Last updated: November 3, 2026
This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Los Angeles SEO Inc., doing business as Bloomize (“Bloomize”) and the business or agency customer that uses the Service (“Customer”). It applies automatically to every paid and trial business account; no signature is needed. If you need a signed copy for your records, email [email protected].
For personal information contained in Customer Data (for example, names in reviews, contact counts or user details in connected accounts), Customer is the business (controller) and Bloomize is the service provider (processor). For account, billing and website usage data about Customer’s own users, Bloomize acts as an independent business as described in the Privacy Policy.
Bloomize processes Customer Data only to provide, secure and support the Service according to the Terms, this DPA and Customer’s documented instructions (including settings chosen in the app). Bloomize will not sell or share Customer Data, retain, use or disclose it for any other purpose, or combine it with data from other sources except as allowed by applicable law for service providers. Bloomize will tell Customer if it believes an instruction breaks the law.
Bloomize ensures that people authorized to process Customer Data are bound by confidentiality and access it only as needed to provide the Service or support requested by Customer.
Bloomize maintains appropriate technical and organizational measures, described on our Security page, including encryption in transit, encrypted storage of access tokens, hashed passwords, least-privilege access and read-only access to connected accounts.
Customer authorizes Bloomize to use the subprocessors listed on our Subprocessors page. Bloomize has written agreements with them that protect Customer Data at least as well as this DPA and remains responsible for their performance. Bloomize will update that page at least 30 days before adding a new subprocessor; Customer may object on reasonable data protection grounds, and if we cannot address the objection, Customer may cancel the affected Service and receive a refund of prepaid fees for the remaining period.
Bloomize will help Customer respond to requests from individuals exercising privacy rights (such as access, deletion or correction) and with reasonable compliance questions, taking into account the nature of the processing. If Bloomize receives such a request directly about Customer Data, it will refer the person to Customer.
On termination, or on Customer’s request, Bloomize will delete Customer Data within 90 days, except where retention is required by law. Before closing an account, Customer may request an export of its report data.
Bloomize will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a security incident affecting Customer Data, and will share the information Customer reasonably needs to meet its own notification obligations.
On reasonable written request, no more than once a year, Bloomize will answer security questionnaires and provide information needed to show compliance with this DPA.
Where Customer is an agency acting for its own clients, Customer confirms it has its clients’ authorization to connect their accounts and to instruct Bloomize under this DPA, and is responsible for passing on any required notices to its clients.
Customer Data is processed and stored in the United States. This DPA is governed by the same law as the Terms. If this DPA conflicts with the Terms, this DPA controls with respect to Customer Data.
