Privacy Policy

Bloom Agents is a managed AI voice and text agent platform operated by BrianBloom AI ("BrianBloom AI," "Bloom Agents," "we," "us," or "our"). This Privacy Policy applies to our websites, client portal, managed agents, support services, and related communications.

A business using Bloom Agents may collect information from its own customers and contacts through an agent we operate for that business. In that situation, the client business generally determines why the information is collected, and its own privacy notices may also apply. Contact that business directly about its specific practices.

• Contact and account information, including names, business details, email addresses, telephone numbers, roles, and login records.
• Consultation, onboarding, support, billing, service, and configuration information.
• Voice and messaging data, which may include call audio, recordings, transcripts, summaries, SMS and MMS content, attachments, delivery status, caller or recipient numbers, and timestamps.
• Agent and business information, including approved knowledge, scripts, routing rules, appointment details, contacts, and workflow instructions.
• Integration data you authorize us to access, such as selected email, calendar, file, CRM, telephony, or other connected-service information.
• Technical and usage data, including device, browser, IP address, event logs, diagnostic information, audit records, and service activity.

We use information to:

• provide, configure, test, monitor, secure, support, and improve Bloom Agents;
• answer calls and texts, route communications, book appointments, perform approved workflows, and provide requested agent functions;
• authenticate users, enforce permissions, isolate client data, prevent fraud or abuse, and maintain audit records;
• process requests, provide customer support, administer accounts, and communicate service or security information;
• meet legal, regulatory, carrier, Application-to-Person messaging, and contractual requirements; and
• send marketing communications where permitted and where any required consent has been obtained.

Bloom Agents uses automated and artificial-intelligence systems to understand and generate voice or text, summarize interactions, classify requests, and carry out approved actions. Communications may be recorded or transcribed when enabled by a client and permitted by law. Clients are responsible for configuring required notices and obtaining any legally required consent from callers, recipients, employees, and other participants.

AI output can be incomplete or inaccurate. We use safeguards and human review processes, but clients and users should verify important information before relying on it for legal, medical, financial, safety-critical, or similarly consequential decisions.

Bloom Agents supports Application-to-Person (A2P) SMS and MMS for consultation follow-up, onboarding, appointments, account and support updates, security alerts, client-deployed agent conversations, and marketing where separately authorized. Message frequency varies. Message and data rates may apply. Consent to receive texts is not a condition of purchase.

You may opt out at any time by replying STOP. After opting out, you may receive one confirmation message. Reply HELP for assistance or email support@brianbloomai.com. Carriers are not liable for delayed or undelivered messages.

We do not sell or rent mobile telephone numbers or SMS opt-in information. We do not share SMS consent with third parties or affiliates for their own marketing. We may disclose it to communications providers and service providers solely to deliver and support the messaging program, comply with law, prevent abuse, or honor your choices.

When a business client connects a Google account to Bloom Agents, we access only the Google data the account holder authorizes and that is needed for the features the client has enabled. Depending on those features, this may include Google account and profile information, Gmail data, Google Calendar data, Google Drive data, and Google Sheets data.

Google data we access and why

• Account and profile information (openid, https://www.googleapis.com/auth/userinfo.email, https://www.googleapis.com/auth/userinfo.profile) — your name, email address, and basic profile, used to identify which Google account is connected.
• Gmail (https://www.googleapis.com/auth/gmail.readonly, https://www.googleapis.com/auth/gmail.compose, and https://www.googleapis.com/auth/gmail.send where authorized) — accessed only for authorized email functionality. This may include sender details, subject lines, message content or excerpts, and conversation context. We use it to organize business email, assess priority, prepare summaries and reply drafts, and execute approved email workflows. Drafted replies are sent only after approval through an authorized client channel. Limited Gmail excerpts and AI-generated drafts may be stored in our application database where needed to provide these features.
• Google Calendar (https://www.googleapis.com/auth/calendar.events, https://www.googleapis.com/auth/calendar.calendarlist.readonly) — authorized Calendar information may include event titles, dates, times, availability, and appointment details. We access calendar lists so operators can select which calendar to use, and access events for scheduling, calculating scheduling availability from authorized calendar events, appointment booking, updates, cancellations, reminders, and voice-agent scheduling.
• Google Drive and Google Sheets (file-specific access only) (https://www.googleapis.com/auth/drive.file) — Bloom Agents cannot browse or access a user's entire Google Drive. All file and spreadsheet access is strictly per-file under the drive.file scope. Files and spreadsheets must be explicitly selected by the user through the interactive Google Picker, or created directly by Bloom Agents (such as an application-created bookings spreadsheet or customer receipt folder). Bloom Agents uses this permission solely to read or update the selected spreadsheet or save receipts to the designated folder. Drive and Sheets content is not sent to any third-party AI model.

AI service providers and Google user data

Some features use outside AI services that act only on our behalf:

• Lovable AI Gateway. Bloom Agents uses the Lovable AI Gateway, operated by Lovable, to run certain AI features. Certain authorized Gmail and Calendar information may pass through this service so the AI can process it.
• OpenAI. The Lovable AI Gateway currently sends certain requests to OpenAI models. Authorized Gmail information, such as the sender, subject and message excerpts, may be processed to sort email, summarize it and draft replies. Authorized Calendar information may be processed so the assistant can give scheduling and context-aware answers.
• ElevenLabs. Bloom Agents uses ElevenLabs for voice conversations. When a client's authorized scheduling or phone features need it, the voice agent may receive information drawn from Google Calendar, such as event titles, appointment times, availability, agenda details and booking results, along with the names of the relevant people or accounts. Bloom Agents does not currently send Gmail message content, Google Drive content or Google Sheets content to ElevenLabs.

We send these providers only the information a request needs. Bloom Agents does not use Google Workspace API user data to train generalized AI models, and we configure third-party AI processing in accordance with the applicable Google Limited Use requirements and the privacy and data-control settings each provider makes available to us. We do not state that a provider never uses transmitted data for model training: each provider's own terms, tier and account configuration determine what it may do with that data, and we describe those settings here only as we have verified them for our own accounts.

Limited Use

Bloom Agents' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Bloom Agents does not use Google Workspace API user data to develop, improve, or train generalized AI or machine-learning models.
• Bloom Agents does not sell Google user data.
• Bloom Agents does not use Google user data for advertising.
• Bloom Agents does not transfer Google user data to data brokers.
• We share Google user data only with the business client that authorized the account, its authorized users, and the service providers named or described in this policy, solely to provide the service.

How long we keep Google data

• Temporary processing: most Calendar, Drive and Sheets data is read when a feature needs it and is not copied into our database.
• Stored Gmail excerpts and drafts: short Gmail excerpts (up to 2,000 characters) and AI-generated drafts are kept in our database so the client can review and approve them. They are kept until the client asks us to delete them or the client's account ends. We do not currently delete them automatically after a set period.
• Calendar and booking records: appointments booked through Bloom Agents are kept as part of the client's records until deleted at the client's request or when the client's account ends. Events in Google Calendar stay in the user's own Google account.
• OAuth credentials: access and refresh tokens are kept only while the account stays connected. Disconnecting the account in the portal revokes them with Google and stops the related features. You can also remove access in your Google Account security settings.
• Deletion on request: to ask us to delete Google-derived data, email support@brianbloomai.com.
• End of account: when a client's service ends, the client can disconnect its Google accounts, which revokes our tokens, and can ask us to delete the related Google-derived data. We delete it unless the law requires us to keep it.
• Demo accounts: when a demo ends, a demo reset deletes the prospect's demo activity, including messages, bookings and email drafts, revokes the demo Google connection, and removes the temporary demo login.

How we protect Google data

Google OAuth credentials are stored only on our servers, encrypted at rest, and never shown to client browsers, client users or message recipients. Each connected Google account belongs to a single client. Access is limited to that client, Google data is never available to other clients, and access to Google data is recorded in audit logs.

We may share information only as reasonably necessary with:

• the Bloom Agents client on whose behalf an agent communicates and its authorized users;
• service providers that support hosting, communications, email, calendars, AI processing, storage, security, analytics, support, and payment operations;
• professional advisers, auditors, insurers, or transaction counterparties subject to appropriate obligations; and
• government authorities or other parties when required by law or necessary to protect rights, safety, security, and platform integrity.

We do not sell personal information for money.

If you authorize a connected service, we access only the permissions and resources needed for approved workflows. Separate authorizations are maintained for separate accounts. Connected providers operate under their own privacy policies. You may disconnect a service, although doing so may stop related agent functions.

We use administrative, technical, and organizational safeguards designed to protect data, including access controls, tenant isolation, encrypted credentials, audit logging, and restricted production access. No method of storage or transmission is completely secure.

We retain information for as long as reasonably needed to provide services, meet contractual and legal obligations, resolve disputes, maintain audit and security records, and enforce agreements. Retention may vary by data type, client instructions, connected provider, and law.

Depending on where you live, you may have rights to request access, correction, deletion, portability, restriction, or information about processing. You may withdraw consent where consent is the basis for processing. We may need to verify your identity and may retain information where required or permitted by law.

To make a privacy request, email support@brianbloomai.com. If your information was collected by a Bloom Agents client, contact that business first so it can direct the request appropriately.

Bloom Agents is intended for businesses and is not directed to children under 13. We may update this policy to reflect changes in our services, practices, or legal obligations. The effective date above shows the latest revision. This policy was revised on October 7, 2026 to reflect file-specific Google Drive and Sheets access and narrower Google Calendar permissions.

Questions may be sent to BrianBloom AI at support@brianbloomai.com. Please also review our Terms of Service.