with your account if you sign up.
• Browser storage: the design editor saves your in-progress design settings in your browser's local storage, on your own device.

3. Cookies

We use the cookies needed for signing in, and one first-party cookie for campaign attribution. They are secure, HttpOnly, and SameSite=Lax, which means page scripts cannot read them and they are sent only over HTTPS.

• __Secure-better-auth.session_token: keeps you signed in. It lasts up to 7 days.
• __Secure-better-auth.session_data: a cached copy of your session details, so that pages load faster. It lasts up to 7 days.
• bb_ft: set only if you first arrive through a link with campaign tags (utm_source, utm_medium, utm_campaign, utm_term or utm_content). It stores those tags, the page you landed on, the website that sent you (without its query string), and the time. It lasts 90 days and is never overwritten. If you create an account, we save these details with your account so we can see which campaigns bring sign-ups. It is first-party only and is not shared with or read by anyone else.

Our sign-in software may also set other short-lived cookies that are strictly needed for particular sign-in steps.

We do not use advertising cookies, tracking pixels, or third-party analytics. Stripe's checkout and billing portal pages, and Facebook Login, are hosted by those companies, which may set their own cookies under their own policies.

You can block or delete cookies in your browser, but you will not be able to stay signed in without the session cookies. Blocking or deleting bb_ft has no effect on the Service. Because we do not sell personal information or use it for targeted advertising, we have nothing that browser “Do Not Track” or Global Privacy Control signals would need to switch off. We will honor those signals as the law requires.

4. How we use information

• To provide the Service. This includes your brand profile, Content Studio, calendar, CRM, and team workspace.
• To write AI drafts at your request (see AI processing).
• To publish posts to the Facebook and Instagram accounts you connect, when you tell us to. Direct posting to Facebook Pages and Instagram professional accounts is optional, uses the Meta permissions you grant, and may be limited or unavailable for some accounts depending on Meta's review and permissions. You can always download your designs and post them yourself.
• To run billing, trials, plan limits, and the referral program.
• To send service emails, such as your welcome email, password resets, trial reminders, and team invitations.
• To send marketing emails (see Emails from us).
• To give support and answer your questions.
• To secure the Service, prevent fraud and abuse, and enforce our Terms.
• To understand and improve how the Service works, using usage information and the feedback you send us.
• To comply with the law.

We do not use your CRM data for our own marketing, and we do not sell it.

5. AI processing with OpenAI

When you use the AI builder, or ask for an AI caption, we send OpenAI the information it needs to write the draft:

• your brand profile details: business name, voice and tone, target audience, and insurance lines;
• the goal, topic, and platform you choose; and
• for captions, the text on the selected design, such as its headline, body, call to action, and brand name.

If you write a comment in the in-app feedback prompt, we also send that comment to OpenAI to sort it into a short topic (for example, “More templates”), so we can see which features are requested most.

We do not send OpenAI your CRM data, your password, or your payment details. OpenAI processes this information as our service provider. Under its API data policies, as of the date above, OpenAI states that it does not use API data to train its models by default, and that it may keep API data for up to 30 days to monitor for abuse. Please do not include clients' personal or sensitive information in AI prompts.

For each successful generation, we keep a log of the goal, the topic, the template chosen, and the time. We use it to count generations against your plan's allowance.

6. How we share information

We do not sell personal information, and we do not share it for cross-context behavioral (targeted) advertising. We share it only as follows.

Service providers

These companies process information for us, to help us run the Service:

• Railway: hosts the application and the database.
• Stripe: payments, subscriptions, and the customer billing portal, and, once enabled, referral payouts through Stripe Connect.
• OpenAI: AI text generation.
• Resend: delivery of our service and marketing emails.
• Meta Platforms: Facebook Login, and, once direct posting is available for your account, publishing to the Facebook Pages and Instagram accounts you connect, when you tell us to.

Others

• Your team: in a team workspace, the other members can see the team's shared brand kit, leads, designs, scheduled posts, and team analytics. If you connect a Facebook or Instagram account while you are in a team, that connection is shared with the team, so that team posts can be published to it.
• Your referrer: if you signed up through someone's referral link, they see your first name and last initial and the earnings from your payments. They never see your email address or payment details.
• Legal and safety: when the law, a court order, or legal process requires it, or to protect the rights, safety, or property of our users, the public, or BrokerBloom.
• Business transfers: as part of a merger, acquisition, financing, or sale of all or part of our business. If that happens, we will notify you of any change in who controls your information.
• With your direction or consent: for example, when you publish a post.

7. Facebook and Instagram data and data deletion instructions

We use the data we get from Meta only to show you your connected accounts, and to publish the posts you choose to the account you pick. We do not sell Meta data, use it for advertising, or share it, except with our hosting provider.

To delete your Facebook and Instagram data from BrokerBloom, use any of these options:

1. 1Disconnect in BrokerBloom. Go to Settings, then Social accounts, and choose Disconnect next to the account. This immediately deletes the stored connection, including the account ID, name, and encrypted access token. Any scheduled posts for that account will no longer be published.
2. 2Remove BrokerBloom in Facebook. Go to Facebook Settings & privacy → Settings → Business integrations (or Apps and websites), select BrokerBloom, click Remove, and choose to send a deletion request. BrokerBloom receives the request automatically, deletes the Facebook and Instagram connection data we hold for you, and Facebook shows you a confirmation code and a link where you can check the status of your request at any time.
3. 3Email us. Send a request to hellobrokerbloom@gmail.com from your BrokerBloom account email. Ask us to delete your Facebook and Instagram data, or your whole account.

We complete email requests within 30 days and confirm by email when they are done. Posts you have already published stay on Facebook or Instagram until you delete them there. Deleting your whole BrokerBloom account also deletes all of your connected-account data.

8. Information about your leads and clients

Our users enter or import personal information about their leads and clients into the CRM. For that information, our user (the agent or agency) is in control, and BrokerBloom processes it on their behalf, as their service provider. We use it only to provide the Service to that user. We do not sell it, and we do not use it to market to those people ourselves.

The CRM currently logs the emails and texts an agent sends to a lead; BrokerBloom does not send them, so leads do not get emails or texts from BrokerBloom on an agent's behalf.

If you are a lead or client of a BrokerBloom user, and you want to access, correct, or delete your information, or stop receiving messages, please contact that agent directly. If you contact us instead, we will pass your request on to the agent, or help them respond to it.

9. Emails from us

• Account holders get a welcome email when they sign up. Over the first week, they also get a short series of tips emails, on days 1, 2, and 4, and people in a free trial get a trial reminder about one to two days before the trial ends. We skip these once you are on a paid plan.
• Waitlist members get our launch announcement, and occasional tips and updates.

How to unsubscribe. Waitlist emails and the tips emails for account holders include an unsubscribe link, which takes you to our unsubscribe page. You do not need to sign in. You can also email hellobrokerbloom@gmail.com from the address you want removed, and we will stop them.

We will still send you service emails that you need, such as password resets, billing and trial notices, security notices, and team invitations. You cannot opt out of these while you have an account.

10. How long we keep information and how to delete it

• While your account is open, we keep your account data. If you cancel a paid plan, your workspace returns to Lite, and your data stays until you delete it or ask us to delete it.
• Deleting things yourself: you can delete individual leads, designs, and uploaded photos, and you can disconnect social accounts, at any time.
• Deleting your account: there is not yet a delete-account button in the app. Email hellobrokerbloom@gmail.com from your account email address. Once we have verified the request, we will delete your account, along with your brand profile, designs and images, CRM data, scheduled posts, social connections, and referral records. We do this within 30 days, and confirm by email when it is done.
• Things we may keep: records we must keep for tax, accounting, or legal reasons (Stripe also keeps payment records under its own policies); information we need to prevent fraud or to establish or defend legal claims; and copies in routine backups and logs, until they expire on their normal schedule.
• Waitlist: we keep your email address until you ask us to delete it. If you unsubscribe, we keep a record of that so that we do not email you again.
• Inactive free accounts: if a Lite account has been inactive for a long time, we may delete it. We will email the account address at least 30 days before we do.

11. Security

We use reasonable safeguards to protect personal information:

• connections are encrypted with HTTPS;
• passwords are stored only as one-way hashes;
• Facebook and Instagram access tokens are encrypted with AES-256-GCM, and they are never shown in the app or written to logs;
• sign-in cookies are secure and HttpOnly;
• team invitation links are stored only as hashes;
• access controls limit data to your own account or team; and
• card data stays with Stripe.

As explained in our Terms, saved design images and uploaded photos are kept at hard-to-guess web addresses that anyone with the link can open, so that Meta can fetch them when you publish.

No system is completely secure, and we cannot guarantee security. If a data breach affects you, we will notify you as the law requires.

12. Your privacy rights

Wherever you live, you can ask us to:

• confirm whether we process your personal information, and give you access to it;
• correct inaccurate information (you can edit most of it yourself in the app);
• delete your personal information;
• give you a copy of your information in a portable format; and
• stop sending you marketing emails.

U.S. state privacy laws

Several states give their residents privacy rights. Examples are California (the CCPA, as amended by the CPRA), Texas (the Texas Data Privacy and Security Act, or TDPSA), and Colorado, Connecticut, Virginia, Utah, Oregon, and others. Depending on the state, these rights may include the right to know, access, correct, delete, and get a copy of your personal information. They may also include the right to opt out of the sale of personal information, targeted advertising, and certain kinds of profiling, and the right to limit the use of sensitive personal information.

Whether a particular law applies to BrokerBloom depends on things like the size of our business and where our users live. Some of these laws may not apply to us yet. Even so, we honor the requests listed above from all U.S. users. We do not sell personal information, use it for targeted advertising, or use it for profiling that has legal or similarly significant effects. We do not use sensitive personal information about our users to infer things about them.

How to make a request

1. 1Email hellobrokerbloom@gmail.com with the subject “Privacy request,” and say what you are asking for. If you can, send it from your BrokerBloom account email.
2. 2We will verify your identity. Usually we do this by confirming that you control your account email. We may ask for more information if we need it.
3. 3We will respond within 45 days. If we need more time, we will tell you, and we may take up to 45 more days where the law allows.

You may use an authorized agent to make a request for you. We may ask for proof that they are authorized, and we may ask you to confirm your identity directly with us.

Appeals. If we decline your request, you can appeal by emailing hellobrokerbloom@gmail.com with the subject “Appeal” within 60 days. We will respond to your appeal within 60 days. If you are a Texas resident and you disagree with our decision, you may contact the Texas Attorney General. Residents of other states may contact their own state attorney general.

We will not treat you differently because you used any of these rights.

If you are a lead or client of a BrokerBloom user, see Information about your leads and clients.

13. Children

The Service is for adults using it for their work as brokers or independents across multiple industries, and it is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact hellobrokerbloom@gmail.com, and we will delete it.

14. International users

BrokerBloom is based in the United States and built for U.S. brokers and independents across multiple industries. We and our service providers process and store information in the United States, and in other countries where those providers operate. Privacy laws there may differ from the laws where you live. If you use the Service from outside the United States, you understand that your information will be transferred to the United States and processed there.

15. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the “Last updated” date at the top. If a change is material, we will tell you by email or in the Service before it takes effect.

16. Contact us

Questions about this Privacy Policy or your information? Email us at hellobrokerbloom@gmail.com. We handle all contact, including legal notices and privacy requests, by email. Our mailing address is BrokerBloom LLC, 5900 Balcones Drive, Suite #34485, Austin, TX 78731.