Privacy Policy

1. SCOPE AND OVERVIEW

Scale Social AI, Inc. ("Scale Social AI," "we," "us," or "our") operates Bloem. Bloem helps subscribing businesses collect customer videos and other content through QR codes and links, screen and prepare that content, route Stories to the subscribing business for review through an account, WhatsApp, or SMS, and deliver approved Stories. Where enabled, Bloem may also publish a Story to a Meta, Google Business Profile, or other connected account at the Subscriber's specific direction and retrieve post, account, location, or campaign performance data.

This Privacy Policy explains how we collect, use, disclose, and retain personal information when you:

visit joinbloem.com or another Bloem website;

create, administer, or use a Bloem business subscription;

receive or respond to Bloem WhatsApp or SMS messages;

record or submit content through a Bloem Capture Screen;

contact support or make a privacy or content-removal request; or

otherwise interact with Bloem.

The policy applies to business account holders and authorized users ("Subscribers"), people who record or submit content ("Contributors"), website visitors, and other individuals whose personal information we process in connection with Bloem.

Bloem is designed for use in the United States. Capture Screens may be used only by adults age 18 or older. An adult Contributor may include their minor child in family or customer content as permitted by the Contributor Terms; the minor does not use the Capture Screen or accept the Contributor Terms.

2. WHO WE ARE AND OUR DATA ROLES

Company: Scale Social AI, Inc. Mailing address: 4801 Glenwood Ave, Suite 500, Raleigh, NC 27612 Email: support@joinbloem.com

For purposes of this policy, "Message Channel" means a Bloem WhatsApp or SMS workflow; "Subscriber Data" means account, business, billing, messaging, support, configuration, and other data a Subscriber provides to or generates through Bloem, excluding Captured Content, Bloem Metadata, and Third-Party Platform Data; "Bloem Metadata" means Scale Social AI's technical, consent, rights, curation, workflow, authorization, instruction, audit, security, and product-telemetry information generated through Bloem that does not reproduce or expose restricted Third-Party Platform Data; "Third-Party Platform Data" means information received from or about a connected Meta, Google Business Profile, or other platform account, including raw platform metrics and analytics derived from them unless the platform expressly permits a particular derivative to be treated otherwise; and "Business Day" means Monday through Friday, excluding a day when banks in North Carolina are authorized or required by law to close.

We refer to the Bloem Master Service Agreement as the "Subscriber Agreement" in this policy. Contractual ownership does not by itself determine who is a controller, business, processor, or service provider under privacy law. Under the Subscriber Agreement, the applicable Subscriber owns Captured Content, while Scale Social AI receives broad, continuing rights to use it.

We generally act as a separate controller or business responsible for:

Captured Content and associated personal information when we process them to operate Bloem, administer rights and consent, develop products, train or evaluate artificial-intelligence and machine-learning systems, create analytics, secure the service, or market Bloem and Scale Social;

Bloem Metadata, including consent and rights records, tags, labels, curation and quality information, workflow events, authorization and audit records, security signals, and permitted product telemetry;

Subscriber account, billing, support, and Message Channel data;

website, analytics, security, and marketing data; and

privacy and content-use requests made directly to us.

A Subscriber generally acts as a separate controller or business for its own use, publication, advertising, targeting, retention, and other handling of Captured Content and for its connected Meta, Google Business Profile, or other accounts. Under the Subscriber Agreement, the Subscriber assumes full responsibility for the legal, regulatory, professional, platform-policy, and ethical review of those uses, including privacy notices and legal bases, disclosures, claims, audiences, context, and handling of requests. Bloem screening, automated outputs, suggested copy, and technical publication are not legal or ethical approval.

We act as a processor or service provider for personal information in Subscriber Data, Captured Content, Connected Account credentials, or Third-Party Platform Data when a Subscriber directs us to process it solely to provide an enabled Bloem feature or carry out a documented publishing, reporting, or other instruction. The integrated data processing terms in Article 13 of the Bloem Master Service Agreement apply automatically to that processing. In those circumstances, the Subscriber is responsible for its privacy notice, lawful instructions, and decisions, and a request relating only to Subscriber-controlled data should generally be directed to the Subscriber.

When Scale Social AI independently uses Captured Content or other personal information for its own product development, artificial-intelligence or machine-learning training or evaluation, analytics, security, or marketing purposes, Scale Social AI is responsible for its own compliance with applicable law for those independent uses. The Subscriber is not responsible for a use Scale Social AI independently initiates under its own license.

3. PERSONAL INFORMATION WE COLLECT

The information we collect depends on how you interact with Bloem.

3.1 Subscriber Account and Business Information

We may collect:

name, title, business name, business category, and business contact details;

email address, mobile number, account identifiers, and login or authentication information;

authorized-user names and contact information;

billing address, subscription details, invoices, transaction records, tax information, and limited payment information received from our payment processor;

business locations, brand assets, logos, preferences, Offer details, Capture Surface configurations, and other onboarding information;

approvals, rejections, edits, workflow actions, timestamps, and account history;

marketing preferences and interactions with our communications; and

information you provide in support requests, surveys, feedback, interviews, or research sessions.

We do not store full payment-card numbers. Our payment processor handles those details under its own privacy policy.

3.2 WhatsApp and SMS Information

When a Subscriber activates a Message Channel, we may collect and retain:

the mobile number and channel selected;

the date, time, source, wording, and version of the opt-in;

message content, delivered Stories, attachments, delivery links, delivery and read status where available, timestamps, and routing metadata;

structured replies, approvals, opt-outs, HELP requests, and cancellation-related messages;

device, carrier, and technical information made available by WhatsApp, telecommunications carriers, or messaging providers; and

records showing when consent was given, changed, or withdrawn.

Bloem uses WhatsApp and SMS to communicate with Subscribers and their authorized users. Bloem does not use those channels to message Contributors.

3.3 Contributor and Captured Content Information

When a Contributor uses a Capture Screen, we may collect:

the video, audio, image, text, caption, transcript, or other material the Contributor records or submits;

the Contributor's appearance, likeness, voice, statements, and actions contained in the Submission and, where the Contributor includes a minor child as permitted by the Contributor Terms, the child's appearance, likeness, voice, statements, and actions;

metadata associated with the file or session, such as timestamps, file properties, device and browser information, referring Capture Surface, and approximate location inferred from an IP address;

information embedded in the submitted file, which may include device or location metadata if the Contributor's device includes it;

consent, acceptance, version, parental or guardian authority representations where applicable, and rights records;

the business and Offer associated with the Capture Screen;

screening results, quality and compliance flags, and versions we create from the Submission; and

a submission reference used to locate the content if the Contributor later contacts us.

A Contributor generally does not create an account and is not required to give us a name, email address, or mobile number. Because we may not have direct contact details, a Contributor should keep the reference shown after submission.

3.4 Connected Accounts and Third-Party Platform Data

If a Subscriber connects a Meta, Google Business Profile, or other account, we may collect or receive:

account, page, profile, business, location, listing, and advertising-account identifiers and information;

OAuth tokens, permission grants, permission status, and connection history;

account roles, settings, eligible publishing destinations, and platform-required authorization information;

post, media, caption, call-to-action, campaign, content, and platform identifiers;

publication status, rejection reasons, error messages, moderation or policy notices, and timestamps;

performance and insights data, which may include impressions, reach, views, engagement, likes, comments, saves, shares, clicks, calls, direction requests, website actions, bookings, conversions, and search terms; and

other data the platform makes available for the permissions and features the Subscriber authorizes.

We call this information "Third-Party Platform Data." Captured Content does not become Third-Party Platform Data merely because we publish it to a connected account. Raw platform data, platform metrics, and analytics derived from them remain subject to the rights and terms of the Subscriber, the platform, and other parties. Our own authorization, instruction, publishing, status, error, audit, security, and product-telemetry records may be Bloem Metadata only where they do not reproduce or expose restricted platform data.

For Google Business Profile, we request only permissions needed for implemented user-facing features, use Google's official authorization flow, and obtain specific authorization before an account-changing action. A WhatsApp or SMS instruction may begin a workflow, but where Google's then-current requirements require manual sign-in or in-product confirmation, the authorized user must complete that step before we transmit the action. We store only limited Google API content, securely, for no more than thirty (30) calendar days unless Google expressly permits otherwise, and do not manipulate or aggregate stored Google API content. We provide a quick disconnection method, remove or relinquish management permissions within seven (7) Business Days after the relationship ends or the Subscriber requests disconnection, or sooner if Google requires, and provide any separate notice Google requires for a qualifying account-management change within forty-eight (48) hours after the change.

For Meta, we request only permissions needed for implemented user-facing features, use an official Meta authorization flow, and require the Subscriber to remain authorized to manage the connected Page, Instagram professional account, advertising account, or other asset. We use Meta Platform Data only to provide, secure, troubleshoot, measure, or improve the enabled Subscriber-facing integration, comply with law, or as Meta otherwise permits. We do not use Meta Platform Data for artificial-intelligence or machine-learning training, unrelated advertising or marketing, sale or resale, lead generation, surveillance, cross-client profiling, or cross-client benchmarking. Service providers may receive it only as needed for the enabled integration and subject to permitted-use and protection restrictions. After disconnection, loss of authorization, termination of the feature, or a valid deletion request, we cease access and delete or de-identify the data as Meta's then-current requirements or applicable law require, subject to permitted security, audit, backup, and legal records.

These disclosures do not mean that either integration is currently available or will be released or continued. Feature availability depends on Bloem's implementation and the applicable platform's then-current approval, permission, account, and continuing-access requirements.

3.5 Website, Device, and Usage Information

We may automatically collect:

IP address, browser type, operating system, device identifiers, and language;

pages or screens viewed, links clicked, referring pages, session timestamps, and interactions;

cookie, local-storage, analytics, and similar identifiers;

diagnostic logs, error reports, performance information, and security events; and

approximate location inferred from IP address.

3.6 Communications and Requests

If you contact us, we may collect the contents of the communication, contact details, identity-verification information, records of our response, and information needed to investigate or fulfill the request.

3.7 Information from Third Parties

We may receive information from:

a Subscriber or its authorized users;

payment processors;

WhatsApp, telecommunications carriers, and messaging providers;

Meta, Google Business Profile, and other platforms or platform-authorized providers after a Subscriber connects an account;

cloud hosting, analytics, security, support, and fraud-prevention providers;

public sources and business directories; and

other parties at your direction or with your consent.

4. SENSITIVE INFORMATION, FACES, VOICES, AND BIOMETRICS

We do not ask you to provide Social Security numbers, government identification numbers, health information, financial account credentials, precise geolocation, information about race or ethnicity, religious or philosophical beliefs, sexual orientation, sex life, immigration status, union membership, or criminal history through a Capture Screen. Please do not include that information in a Submission.

A video or audio recording may incidentally reveal characteristics that some laws treat as sensitive, and it will often include a face or voice. Where an adult Contributor validly includes a minor child under the Contributor Terms, the recording may also include the child's image, likeness, voice, statements, actions, and other information appearing in the content. We process the recording to screen and prepare the content, document and administer its assignment to the applicable Subscriber, exercise Scale Social AI's license, publish at the Subscriber's direction, develop and train products and systems, market Bloem and Scale Social, secure the service, and administer the Story as described in this policy and the Contributor Terms, subject to applicable law.

We do not use Captured Content to identify or verify the identity of a person, and we do not create or retain, or direct a service provider acting for us to create or retain, face-geometry templates, facial-recognition templates, voiceprints, speaker signatures, identity embeddings, or other biometric identifiers for identification or authentication. We do not use faces or voices to build audience, lookalike, or identity profiles. We contractually restrict providers from creating or retaining those identifiers for us.

If we introduce a materially different biometric or identity use, we will provide any notice and obtain any consent required before that use begins.

5. HOW WE COLLECT INFORMATION

We collect information:

directly from you, such as when you subscribe, activate messaging, submit content, configure an Offer, contact support, or exercise a privacy right;

automatically, through cookies, logs, analytics, security tools, and platform telemetry;

from a Subscriber, such as when a business adds an authorized user or provides brand materials;

from service providers and platforms, such as payment, WhatsApp, SMS, Meta, Google Business Profile, hosting, analytics, and security providers, after any required authorization; and

from public or permissioned sources, where lawful and relevant to operating or protecting Bloem.

6. HOW WE USE PERSONAL INFORMATION

We may use personal information to:

6.1 Provide and Administer Bloem

create and manage accounts and subscriptions;

configure Capture Surfaces, Offers, brands, workflows, and Connected Accounts;

receive, screen, prepare, caption, crop, stabilize, and otherwise process Submissions;

route Stories for Subscriber review and deliver approved Stories;

publish a Story to a Connected Account when an authorized user gives a specific instruction;

retrieve publication status, errors, and performance information;

record approvals, rejections, edits, publishing instructions, opt-ins, opt-outs, and cancellation requests;

process payments, invoices, taxes, renewals, and refunds;

provide onboarding, support, and service communications; and

maintain rights, consent, usage, platform-authorization, and audit records.

6.2 Communicate

send Subscriber approval and publishing prompts, Story deliveries, performance recaps, recommendations, and account notices through an activated Message Channel;

send transactional emails about onboarding, billing, renewal, security, changes, and cancellation;

respond to support, privacy, legal, and content-use requests; and

send marketing communications where permitted and subject to your preferences.

6.3 Secure and Protect the Service

authenticate users and control access;

detect fraud, abuse, malicious activity, unauthorized access, and violations;

monitor performance, investigate incidents, troubleshoot errors, and maintain availability;

enforce our agreements and protect our rights, users, Subscribers, platforms, and the public; and

comply with law, legal process, and regulatory requests.

6.4 Develop, Train, Analyze, and Improve

We may use Captured Content, Bloem Metadata, aggregated or de-identified account and usage information, and other information as permitted by this policy and applicable law to:

understand feature usage, workflow performance, content performance, and service quality;

test, debug, evaluate, and improve our systems, screening processes, curation, recommendations, and products;

research, design, develop, train, fine-tune, evaluate, validate, and improve artificial-intelligence and machine-learning models, algorithms, classifiers, and recommendation systems;

create tags, labels, scores, taxonomies, benchmarks, generalized learnings, and aggregated or de-identified statistics;

develop new features and products; and

use feedback for product and business development.

We do not use Message Channel content or raw Third-Party Platform Data for artificial-intelligence or machine-learning training. If we accept a content-use restriction for an identified Story, we will not intentionally place the identified source media into a new training or evaluation dataset after the restriction takes effect. We do not promise to retrain or unlearn models, delete model parameters or weights, or delete generalized learnings created before the restriction, except where applicable law requires it.

6.5 Business Ownership and Use of Captured Content

The Contributor Terms assign the Contributor's rights in a Submission to the Subscriber identified on the Capture Screen, and the Subscriber Agreement assigns to that Subscriber the rights Scale Social AI acquires in Bloem-created edits and versions. Ownership does not require us to disclose, deliver, preserve, or export every Submission, rejected or disqualified version, or internal screening record. We may quarantine, withhold, disable, or delete content for safety, privacy, rights-management, data-minimization, legal, platform, technical, security, fraud-prevention, or policy reasons. We may process, edit, store, deliver, and publish the Captured Content for that Subscriber and administer the rights and consent records. The Subscriber may use the content for marketing, promotional, advertising, and commercial purposes subject to its agreement with us, applicable law, and any communicated restriction. The Subscriber is solely responsible for the legal and ethical basis, review, context, claims, disclosures, targeting, platform compliance, publication, downstream sharing, retention, and removal of its uses. Where Bloem publishes at a Subscriber's direction, we act as the technical service provider for that instruction rather than the publisher or legal or ethical approver.

The Contributor Terms and Subscriber Agreement give Scale Social AI a worldwide, perpetual, transferable, sublicensable, fully paid-up, royalty-free license to use Captured Content. To the fullest extent permitted by law, the license is irrevocable. We may use Captured Content, including a Contributor's appearance, voice, statements, and the Subscriber's brand context, to operate and improve Bloem and Scale Social products, develop and train artificial-intelligence and machine-learning systems, conduct research and analytics, and advertise, market, demonstrate, and promote Bloem, Scale Social AI, their affiliates, and their products and services.

Marketing uses may include public websites, social media, paid advertising, sales materials, presentations, demos, portfolios, case studies, and other promotional channels. We do not sell, rent, or license Subscriber-specific Captured Content to an unrelated third party as a standalone content asset, whether the content is raw, edited, captioned, transcribed, reformatted, or otherwise prepared. We will not knowingly state that a Subscriber endorses us beyond the actual relationship unless the Subscriber provides or approves that statement.

6.7 Connected Accounts, Publishing, and Performance Data

When a Subscriber connects an account, we may use the authorized permissions and Third-Party Platform Data to provide user-facing publishing, status, performance, attribution, reporting, recommendation, troubleshooting, and security features. We process the data as the Subscriber's processor or service provider where we act only on its behalf, and as a separate controller only for limited security, legal, audit, and operational records or another use separately disclosed and permitted by law and the platform.

We do not claim ownership of raw Third-Party Platform Data. Our own authorization, instruction, transaction, publishing, status, error, audit, security, and product-telemetry records may be Bloem Metadata only where permitted and where they do not reproduce or expose restricted platform data.

We do not use raw Third-Party Platform Data for artificial-intelligence or machine-learning training, unrelated advertising or marketing, sale or resale, lead generation, surveillance, cross-client profiling, or cross-client benchmarking. Google API content and Meta Platform Data are also subject to the platform-specific practices described in Section 3.4.

7. LEGAL BASES WHERE APPLICABLE

Where a law requires a legal basis, we rely on one or more of the following:

contract: to provide Bloem, process a Submission under the Contributor Terms, administer a subscription, or take requested steps before a contract;

consent: for WhatsApp or SMS messaging, optional marketing, recording a research session, or another use where we request consent;

legitimate interests: to secure, operate, analyze, support, and improve Bloem; prevent fraud; enforce agreements; and communicate about the service, balanced against individual rights;

legal obligation: to maintain tax and transaction records, respond to lawful requests, and comply with applicable law; and

legal claims and public interests: to establish, exercise, or defend claims and protect people, systems, and rights.

You may withdraw consent where processing is based on consent. Withdrawal does not affect processing that was lawful before withdrawal or processing based on another legal basis.

8. AUTOMATED PROCESSING AND ARTIFICIAL INTELLIGENCE

We may use artificial intelligence, machine learning, and other automated tools to:

assess technical quality, clarity, relevance, apparent authenticity, and suitability;

identify possible rights, privacy, safety, or policy concerns;

stabilize, crop, reframe, shorten, caption, transcribe, or improve audio and visual quality;

remove or reduce incidental audio and background material;

if and when the functionality is made available, draft suggested captions, disclosures, or workflow recommendations;

create tags, labels, scores, annotations, generalized features, and Bloem Metadata;

research, design, develop, train, fine-tune, evaluate, validate, and improve models, algorithms, classifiers, recommendation systems, and related products and services; and

support fraud prevention, analytics, security, and customer service.

Automated outputs may be inaccurate and do not constitute legal, regulatory, professional, ethical, editorial, or brand-safety review. A Subscriber is solely responsible for reviewing each Story and proposed use before approving, publishing, targeting, distributing, or otherwise using it.

We do not intentionally alter the substance of what a Contributor said or did, add words the Contributor did not say, generate a synthetic face or voice presented as the Contributor, or make it appear that a person endorsed something they did not endorse.

We may use Captured Content to train, fine-tune, evaluate, and improve artificial-intelligence and machine-learning systems, including through service providers, as described in the Contributor Terms. A trained model may retain model parameters and generalized learnings that do not contain a readily retrievable copy of a Submission. It may not be technically feasible to identify or remove the effect of one Submission from a trained model, and we do not promise model retraining or unlearning except where applicable law requires it.

We do not use information obtained through the WhatsApp Business Platform to develop, train, or improve an artificial-intelligence or machine-learning model, including in aggregated or de-identified form. We apply the same restriction to the content of Bloem SMS threads. We also do not use Third-Party Platform Data from Meta, Google Business Profile, or another Connected Account for model training.

These restrictions do not prevent us from using Captured Content, Bloem Metadata, aggregated or de-identified account and usage information, or feedback as otherwise described in this policy. We do not use Captured Content to train a facial-recognition, speaker-identification, voiceprint, or other identity model.

9. WHATSAPP AND SMS PRACTICES

9.1 Separate Opt-In

A Subscriber's purchase does not by itself authorize WhatsApp or SMS messages. We separately request the mobile number, identify the sender, describe the message categories, and ask for confirmation before activating a Message Channel.

Consent is not a condition of purchase. A Subscriber may use Bloem through the account and email without Message Channel communications.

9.2 Messages and Frequency

Messages may include Story approval requests, publishing prompts and confirmations, asset delivery, post or campaign performance recaps, workflow summaries, recommendations, billing and renewal notices, outage or security notices, changes to terms, and responses to requests. Frequency varies with account, Submission, publishing, and performance activity.

9.3 Opt-Out and Help

Reply STOP to stop Bloem Message Channel communications. For SMS, other recognized words may include UNSUBSCRIBE, CANCEL, END, and QUIT. Reply HELP for assistance. A Subscriber may also change preferences in the account or email support@joinbloem.com.

An opt-out on one Bloem channel suppresses other Bloem messaging channels associated with the same account unless new consent is given. We may send one non-marketing opt-out confirmation. Stopping messages does not cancel a paid subscription.

We use a mobile number to provide the requested Bloem messaging workflow, administer consent and opt-out preferences, secure the account, and respond to requests. We do not sell a mobile number or disclose it to third parties for their own marketing. We may disclose it to service providers that deliver, route, secure, or support the messages.

Message and data rates may apply. WhatsApp, carriers, and messaging providers process information under their own terms and privacy policies.

9.5 Reassigned Numbers and Shared Devices

Subscribers should tell us promptly if a number changes. A reassigned number or shared device may expose Stories or account information to another person. We may use provider tools, delivery signals, and suppression records to reduce messaging to invalid, deactivated, or opted-out numbers.

10. COOKIES AND SIMILAR TECHNOLOGIES

We may use cookies, local storage, pixels, software development kits, analytics tools, and similar technologies for website functionality, preferences, security, measurement, analytics, and, where permitted, advertising.

Where required, we provide a cookie or privacy-choice control. You can also use browser settings to limit cookies, although some features may not work. If we are subject to a law requiring recognition of an opt-out preference signal, we will treat a legally recognized Global Privacy Control signal as an opt-out request for the browser or device sending it.

This section concerns website and online advertising technologies. It is separate from consent to receive marketing email, SMS, or WhatsApp messages, which is addressed in Sections 16.3 and 16.4.

11. HOW WE DISCLOSE PERSONAL INFORMATION

We may disclose personal information as follows.

11.1 Subscribers

The Contributor Terms and Subscriber Agreement allocate ownership of Captured Content to the Subscriber whose Capture Surface was used. We disclose and deliver Stories and associated information that Bloem makes available so the Subscriber can review, approve, download, publish, and use them. Ownership does not require us to disclose, deliver, preserve, or export every Submission, rejected or disqualified version, or internal screening record. Authorized users of that Subscriber account may see the Stories, Bloem Metadata, Connected Account information, performance data, and workflow history that the service makes available.

11.2 Service Providers and Subprocessors

We may use providers for cloud hosting, storage, content processing, artificial intelligence and model training or evaluation, analytics, security, support, messaging, telecommunications, payment processing, email, document management, publishing integrations, and professional services. They may process personal information only to provide services to us or exercise rights we grant them under contract, subject to safeguards appropriate to their role. We prohibit service providers acting for us from creating or retaining face-geometry templates, voiceprints, speaker signatures, identity embeddings, or other biometric identifiers for identification or authentication from Captured Content.

11.3 WhatsApp, Carriers, Messaging Providers, and Connected Platforms

When a Subscriber activates messaging, information is transmitted through WhatsApp, telecommunications carriers, aggregators, or messaging providers. When a Subscriber connects Meta, Google Business Profile, or another account, information is transmitted to and from that platform and may be processed by platform-authorized providers. Their independent processing is governed by their terms and privacy policies.

11.4 Business and Professional Advisers

We may disclose information to auditors, insurers, accountants, lawyers, and other advisers subject to confidentiality duties.

11.5 Legal, Safety, and Enforcement Purposes

We may disclose information when we reasonably believe it is necessary to comply with law or legal process; enforce agreements; investigate fraud, abuse, or security incidents; protect rights, safety, or property; or respond to a regulator or law-enforcement request.

11.6 Business Transfers

Information may be disclosed or transferred in connection with a merger, financing, acquisition, reorganization, bankruptcy, sale of assets, or similar transaction, subject to applicable law.

11.7 Public and Marketing Uses of Captured Content

Under the Contributor Terms and Subscriber Agreement, we may publicly display, distribute, publish, advertise, and otherwise use Captured Content in marketing and promotional materials for Bloem, Scale Social AI, their affiliates, and their products and services. Public audiences, advertising platforms, prospective customers, event participants, and other recipients may see the content.

We may disclose information when you direct us or consent.

We do not sell personal information for money in the ordinary sense. We do not sell Subscriber mobile numbers, Message Channel content, Connected Account credentials, raw Third-Party Platform Data, or Subscriber-specific Captured Content as a standalone asset.

Some state laws define "sale," "sharing," or "targeted advertising" broadly. The assignment and delivery of Captured Content to the applicable Subscriber, Scale Social AI's perpetual license and public marketing uses, disclosure to artificial-intelligence and content-processing providers, or website advertising and analytics technologies may fall within one of those definitions, even though the Contributor intentionally submitted the content under the disclosed terms and we do not receive a separate payment for the individual's personal information.

Where applicable law gives you a right to opt out, you may use either of these methods:

use the web form available through the Your Privacy Choices link in the footer of our website; or

email support@joinbloem.com with "Privacy Opt-Out" in the subject line and describe the request.

We will also process a legally recognized Global Privacy Control signal where required and technically applicable. A Contributor should include the submission reference so we can locate the relevant content.

This Section primarily concerns statutory sale, sharing, targeted-advertising, and online-tracking rights. It is not limited to marketing messages sent after a website visit. Direct email, SMS, and WhatsApp marketing choices are addressed separately in Sections 16.3 and 16.4.

An accepted Contributor restriction request is handled under Section 15 and may end specified future use of the applicable Story, subject to the limitations described there.

13. DATA RETENTION

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, including to provide Bloem, maintain rights and consent records, comply with law and platform requirements, resolve disputes, enforce agreements, and protect security.

Retention periods may include:

Subscriber account and billing information: for the subscription and afterward as required for tax, accounting, fraud prevention, dispute, and legal purposes;

WhatsApp and SMS records: message-thread content, including delivered Stories, attachments, and delivery links, and records of opt-ins, approvals, opt-outs, support routing, and cancellation requests for at least twenty-four (24) months, and longer if reasonably needed for legal, security, or dispute purposes;

Captured Content: for as long as reasonably useful for the purposes permitted by the Contributor Terms and Subscriber Agreement, which may be indefinite because the applicable ownership and Scale Social license are perpetual, subject to applicable law and any restriction we are required or agree to apply;

Bloem Metadata: for as long as reasonably useful for product development, artificial-intelligence and machine-learning training and evaluation, analytics, benchmarking, rights management, security, legal compliance, and other permitted business purposes, excluding raw Third-Party Platform Data and restricted platform-derived metrics;

Google Business Profile API content: only in limited amounts, securely, and for no more than thirty (30) calendar days unless Google's then-current terms expressly permit another period; stored Google API content is not manipulated or aggregated;

Meta Platform Data: while the enabled connection or feature requires it and afterward only for the period Meta's then-current terms or applicable law permit, subject to permitted security, fraud-prevention, transaction, audit, backup, and legal-retention records;

other Connected Account credentials and Third-Party Platform Data: while the connection is active and afterward only as long as permitted or required by platform terms, security needs, legal obligations, or dispute needs;

rights, consent, platform-authorization, publishing, and takedown records: as long as reasonably needed to demonstrate the scope and history of permission, honor restrictions, audit actions, comply with platform terms, and establish or defend legal rights, even if associated media or platform data is removed from active use;

support and privacy requests: for as long as needed to respond, document compliance, and resolve disputes; and

website and security logs: for periods appropriate to analytics, troubleshooting, fraud prevention, and security.

When a Subscriber disconnects Google Business Profile or ends the relationship, we provide a quick disconnection path and remove or relinquish management permissions within seven (7) Business Days or sooner if Google requires. When a Subscriber disconnects Meta, loses authorization, ends the feature, or makes a valid deletion request, we cease access and delete or de-identify Meta Platform Data as Meta's then-current requirements or applicable law require. We may retain our own permitted authorization, instruction, transaction, audit, security, and legal records, but those records do not extend our rights in raw platform data.

When retention is no longer necessary, we may delete, de-identify, or aggregate the information. Information may remain for a limited time in backups, disaster-recovery systems, legal holds, or records that cannot reasonably be isolated, but we will not use it for a new purpose while retained solely for those reasons.

14. SECURITY

We use technical and organizational measures designed to protect personal information, including encryption in transit using TLS 1.2 or higher, encryption at rest using AES-256 or an equivalent standard, role-based access controls, logging and monitoring, vulnerability assessment, personnel security training, and incident-response procedures.

No system is completely secure. Subscribers are responsible for securing their devices, credentials, email, Message Channel, Connected Accounts, authorized users, and downstream vendors. Do not send highly sensitive information through a general support email or message thread.

A Contributor may request that we review future use of a Story by emailing support@joinbloem.com with "Content Use Request" in the subject line and including the submission reference shown after submission. If the reference is unavailable, provide enough information to help us identify the Submission, such as the business, approximate date, and a description.

We will provide an initial substantive response by the end of the second Business Day after receiving a request that contains enough information for us to begin reviewing it. This is a response-time commitment, not a guaranteed resolution time.

The assignment to the Subscriber and Scale Social AI's license are perpetual. To the fullest extent permitted by law, they are irrevocable, so a request does not automatically revoke them. If applicable law requires a restriction, or if we agree to honor a request, we will stop the specified future public-facing, promotional, advertising, commercial, or other uses of the Story covered by the restriction and notify the applicable Subscriber. The Subscriber is contractually required to stop the affected use and remove copies it controls within five (5) Business Days after our notice.

After a restriction takes effect, we will not intentionally place, or direct a service provider acting for us to place, the identified source media into a new artificial-intelligence or machine-learning training or evaluation dataset. We cannot guarantee removal of:

reposts, screenshots, downloads, or copies outside our or the Subscriber's control;

uses completed before the request was accepted;

model parameters or weights, embeddings that do not permit retrieval of the source media, generalized learnings, analytics, or systems developed through permitted training or evaluation before the restriction;

information we must retain for legal, rights-management, security, fraud-prevention, platform-compliance, or dispute purposes; or

a Submission we cannot reasonably identify from the information provided.

The Contributor Terms explain the relationship among a request, the assignment to the Subscriber, Scale Social AI's license, artificial-intelligence training, and completed uses.

16. YOUR PRIVACY RIGHTS AND CHOICES

Depending on where you live and subject to legal exceptions, you may have the right to:

confirm whether we process your personal information;

access or obtain a copy of personal information;

correct inaccurate personal information;

delete personal information;

obtain portable data;

opt out of sale, sharing, targeted advertising, or certain profiling;

limit certain uses of sensitive personal information;

object to or restrict processing;

withdraw consent;

appeal a refusal of a privacy request; and

receive equal service and not be retaliated against for exercising a right.

16.1 How to Make a Request

You may submit a privacy request through the web form available from the Your Privacy Choices link in our website footer or by emailing support@joinbloem.com with "Privacy Request" in the subject line. State the right you wish to exercise and whether you are a Subscriber, Contributor, website visitor, or authorized agent. A Contributor should include the submission reference.

We may verify identity by matching information we already hold, requesting account authentication, confirming control of an email address or number, or requesting additional information appropriate to the sensitivity of the request. We will use verification information only for the request.

An authorized agent may submit a request where permitted. We may require proof of authority and direct confirmation from the individual unless the agent has a legally valid power of attorney.

We will respond within the period required by applicable law. If we deny a request, we will explain the basis where required and provide appeal instructions where applicable.

16.2 Limits and Exceptions

Rights may be limited where information is needed to complete a requested transaction, provide the service, protect security, prevent fraud, comply with law or platform requirements, maintain rights or consent records, exercise or defend legal claims, protect another person's rights, or satisfy another legal exception.

Deletion or opt-out rights concerning Captured Content are also subject to the Contributor Terms, the assignment to the Subscriber, Scale Social AI's perpetual license, applicable legal exceptions, completed uses, model-training and unlearning limitations, Bloem Metadata and rights records, and copies beyond our control. An accepted content-use restriction will stop new training-dataset ingestion of the identified source media as described in Section 15.

16.3 Marketing Choices

You may unsubscribe from marketing email using the link in the email or by contacting us. We send marketing SMS or WhatsApp messages only where we have the consent or other permission required by applicable law and platform rules, and you may opt out using the instructions in the message. A person who visits our website but does not subscribe may receive direct marketing only if the person provides contact information and we have the required permission to use it for that channel.

Service, security, billing, renewal, support, and legal communications are not marketing and may continue while relevant.

16.4 Message Channel Choices

A Subscriber or authorized user may reply STOP to stop Bloem WhatsApp or SMS communications or change preferences in the account. Stopping messages does not cancel a paid subscription. Reply HELP for assistance. Consent to Subscriber workflow messages is collected separately from checkout.

17. CALIFORNIA PRIVACY NOTICE

This Section supplements the policy for California residents and uses terms defined by the California Consumer Privacy Act, as amended ("CCPA"). It applies only to the extent we are subject to the CCPA for the processing at issue.

17.1 Categories Collected, Sources, Purposes, and Disclosures

In the preceding twelve (12) months, we may have collected the following categories:

Identifiers

Examples in Bloem: name, email, mobile number, account ID, IP address, submission reference.

Main sources: you, Subscriber, device, providers.

Business or commercial purposes: account, messaging, support, security, rights requests.

Categories of recipients: Subscriber where relevant, cloud, messaging, support, security, professional advisers.

Customer Records

Examples in Bloem: business contact and billing information.

Main sources: you, Subscriber, payment provider.

Business or commercial purposes: subscription, billing, support, compliance.

Categories of recipients: payment, accounting, cloud, support providers.

Commercial Information

Examples in Bloem: plan, payments, renewals, Offer and transaction records.

Main sources: you, Subscriber, payment provider.

Business or commercial purposes: provide service, billing, analytics, disputes.

Categories of recipients: payment, accounting, cloud, professional advisers.

Internet Or Network Activity

Examples in Bloem: browser, device, page and account activity, logs, Connected Account activity.

Main sources: device, cookies, Subscriber, platforms, providers.

Business or commercial purposes: functionality, publishing, analytics, security, troubleshooting.

Categories of recipients: hosting, analytics, security, integration, platform providers.

Geolocation

Examples in Bloem: approximate location from IP or file metadata.

Main sources: device, submitted file.

Business or commercial purposes: security, localization, content administration.

Categories of recipients: hosting, security, content-processing providers.

Audio, Electronic, Visual, Or Similar Information

Examples in Bloem: videos, voices, images, message and support content.

Main sources: Contributor, Subscriber, Message Channel.

Business or commercial purposes: document and administer ownership; screen, prepare, publish, market, support, and secure the service; and, for Captured Content, train and evaluate models.

Categories of recipients: applicable Subscriber, public marketing audiences, content-processing, AI, cloud, messaging, support providers.

Professional Or Employment Information

Examples in Bloem: title, role, business affiliation.

Main sources: Subscriber or authorized user.

Business or commercial purposes: account administration, support, marketing.

Categories of recipients: cloud, support, professional advisers.

Inferences

Examples in Bloem: workflow recommendations, quality, curation, fraud, and model-derived signals.

Main sources: activity, Captured Content, and Bloem Metadata.

Business or commercial purposes: screening, recommendations, product development, AI training and evaluation, analytics, security.

Categories of recipients: service providers supporting those functions.

Sensitive Personal Information

Examples in Bloem: account credentials and sensitive information incidentally included in a Submission or support request.

Main sources: you, device, content.

Business or commercial purposes: authentication, service delivery, security, content processing.

Categories of recipients: providers supporting those functions and the applicable Subscriber where included in a Story.

We may disclose each category for the business purposes described in Sections 6 and 11. We do not use or disclose sensitive personal information to infer characteristics about a person. We do not create biometric identifiers used to identify or verify a person.

We do not sell Subscriber mobile numbers, Message Channel content, Connected Account credentials, raw Third-Party Platform Data, or Subscriber-specific Captured Content as a standalone asset. The assignment and delivery of Captured Content to a Subscriber, Scale Social AI's perpetual license and marketing uses, disclosures to AI and content-processing providers, and website advertising or analytics technology may be treated as sale or sharing under a broad legal definition.

We do not knowingly sell or share personal information of anyone under 16 without the affirmative authorization required by applicable law. Because an adult may submit family content that includes a minor child, the adult's acceptance of the Contributor Terms does not substitute for a separate age-specific opt-in where applicable law requires one for a sale, sharing, or targeted-advertising use of the minor's personal information.

17.3 California Rights and Opt-Out Methods

Subject to exceptions, California residents may request to know, access, correct, or delete personal information; opt out of sale or sharing; limit qualifying uses of sensitive personal information; and receive non-discriminatory treatment.

You may use either the Your Privacy Choices web form or email support@joinbloem.com as described in Sections 12 and 16.1. Where required, we honor a recognized Global Privacy Control signal as a request for the browser or device sending it. These privacy-choice mechanisms concern statutory sale, sharing, targeted advertising, and online tracking; direct marketing-message choices are addressed in Sections 16.3 and 16.4.

18. OTHER U.S. STATE PRIVACY RIGHTS

Residents of states with comprehensive privacy laws may have similar rights, including access, correction, deletion, portability, opt-out, and appeal rights. Submit a request under Section 16.1. We will apply the law that governs the request.

19. INTERNATIONAL PROCESSING

We and our service providers may process information in the United States and other countries. Those countries may have different data-protection laws. Where required, we use appropriate transfer mechanisms, which may include contractual safeguards.

Bloem is designed for U.S. use. If applicable law in the European Economic Area, United Kingdom, or another jurisdiction applies, you may have additional rights and may contact us about the relevant transfer mechanism or supervisory authority.

20. CHILDREN

Bloem is a general-audience service, and Capture Screens may be used only by adults age 18 or older. A minor may not create a Bloem account, operate a Capture Screen, accept the Contributor Terms, or submit as the Contributor. An adult Contributor who is the parent or legal guardian of a minor may include that minor child in a family or customer Submission as the Contributor Terms permit. In that situation, we may process the child's image, likeness, appearance, voice, statements, actions, and other information appearing in the content based on the adult's representation of authority and subject to applicable law. We do not knowingly collect personal information directly from a child through Bloem. If you believe a minor submitted directly or appears in a Submission without appropriate parent or legal guardian authority, contact support@joinbloem.com with the submission reference or enough information to identify it. We will investigate and may remove, obscure, restrict, or otherwise address the content as appropriate.

21. THIRD-PARTY SITES AND SERVICES

Bloem may link to, connect with, publish to, retrieve data from, or otherwise interact with third-party sites and services, including WhatsApp, payment processors, Meta, Google Business Profile, social networks, advertising platforms, and review platforms. Their privacy practices are governed by their own policies. We are not responsible for their independent practices.

22. CHANGES TO THIS POLICY

We may update this policy. We will post the revised version with a new version date and provide additional notice where required or where a change is material. Prior versions are available on written request.

23. CONTACT US

For privacy questions, rights requests, or content-removal requests:

Email: support@joinbloem.com Mail: Scale Social AI, Inc., 4801 Glenwood Ave, Suite 500, Raleigh, NC 27612

General Subscriber support is governed by the two-Business-Day initial response commitment in the Bloem Master Service Agreement. For that support commitment only, a Business Day excludes Scale Social-recognized holidays. Formal privacy requests are handled within the time required by applicable law. Contributor content-use requests are handled under Section 15 above. The Your Privacy Choices web form must be implemented and linked from the website footer before relying on it as an opt-out method.