Privacy Policy

Effective July 23, 2026

Bloomly is a Shopify app built and operated by Nehemiah Apps ("Nehemiah Apps," "we," "us"). This policy describes the personal data Bloomly processes when a merchant installs it on their Shopify store, why we process it, and the rights available to the people that data belongs to.

Bloomly is installed by merchants ("you," the merchant) to manage their own customers' orders. In most cases, the merchant is the data controller and Nehemiah Apps acts as a data processor on the merchant's behalf — see our Merchant Data Protection Agreement for that relationship.

What personal data we process

Bloomly captures the following as part of its core function — adding structured recipient details to flower orders and printing gift cards:

Recipient details: name, phone number, delivery address type, delivery instructions, pronunciation notes, and a "safe place" note, entered by the buyer at checkout.
Card message: the text the buyer writes for the card, and the sender's name (or an anonymous flag).
Sender's phone number: collected only to detect and warn when it matches the recipient's number (a common checkout mistake), so the correct number reaches your delivery driver.
Order context: occasion, substitution permission, and delivery date.
Merchant-defined custom fields: any additional field a merchant has chosen to add to their own field templates (e.g. ribbon color, vase style).
Video greeting links or uploads: an optional link the buyer provides, or a video a merchant uploads on the buyer's behalf, turned into a scannable QR code on the printed card. Uploaded video files are stored in the merchant's own Shopify Files, not on Nehemiah Apps' servers.
Buyer identity: for merchants who use the occasion-reminder feature, we store the buyer's Shopify customer ID, email, and name, so a repeat occasion (like a birthday) can be recognized across multiple orders from the same buyer.

We process only the data required to provide the above functionality — we do not collect browsing behavior, run advertising, or build profiles for any purpose beyond order fulfillment and the specific features described here.

How we use this data

To render the recipient-details form on the merchant's product pages and carry those details into the resulting order.
To display order details to the merchant so they can prepare and print gift cards and production worksheets.
To run pre-print checks that catch common mistakes (a missing phone number, an over-limit message, a sender/recipient number match) before anything is printed.
To generate a QR code linking to a branded video-greeting page, when a video link is provided.
To surface a list of buyers with a recurring occasion coming up soon, for merchants who want to reach out manually — Bloomly never sends this outreach automatically.
If a merchant explicitly uses the spelling/language-checking or translation feature, the card message text is sent to Anthropic's API to generate a suggestion, which the merchant must review and approve before it's ever used — the buyer's original message is never modified automatically or overwritten.

We never sell personal data, and we never use it for advertising or marketing on our own behalf.

Data retention

Recipient phone number, card message, and any custom field values are automatically deleted 90 days after an order is marked Completed in the merchant's dashboard.

Buyer identity (customer ID, email, name) used for occasion reminders is retained longer than 90 days by design — recognizing an annual occasion requires roughly a year of order history. This is a deliberate, purpose-limited retention period, not indefinite storage: an explicit deletion request (see below) removes it immediately regardless of how recently it was collected.

Data sharing

We share personal data only as needed to provide the service:

Shopify — as the platform the app is built on; order and customer data originates from and flows through Shopify's systems.
Our hosting provider — where the app's database and server run.
Anthropic — only the card message text, and only when a merchant explicitly triggers a spelling-check or translation action.

We do not share personal data with any other third party, and we do not sell it.

Security

All data in transit between the buyer's browser, the merchant's admin, and our servers is encrypted (HTTPS/TLS). Recipient and sender details, card messages, and buyer identity are also encrypted at rest in our database. We apply security measures appropriate to the nature of the data we process, but no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Third-party services

Bloomly operates on top of Shopify's platform and relies on the subprocessors described above. We are not responsible for the independent privacy or security practices of Shopify or any other third-party service not operated by us, and we encourage you to review their own policies.

International data

Nehemiah Apps is based in the Philippines, and personal data processed through Bloomly may be stored or processed there and in other countries where our hosting provider or other subprocessors operate. By using or interacting with Bloomly, you acknowledge that your data may be transferred to and processed in countries with data protection laws different from those in your own country, to the extent permitted by applicable law.

Your rights

Bloomly implements Shopify's mandatory data protection webhooks:

Data request — a customer can ask the merchant for a copy of the data Bloomly holds about them.
Redact (customer) — a customer can request deletion of their recipient and buyer-identity data; this is processed immediately, overriding any longer retention period described above.
Redact (shop) — if a merchant closes their store, their shop's data is handled per Shopify's redaction schedule.

Depending on where you're located, you may have additional rights under applicable law (for example, the Philippine Data Privacy Act of 2012 for data processed in the Philippines, or the GDPR for data originating in the EU/UK) — including the right to access, correct, or object to the processing of your personal data. To exercise any of these rights, contact the merchant you ordered from directly, or reach us at support@nehemiahapps.com and we'll assist.

Children's privacy

Bloomly is not directed at children and we do not knowingly collect personal data from children.

Changes to this policy

We'll update the effective date above if this policy changes, and post the updated version at this same address. Continued use of the app after a change takes effect constitutes acceptance of the updated policy.

Governing law

This policy is governed by the laws of the Republic of the Philippines, without regard to conflict-of-law principles, except where applicable data protection law requires otherwise for data originating outside the Philippines.

Contact

Nehemiah Apps
support@nehemiahapps.com