Humbloom Privacy Policy

1. Who We Are

Humbloom is a service provided by Humbloom LLC, a California limited liability company ("Humbloom," "we," "us," or "our"). Humbloom helps small business owners manage their Instagram presence and respond to Google reviews using an assistant that drafts content in each owner's voice.

Our registered address is: Santa Ana, California.

This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and what rights you have. If you have questions, contact us at privacy@humbloom.com.

2. Information We Collect

2.1 Information you give us directly

• Account registration: name, email address, and password when you create an account.
• Business profile: business name, business type, city, and location when you complete onboarding.
• Voice and content settings: your preferred communication style, sign-off text, sample posts you provide for voice training (Premium subscribers), and phrases you instruct us to always or never use.
• Posting schedule and recurring specials: the days, times, and recurring promotions you configure.
• Payment information: billing details collected and processed by Stripe, our payment processor. We do not store your full card number. We receive a tokenized payment reference and billing address from Stripe.
• Communications: messages you send us through support channels.

2.2 Information from third-party platforms you connect

When you connect your Instagram Business or Creator account, we receive and store:

• Your Instagram user ID, username, and account type (Business or Creator).
• The Facebook Page linked to your Instagram account.
• OAuth access tokens and refresh tokens, which we encrypt and store to maintain your connection.
• Comments on your posts (Pro and Premium subscribers) and Instagram Direct Messages (Premium subscribers), solely to draft replies for your review and approval.

When you connect your Google Business Profile, we receive and store:

• Your Google Business Profile location name and business details.
• Customer reviews posted to your Google listing, solely to draft replies for your review and approval.
• OAuth tokens, encrypted and stored to maintain your connection.

2.3 Information we generate about your use of the service

• Usage data: which features you use, drafts you approve, edit, or skip, and posting activity.
• Token balance and transaction history: records of monthly token usage and purchased token balances.
• Device and session data: IP address, browser type, device type, and session duration for security purposes including new-device login alerts.
• Photo library: photos you upload to Humbloom, including AI-generated category labels (food, interior, staff, etc.) we assign on upload.

2.4 Information from AI generation

When we generate content on your behalf using the Anthropic Claude API, we send your business name, business type, city, voice settings, and the specific review or scheduling context to Anthropic's API. We log the generation type, model used, estimated cost, and outcome (approved, edited, or skipped) for billing and analytics purposes. We do not log the full text of every generated draft in a way that is linked to individual customer accounts for longer than necessary to deliver the service.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Humbloom service.
• Generate AI-drafted Instagram captions and Google review replies in your business voice.
• Publish approved content to your connected Instagram and Google Business Profile accounts.
• Send push notifications when drafts are ready for your review.
• Process payments and manage your subscription through Stripe.
• Enforce token allocations and storage limits based on your subscription tier.
• Send transactional emails including account verification, password reset, new-device login alerts, and subscription billing notifications.
• Provide customer support and respond to your requests.
• Detect and prevent fraud, abuse, and security incidents.
• Comply with legal obligations.
• Improve the quality of AI-generated content, including analyzing aggregate patterns in approvals and edits. We do not use your content samples to train AI models for use by other customers.

We do not use your information for advertising. Humbloom does not sell your personal information to third parties. Humbloom does not share your personal information with advertisers. Humbloom does not use your data to serve you targeted advertisements.

4. AI-Generated Content and Voice Data

Humbloom's core service involves generating content that sounds like you. To do this, we use your business profile, voice settings, and (for Premium subscribers) the sample posts you provide. This section explains how that data is handled.

4.1 Your voice samples (Premium)

If you are a Premium subscriber and provide sample posts for custom voice training, those samples are stored securely and used only to generate content for your account. They are not shared with other customers, used to train shared models, or disclosed to third parties except as described in Section 6 (Sharing).

4.2 Anthropic API

We use the Anthropic Claude API to generate content. When we make an API call, your business name, business type, city, voice settings, and the relevant context (the review text or scheduling details) are transmitted to Anthropic's servers. Anthropic processes this data subject to their own Privacy Policy and API terms. Anthropic does not train their models on API inputs by default. You can review Anthropic's privacy practices at anthropic.com/privacy.

4.3 Content you approve

When you approve a draft, we post it on your behalf to the relevant platform (Instagram or Google Business Profile) using your connected OAuth credentials. Approved content is stored in your Humbloom account history so you can review past posts and replies.

5. Connected Platform Data

When you connect your Instagram or Google Business Profile account, you authorize Humbloom to access data from those platforms on your behalf. We use that access only to provide the features you have enabled:

• Instagram: reading your account info to verify connection, reading comments on your posts, posting approved captions and replies, and (Premium) reading and responding to Direct Messages.
• Google Business Profile: reading your reviews and posting approved replies.

We do not access your personal Facebook account, your personal Gmail, or any platform data beyond what is needed for the features you use. You can revoke our access at any time by disconnecting your accounts in Settings or by revoking access directly in your Instagram or Google account settings.

Your connected platform data (reviews, comments, access tokens) is processed solely to provide the service and is not sold or shared for advertising purposes.

Google API Services User Data Policy. Humbloom's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the features you have connected, we do not transfer it to others except as needed to provide those features or as required by law, we do not use it for advertising, and no human reads it except with your explicit consent, for security purposes, to comply with applicable law, or where the data has been aggregated and anonymized.

6. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

6.1 Service providers

We share information with third-party vendors who help us deliver the service. Each vendor is bound by a data processing agreement and may only use your data for the purpose of providing their service to us:

• Supabase: database hosting and authentication.
• Vercel: application hosting and deployment.
• Anthropic: AI content generation (see Section 4).
• Stripe: payment processing and subscription management.
• Resend: transactional email delivery (account alerts, billing notifications).
• Meta (Instagram/Facebook Graph API): we transmit approved content and replies to Meta's servers on your behalf when you approve a post or reply.
• Google (Business Profile API): we transmit approved review replies to Google's servers on your behalf.

6.2 Legal requirements

We may disclose your information if required by law, court order, or government request, or if we believe disclosure is necessary to protect the rights, property, or safety of Humbloom, our users, or others.

6.3 Business transfers

If Humbloom is acquired, merged with another company, or undergoes a change of ownership, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a materially different privacy policy.

6.4 With your consent

We may share your information with third parties when you have given us your explicit consent to do so.

7. Data Retention

We retain your personal information for as long as your account is active and as long as needed to provide the service. Specifically:

• Account data: retained while your account is active. After you close your account, account data is deleted within 30 days, except where we are required to retain it for legal, regulatory, or fraud-prevention purposes.
• Connected platform tokens: OAuth tokens are deleted immediately when you disconnect a platform or close your account.
• AI generation logs: generation metadata (type, model, cost, outcome) is retained for 90 days to support billing audits and service improvement. The content of individual drafts is not retained beyond what is needed to display your approval history. Aggregate cost data with no personal identifiers may be retained longer for margin analysis.
• Instagram comments and Direct Messages: comment and DM data fetched from your Instagram account is processed to generate reply drafts and is deleted within 7 days of retrieval, or immediately when you disconnect your Instagram account or close your account, whichever is sooner.
• Voice samples (Premium): sample posts you provide for custom voice training are retained for as long as your Premium subscription is active. You may delete individual samples at any time from your settings. All voice samples are deleted within 30 days of your account closure or tier downgrade from Premium.
• Photo library: photos you upload are retained for as long as your account is active. You may delete individual photos at any time; deleted photos are removed immediately from the active library. All photos are deleted within 30 days of account closure.
• Payment records: Stripe transaction records are retained for 7 years as required by US tax and accounting law.
• Purchased token balances: token balances are forfeited upon account closure and are not refunded. See Section 9.
• Backup copies: deleted data may remain in encrypted backups for up to 30 days after deletion.

8. Security

We use industry-standard measures to protect your personal information:

• All data is transmitted over HTTPS/TLS.
• OAuth access tokens and authentication secrets are encrypted at rest using AES-256-GCM encryption.
• Passwords are hashed using bcrypt and are never stored in recoverable form.
• Admin accounts require two-factor authentication (TOTP).
• Failed login attempts trigger an automatic temporary lockout after 5 consecutive failures.
• New-device logins trigger an email alert to the account holder.
• Row-level security policies restrict database access so each customer can only access their own data.

No method of transmission or storage is 100% secure. If we become aware of a data breach that affects your personal information, we will notify you as required by applicable law.

9. Your Privacy Rights

Depending on where you live, you may have certain rights regarding your personal information. We honor all of the rights described below for all users regardless of location:

9.1 Access

You have the right to request a copy of the personal information we hold about you. To submit an access request, email privacy@humbloom.com with the subject line "Privacy Access Request." We will respond within 45 days.

9.2 Correction

You have the right to ask us to correct inaccurate personal information. Most of your business profile and voice settings can be updated directly in the app at any time.

9.3 Deletion

You have the right to request deletion of your personal information. You can delete your account directly in the app under Settings. Upon account deletion, your personal information will be deleted within 30 days, except data we are required to retain for legal, tax, or fraud-prevention purposes. Please note: voluntary account closure forfeits remaining monthly token balances and any boosting wallet balance. California residents exercising their right to deletion under the CCPA may be entitled to a refund of unused purchased token balances. See Section 9.7 for details.

9.4 Data portability

You have the right to receive your personal information in a structured, machine-readable format. Email privacy@humbloom.com with the subject line "Data Portability Request."

9.5 Opt-out of sale or sharing

We do not sell your personal information and do not share it for cross-context behavioral advertising. There is nothing to opt out of with respect to sale. If you are a California resident and believe we have shared your data in a way that qualifies as a "sale" under the CCPA, please contact us at privacy@humbloom.com.

9.6 Non-discrimination

We will not discriminate against you for exercising any of your privacy rights. Exercising your rights will not result in a denial of service, different pricing, or a different level of service quality.

9.7 California residents

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) give you additional rights, including the right to know the specific pieces of personal information we have collected about you, the right to limit the use of sensitive personal information, and the right to opt out of automated decision-making. To exercise any California-specific rights, contact us at privacy@humbloom.com or use the contact information in Section 14. We do not discriminate against California residents who exercise their rights. If you are a California resident and close your account by submitting a deletion request under the CCPA, Humbloom will refund the dollar value of your unused purchased token balance at the time of the deletion request. This refund right applies only to verified CCPA deletion requests, not to voluntary account cancellations. Monthly token balances are forfeited in all cases as they have no independent monetary value and reset each billing cycle.

9.8 Other US state residents

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), Oregon, Montana, Delaware, New Hampshire, New Jersey, Nebraska, and other states with active comprehensive privacy laws have similar rights to access, correct, delete, and port their data, and to opt out of certain processing. We honor these rights for all users. To exercise your rights, contact us at privacy@humbloom.com. We will respond within the timeframe required by your state's law (typically 45 days, with a 45-day extension where permitted).

9.9 Authorized agents

You may designate an authorized agent to submit requests on your behalf. We may require verification of both your identity and the agent's authorization before processing the request.

10. Children's Privacy

Humbloom is not directed to children under the age of 13 and we do not knowingly collect personal information from children under 13. If you are under 13, do not use Humbloom or provide any personal information to us. If we learn that we have collected personal information from a child under 13, we will delete that information as quickly as practicable. If you believe a child under 13 has provided personal information to us, please contact us at privacy@humbloom.com.

Humbloom is intended for business owners and their employees and contractors. If you are under 18, you may use Humbloom only with the involvement and consent of a parent or guardian.

11. Cookies and Tracking Technologies

Humbloom uses the following types of cookies and similar technologies:

• Strictly necessary cookies: session cookies that keep you logged in and maintain your authentication state. These cannot be disabled without affecting core functionality.
• Preference cookies: cookies that remember your settings and preferences within the app.

We do not use advertising cookies, behavioral tracking cookies, or third-party analytics cookies that track you across other websites. We do not use the Meta Pixel or Google Analytics.

Our authentication system uses httpOnly cookies that are not accessible to JavaScript, which protects against cross-site scripting (XSS) attacks.

12. Meta Platform Data Policy

Because Humbloom uses the Meta (Instagram/Facebook) Graph API, we are required to comply with Meta's Platform Terms and Developer Policies. The following rules govern our use of data received from Meta's platforms:

• We use Instagram and Facebook data only to provide the features described in this Privacy Policy and in our Terms of Service.
• We do not use Meta platform data to make decisions about individuals' eligibility for financial products, insurance, employment, housing, or other sensitive categories.
• We do not sell Meta platform data or use it for advertising targeting.
• We do not transfer Meta platform data to data brokers or aggregators.
• We delete Meta platform data when it is no longer needed to provide the service, when you disconnect your Instagram account, or when you close your Humbloom account.
• We process Meta platform data in accordance with Meta's Platform Terms available at developers.facebook.com/terms.

By connecting your Instagram Business account to Humbloom, you authorize us to access and process your Instagram data as described in this policy and in accordance with the permissions you grant during the OAuth connection flow.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and by displaying a notice in the Humbloom app at least 14 days before the changes take effect. The updated policy will be posted at humbloom.com/privacy with a new effective date. Your continued use of Humbloom after the effective date constitutes acceptance of the updated policy.

14. Contact Us

For privacy-related questions, requests, or complaints, contact us at:

We will respond to privacy requests within 45 days. If your request or complaint is not resolved to your satisfaction, you may contact your state Attorney General's office or, for California residents, the California Privacy Protection Agency (cppa.ca.gov).