Privacy Policy

The company that signs up to BloomKin (“the Customer”) decides what employee information goes into the service and why. For that information, the Customer is the data controller and BloomKin acts as its processor, handling the data only to provide the service. For the details of the people who sign up and manage an account (name, work email, company name), BloomKin is the controller.

• Account details: name, work email and company name when a company is set up or someone is invited.
• Employee records the Customer adds: contact details, job title and department, start date, date of birth, nationality, Emirates ID, passport and visa details, expiry dates, address, emergency contacts, bank details for payroll, salary information, and uploaded documents and photos.
• Day-to-day HR activity: leave requests, letter requests, service desk tickets, tasks, training records, kudos and celebrations.
• Wellbeing check-ins: a daily mood tap and an optional weekly question, if the Customer switches them on.
• Technical data: basic sign-in and security logs needed to keep the service safe and working.

Mood check-ins are personal. Each person can see their own answers and notes. Managers and company admins only see anonymous group averages, never an individual’s answers.

• To run the service: employee records, leave, letters, documents, payroll preparation and reminders such as document expiry alerts.
• To send the emails the service needs, such as invitations, confirmations, approvals and reminders.
• To keep the service secure, fix problems and prevent misuse.

We do not sell personal data, and we do not use it for advertising.

We use a small number of trusted providers to run BloomKin:

• Supabase for the database, file storage and sign-in. Data is stored in Singapore.
• Vercel to host the application, also served from Singapore.
• Resend to deliver the emails the service sends.
• Anthropic for the “Ask BloomKin” helper. When someone uses it, the question they type is sent to Anthropic, whose servers are outside the UAE, so it can write an answer from our help guide. No employee or company records are sent with it. We keep a count of questions to apply fair-use limits, but not the text of the questions or answers. Please don’t type personal details into the helper. The same provider is used for “Ask HR”, which is switched off unless a company admin turns it on: when staff ask it a question, the question and a few short passages from that company’s own HR Documents library are sent to Anthropic to write the answer. Employee records are never sent.

These providers process data on our behalf and only to provide their service. Because data is stored outside the UAE, we rely on contractual protections with these providers.

• Each company’s data is kept separate from every other company’s, enforced at the database level.
• Data is encrypted in transit. Stored asset and device passwords are additionally encrypted before they are saved.
• Access inside a company depends on role: admins, managers (their own team) and staff (their own information).
• Uploaded documents are private and only opened through short-lived secure links.

No system is perfectly secure. If we ever learn of a breach affecting your data, we will tell the affected Customer without undue delay.

We use only the essential cookies needed to keep you signed in and secure, plus small preferences stored in your browser, such as hiding a checklist. We do not use advertising or tracking cookies.

Data is kept while the Customer’s account is active. A company admin can download a copy of the company’s data, or permanently close the account and delete everything, at any time from the Company Profile page. We can also do this on request. Employees who want their information corrected or removed should contact their employer first, as the employer controls the record, or email us and we will pass the request on.

Under UAE data protection law you can ask to see, correct or delete your personal data, and to object to or restrict certain uses. Contact your employer, or email hello@bloomkin.team and we will help.

If we change this policy in a meaningful way, we will update the date at the top and tell account admins.