Privacy Policy | Bloomorbit

Legal

Privacy Policy

Last updated: 6 July 2026

Draft — review needed before launch. This document was last updated on 6 July 2026. We recommend reviewing it with a UK solicitor before publishing.

Who we are

Bloomorbit Ltd (Company No. 17147666) is registered in England and Wales, with its registered office in Cardiff, Wales. We design and build websites, client portals and AI workflows for UK businesses.

For any data-protection enquiry contact hello@bloomorbit.tech.

What we collect

When you interact with bloomorbit.tech we may collect the following information:

  • Contact form submissions: name, email, phone (optional), message, business type.
  • Audit form submissions: name, email, website URL, business type, primary concern.
  • Chat conversations: messages you send to the on-site chat widget, and your email address if you choose to share it.
  • Pageview analytics: path, referrer, viewport size, UTM parameters and an irreversibly hashed IP address. We do not store raw IP addresses.
  • Cookies: bloomorbit_session — strictly-necessary, HttpOnly admin authentication cookie set only when an authorised user signs into the admin portal.

Lawful basis

We process contact, audit and chat enquiries on the basis of legitimate interest in handling your enquiry and replying to you. Where consent is required (for example, marketing communications), we ask for it explicitly.

Retention

  • Contact and audit submissions: retained for 24 months from receipt.
  • Chat conversations and captured email addresses: retained for 12 months.
  • Pageview analytics: retained for 12 months in aggregate form.

Your rights under UK GDPR

You have the right of access, rectification, erasure, restriction, portability and objection in respect of your personal data. To exercise any of these rights, email hello@bloomorbit.tech with your request and we will respond within one calendar month.

Third parties

We use the following third parties to operate the site. Each is named here for transparency; no data is shared with them beyond what is necessary to deliver the stated function.

  • Resend (transactional email delivery, EU/US transfer under Standard Contractual Clauses).
  • OpenAI (chat reply generation, US transfer under Standard Contractual Clauses).
  • Cloudflare Turnstile (spam protection on public forms, US/EU).
  • Vercel (frontend hosting, US/EU).
  • Railway (backend application hosting, US/EU).
  • MongoDB Atlas (database, EU region).

Cookies

Analytics cookies (only set if you accept)

If you accept analytics cookies via our cookie banner, we use Google Analytics 4 to measure how visitors use the site so we can improve it. Google Analytics is provided by Google Ireland Ltd.

CookiePurposeRetention
_gaDistinguishes unique visitors2 years
_ga_LS2ENLK32YPersists session state for our Google Analytics property2 years

IP anonymisation is enabled, so your full IP address is never recorded by Google Analytics. We do not use Google Analytics for advertising or remarketing.

How consent works

The site loads with Google Consent Mode v2, and every ad and analytics category is denied by default. No analytics cookie is set until you make a choice on the cookie banner.

You can change your choice at any time by clicking Cookie settings in the site footer. Selecting "Reject non-essential" stops analytics cookies being set on future visits and prevents any further data being sent to Google Analytics from your browser.

Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the UK Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/. We would encourage you to contact us first so we can try to resolve the issue directly.