GDPR Compliance

Our database is hosted in London (AWS eu-west-2) via Supabase, and our application servers run in London (lhr1) via Vercel. Some sub-processors are based in, or send data to, the United States: Anthropic (AI features), Deepgram and OpenAI (speech-to-text), Recall.ai (meeting recording, run in its EU region), GitHub (encrypted backups) and services a firm chooses to connect, such as Google, Microsoft and Twilio. Resend (email) operates in the US/EU; Sentry (error monitoring) and PostHog (session replay for named test accounts only) run in the EU. Anthropic, OpenAI and Recall.ai only receive client data when the related feature is used, and transfers to them are covered by Standard Contractual Clauses with the UK Addendum. See the Sub-Processors table in our Privacy Policy for the full list.

Data is encrypted in transit using TLS 1.2+ (HTTPS everywhere) and at rest using AES-256 encryption. Passwords are hashed with bcrypt. Every request is checked so that a firm's staff can reach only that firm's records, with database Row Level Security (RLS) as a second layer underneath.

We support all data subject rights under UK GDPR: access, rectification, erasure, portability, restriction, and objection. Subject Access Requests are handled within 30 days. The right to erasure is balanced against FCA record-keeping requirements (SYSC 9, COBS 9) which require certain records to be kept for at least 3 to 5 years, and pension transfer and opt-out files indefinitely.

The financial adviser firm is the data controller for client data entered into Bloom. Bloom (Arthur Browns Wealth Management Ltd) acts as the data processor and processes that data only on the firm's instructions. We are putting a written data processing agreement in place with each firm; ask privacy@bloomflow.app for its status.

For adviser accounts, website visitors and people who use the free plan tool, Arthur Browns Wealth Management Ltd is the controller. What someone sends from a free check that an advice firm has shared goes to that firm, which is its controller, with Bloom as the firm's processor. Arthur Browns is also an advice firm in its own right, and is the controller of its own clients' data. The Privacy Policy sets out the same split.

Client financial records are kept for a minimum of 7 years (FCA requirements), advice records for a minimum of 5 years, and pension transfer files indefinitely. Automatic deletion at the end of each period is not yet in place: until it is, deletion is carried out on request, subject to regulatory retention periods.

If a breach affects client data we process for a firm, we tell that firm without undue delay so it can notify the ICO and its clients (UK GDPR Article 33(2)). Where we are the controller, we notify the ICO within 72 hours where required and tell affected people without undue delay when the risk to them is high (Articles 33 and 34).