Privacy policy

Who this covers

Bluum Technologies Group, Inc. (“Bluum”) operates the software described here. This notice covers Bluum’s website, staff workspace, and family portal. Studios decide which family records they enter and how they use them to operate their services. Bluum supplies the software used to handle those records. A studio may provide its own privacy notice.

For privacy inquiries, contact legal@usebluum.com. Final deployment details remain subject to review. This page is a review draft, not a claim of certification or compliance with every privacy law.

Information in the product

• Account information, such as email address, authentication records, studio membership, and staff role.
• Family contact names, email addresses, phone numbers, optional additional adult contacts, and child display names entered by an adult.
• Appointments, class registrations, program enrollments, credits, attendance, payment records, and operational activity history.
• Communication preferences, consent changes, message content, phone numbers, delivery status, and carrier opt-out events when messaging is enabled.
• Subscription and invoice identifiers and masked payment method information. Stripe-hosted payment flows handle card entry; Bluum does not provide a field for storing full card numbers or security codes.
• Technical request and security information processed by the hosting and authentication services, such as IP addresses, browser information, and request logs.

How information is used

The product uses this information to authenticate users, enforce studio and role access, schedule services, account for credits and payments, display reports, deliver enabled communications, troubleshoot failures, and maintain an activity history. Studio staff should enter only information necessary for these operational tasks.

Who receives information

Authorized staff at the relevant studio can access information according to their role. The family portal shows records linked to the signed-in family account. Platform administrators have separate access for platform operations.

The current integrations include Vercel for hosting, Supabase for authentication and database storage, Stripe for test-mode billing and payment flows, and Handset for enabled test-carrier messaging. Each receives information needed for its function. Authentication email delivery also involves the project’s configured email provider.

The reviewed website code does not include advertising pixels or analytics scripts. Payment-provider pages are separate services with their own notices. This draft does not authorize selling family records or using them for targeted advertising.

Communication choices

Families can change transactional email, transactional SMS, appointment-update, marketing email, and marketing SMS preferences in the portal. Marketing choices default to off and are stored separately. Marketing delivery is not currently available.

Carrier STOP blocks remain authoritative for texting. Sign-in and account-security emails are handled separately from studio communication preferences. Updating a preference does not erase previous messages or the consent history.

Retention and deletion

Records can remain while needed for studio operations, billing history, access management, or resolving disputes. The product does not currently apply one automatic retention period to every record type. Backup and provider retention may differ from active application storage.

Deleting a family record is subject to history and access safeguards. It may also remove an exclusively linked authentication account, but shared accounts and protected records can remain. Account deletion should not be interpreted as immediate erasure from all backups and provider systems.

Access, corrections, and requests

Families can update available contact information and preferences in the portal. For corrections, access requests, or deletion involving studio records, contact your studio first so it can identify the records and verify your authority. You can also send privacy and data requests to legal@usebluum.com. For general platform assistance, contact hello@usebluum.com.

Depending on your location and applicable law, you may have additional rights to access, correct, delete, or restrict use of personal information. The final notice needs a jurisdiction-specific review; this draft does not limit those rights.

Children and sensitive information

Bluum accounts are intended for adults. A parent or guardian may enter a child’s display name for operational family bookings. The product is not intended for children to create accounts or submit information directly. Do not enter clinical notes, diagnoses, medical histories, or other unnecessary sensitive information. Use fictional information in demo environments.

Security and service locations

The application uses authentication, studio membership checks, and role-based access restrictions. No system can guarantee absolute security. Hosting regions, provider processing locations, contractual protections, and backup retention must be confirmed for the intended deployment before this notice is finalized; no particular data-residency guarantee is made here.

Updates to this notice

This draft will be updated as deployment practices are confirmed. The date at the top identifies the latest revision. See the Cookie policy for browser storage and the Terms & conditions for product scope.