Last updated: November 3, 2026

Your Google, website and marketing data is important. Here is how Bloomize protects it.

Read-only by design

Bloomize asks for the minimum access it needs to build your reports, and never posts, edits or deletes anything in your Google, Business Profile, analytics or email accounts. You can disconnect any service at any time, in Bloomize or in that service’s security settings, and we stop collecting new data immediately.

Protecting your data

Encryption in transit: all pages and data transfers use HTTPS (TLS).
Encrypted tokens: the access tokens for accounts you connect are stored encrypted (AES-256), never in plain text.
Passwords: stored only as one-way hashes. We cannot see your password.
Payments: handled by Stripe, a PCI DSS Level 1 certified provider. Bloomize never sees or stores your full card number.
Separation: each business’s data is separated by account, and users only see the businesses they are linked to.
Limited access: only authorized team members can access production systems, and only when needed to run or support the Service.
Network protection: Cloudflare and server firewalls filter malicious traffic, and logins are rate-limited.
Updates: servers and software are kept up to date with security patches.

Your part

Use a strong, unique password for Bloomize.
Invite team members as separate users instead of sharing a login.
Turn on 2-step verification for the Google account you connect.

Report a vulnerability

If you believe you’ve found a security issue, please email [email protected] with the subject “Security” and details of the issue. Please don’t access other people’s data or disrupt the Service while testing. We’ll reply as quickly as we can.

More details: Privacy Policy · Data Processing Addendum · Subprocessors