Privacy Policy

1. What data we collect

When you contact us or purchase a service: name, email address, and company name; brief and project requirements you submit; payment information (processed by Stripe — we never store card details); billing address.

When you use your GoBloom site or CMS: login credentials (email and password hash); content you create and publish; support desk submissions.

When you visit gobloom.me: IP address and approximate location; browser type, device, and operating system; pages visited, time on site, referral source; analytics data via Google Analytics 4; advertising identifiers and behavioural data via Meta Pixel and Google Ads tags.

2. How we use your data

We use your data to:

• Deliver the services you purchased and process payments
• Send transactional emails (receipts, project updates, support replies)
• Improve our service and fix technical issues
• Show you relevant advertisements on Meta (Facebook/Instagram) and Google after you visit our site (remarketing)
• Build lookalike audiences on Meta and Google using customer data, so we can reach people similar to our existing clients
• Comply with legal obligations

We do not sell your personal data to third parties.

3. Legal basis for processing

We process your personal data under the Singapore Personal Data Protection Act 2012 (PDPA). Where we serve customers in the European Economic Area, we rely on:

• Contract performance — to deliver services you have paid for
• Legitimate interests — to improve our service, prevent fraud, and conduct remarketing and lookalike audience advertising
• Consent — for non-essential cookies and advertising tracking, where required
• Legal obligation — where required by law

You may opt out of remarketing at any time (see Section 9).

4. Third parties we share data with

• Stripe — payments
• Cloudflare — hosting and CDN
• Google — analytics and advertising
• Meta — advertising

Customer data shared with advertising platforms for lookalike audiences is transmitted in hashed form only. We require all third parties to handle your data securely and in accordance with their own privacy policies.

5. Your website's data

When we build and host your website, your site visitors' data is stored on infrastructure we operate on your behalf. You are the data controller for your site visitors. We are the data processor. You are responsible for having an appropriate privacy policy on your own website.

6. Data retention

• Client data: retained for the duration of your subscription plus 7 years (Singapore financial record requirements)
• Analytics data: retained for 26 months in Google Analytics
• Support tickets: retained for 3 years after account closure
• Cancelled accounts: content and site files available for export for 30 days after cancellation, then permanently deleted

7. Your rights

Under the PDPA (and GDPR where applicable), you have the right to access, correct, or delete the personal data we hold about you; withdraw consent where processing is consent-based; and receive your data in a portable format.

To exercise any of these rights, email privacy@gobloom.me. We will respond within 30 days.

8. Data Protection Officer

The DPO function for GoBloom (2Stallions Pte. Ltd.) is provided through 2Stallions' designated DPO-as-a-Service. You can reach our DPO at dpo@gobloom.me.

9. Cookies and tracking

Our website uses the following types of cookies and tracking technologies:

• Essential cookies — required for login and session management. Cannot be disabled.
• Analytics cookies — Google Analytics 4 tracks pages visited, time on site, and traffic sources to help us improve the site.
• Advertising cookies — Meta Pixel and Google Ads tags record your visit so we can show you relevant ads on Facebook, Instagram, and Google after you leave our site. These tags also allow us to measure the effectiveness of our advertising campaigns.

To opt out of remarketing:

• Google: adssettings.google.com
• Meta: facebook.com/ads/preferences
• All platforms: youronlinechoices.com

You can also disable non-essential cookies via your browser settings. Note that opting out of advertising cookies does not opt you out of analytics.

10. Data security

We use Cloudflare infrastructure with encryption in transit (TLS) and at rest. Access to production systems is restricted to authorised personnel. If we become aware of a breach affecting your data, we will notify you within 3 days as required under the PDPA.

11. Changes to this policy

We will notify active clients by email of any material changes. Continued use of our services after changes constitutes acceptance.

12. Contact

Email: privacy@gobloom.me
Data Protection Officer: dpo@gobloom.me
2Stallions Pte. Ltd., 150 Beach Road, #35-01, The Gateway West, Singapore 189720