Who we are and scope
Bloom is a software service provided under the Plainspoken brand. Plainspoken is a trading brand operated by [LEGAL_ENTITY_NAME], registration number [COMPANY_REGISTRATION_NUMBER]. In these documents, 'we', 'us' and 'our' mean [LEGAL_ENTITY_NAME] trading under the Plainspoken brand. 'Bloom' means the Bloom software service, website, applications and associated services. This policy covers Bloom account holders, website visitors, business contacts and people whose information is entered in Bloom. For account, billing, support and security data we determine purposes and generally act as responsible party. For salon-client records the salon usually determines purposes and we process on its behalf as operator, subject to the DPA and law. Contact the salon first about its client records; we will assist it.
Information we handle
Account names, email, phone, business and staff details; appointments, service and treatment history, client notes and communication preferences; transaction and subscription records; support messages; IP addresses, device and authentication events, audit records, essential cookies and service usage. Some salon notes may contain sensitive information, which salons must enter lawfully and only as needed. PayFast handles subscription card entry; Bloom stores payment and provider references, not full card numbers. We do not use optional analytics or advertising trackers in the current application.
Why we process information
We use information to create and authenticate accounts, deliver appointments and other workflows, send necessary service and security messages, bill subscriptions, prevent abuse, assist users, comply with legal obligations and improve reliability. The applicable POPIA justification may be consent, performance of a contract, a legal duty, protection of a legitimate interest or another lawful ground, depending on context. Salons determine the lawful basis for their client records and messages.
Communications and marketing
Security, payment, booking and critical service messages are service communications. Marketing by us is separate and sent only where law permits; account holders can opt out in Privacy & Data settings or through a message's unsubscribe route. Salon-directed client messaging is the salon's responsibility. Bloom records client communication preferences and must not treat a previous opt-out as fresh consent.
Cookies and storage
We use session and CSRF cookies needed for sign-in and security, and a service worker cache for static app files. There are no optional analytics or marketing cookies in this deployment, so there is no consent banner. See the Cookie Policy for names, purposes and lifetimes.
Sharing and transfers
Access is limited to authorised staff and service providers as needed. The deployed hosting and email services depend on the operator's configuration; the Subprocessor List records verified providers. PayFast receives subscription payment details when checkout is used. We may disclose records to advisers, regulators or law enforcement where lawfully required. If information moves outside South Africa, we assess the destination and use safeguards required by POPIA; the location of each deployment must be checked before publishing a specific claim.
Security and incidents
The application uses password hashing, access checks, tenant-scoped queries, CSRF protection, private media routes, audit events and production HTTPS/session-cookie settings. We use backups and access controls as described on the Security page. No system is risk free. We investigate suspected compromises, notify business customers promptly when their data is involved, and make regulator and data-subject notifications where POPIA requires.
Retention and rights
We keep data for service use and lawful records, then delete or de-identify it as set out in the Data Retention Policy. You may request access, correction, deletion where lawful, object to processing or direct marketing, withdraw consent where relied upon, or ask what records we hold. Send requests to privacy@plainspoken.co.za; we may verify identity and coordinate salon-client requests with the responsible salon. You may complain to the South African Information Regulator at https://inforegulator.org.za/.
Children and automated decisions
Bloom accounts are for adults running businesses. Salons may record appointments for minors only where they have lawful authority and must minimise those details. Bloom does not make decisions with legal or similarly significant effects solely by automated processing. We will publish and notify material policy changes as appropriate.