Legal

Customer Data Protection Addendum

Last updated: July 1, 2026

This Customer Data Protection Addendum ("Addendum") supplements Bloom's Terms of Service, Privacy Policy, and any order form, pilot agreement, onboarding agreement, statement of work, or other written agreement that references this Addendum. If this Addendum conflicts with the Terms or Privacy Policy, this Addendum controls for Customer Data to the extent of the conflict unless a signed agreement expressly says otherwise.

Purpose

Restaurants trust Bloom with sensitive operating information. This Addendum explains Bloom's commitments for restaurant-owned data, including recipes, costing, supplier information, menu data, operational records, and other confidential restaurant materials.

Customer Data

"Customer Data" means restaurant, business, user, operational, menu, recipe, formula, preparation method, portioning, costing, margin, supplier, purchasing, inventory, invoice, order, sales, reporting, schedule, employee, guest, customer, configuration, onboarding, support, and similar data submitted to, uploaded to, entered into, generated through, or otherwise processed by Bloom for a customer.

Customer Data includes non-public recipes, prep instructions, build sheets, costing worksheets, supplier pricing, vendor lists, purchasing history, product mix, sales performance, standard operating procedures, training materials, and other proprietary restaurant operating information.

Customer Ownership

Customer retains all ownership rights in Customer Data. Bloom does not acquire ownership of Customer Data, recipes, costing, supplier information, menus, operating procedures, sales records, or other restaurant materials by receiving, hosting, processing, configuring, or supporting that data.

Customer grants Bloom a limited, non-exclusive license to host, process, transmit, display, back up, secure, troubleshoot, support, and use Customer Data only as needed to provide, configure, maintain, secure, support, and improve Bloom services for Customer; comply with law; enforce applicable agreements; and protect Bloom, Customer, users, and the Services.

Restricted Use

Bloom will not sell Customer Data. Bloom will not disclose Customer Data to another restaurant, competitor, or unrelated third party except as permitted by the Terms, Privacy Policy, this Addendum, Customer's instructions, a signed agreement, or law.

Bloom will not use a customer's recipes, formulas, prep methods, costing, supplier pricing, vendor lists, purchasing history, sales mix, margins, training materials, or other confidential operating information to operate, advise, benefit, or compete with that customer through another restaurant, food business, consultant, vendor, or Bloom-affiliated restaurant.

Bloom may use aggregated or de-identified information to operate, secure, analyze, benchmark, and improve the Services only if the information does not identify the customer, a restaurant location, a person, or reveal the customer's non-public recipes, formulas, costing, supplier pricing, margins, or proprietary operating procedures.

Confidentiality

Bloom will protect Customer Data as confidential information using reasonable administrative, technical, and organizational safeguards. Bloom may access Customer Data only for legitimate service, onboarding, support, security, troubleshooting, billing, compliance, legal, or customer-authorized purposes.

Bloom personnel, contractors, advisors, and service providers who access Customer Data must be subject to confidentiality obligations or professional duties that protect Customer Data from unauthorized use or disclosure.

Service Providers

Bloom may use service providers for hosting, authentication, storage, email, analytics, diagnostics, monitoring, support, billing, security, and similar operational needs. Bloom is responsible for selecting service providers that are reasonably appropriate for the Services and for limiting their access to what is needed for the services they provide to Bloom.

Service providers may process Customer Data only for Bloom's business and service purposes, according to their agreements with Bloom and applicable law.

AI and Automation

Bloom may use artificial intelligence, automation, extraction, classification, or recommendation features to help provide customer-authorized workflows, such as invoice extraction, data entry, reporting, support, setup, or operational assistance.

Bloom will not intentionally use identifiable Customer Data, recipes, formulas, costing, supplier pricing, margins, or proprietary operating procedures to train a third-party foundation model for general use unless Customer gives express written permission.

Security

Bloom uses safeguards designed to protect Customer Data from unauthorized access, loss, misuse, alteration, or disclosure. These safeguards may include tenant isolation, access controls, authentication, authorization checks, audit or diagnostic logging, backup practices, and cloud infrastructure security controls. No system is completely secure, and Bloom cannot guarantee absolute security.

Customer remains responsible for managing its authorized users, roles, devices, local networks, physical access, and account credentials.

Export and Deletion

Customer may request access, correction, export, or deletion of Customer Data by contacting Bloom at support@bloomplatform.app. Bloom may need to verify the requester's identity and authority before completing a request.

When a deletion request is approved, Bloom will delete or de-identify applicable Customer Data from active systems where reasonably possible. Some information may be retained where needed for legal, accounting, tax, audit, security, backup, fraud-prevention, dispute-resolution, contractual, or legitimate operational reasons.

Return or Destruction of Onboarding Materials

If Customer provides spreadsheets, documents, images, PDFs, messages, or other onboarding materials outside the Bloom application, Customer may request that Bloom return, delete, or destroy those materials after setup, subject to the retention limits in this Addendum and applicable agreements.

Legal Requests

Bloom may disclose Customer Data if required by law, valid legal process, or a lawful government or regulatory request. Where appropriate and legally allowed, Bloom may review, challenge, narrow, reject, or notify Customer about requests for Customer Data.

Changes

Bloom may update this Addendum from time to time. When Bloom makes changes, Bloom will update the "Last updated" date above. Material changes may also be communicated through the Services, by email, or by other reasonable means.

Contact

Questions about this Addendum can be sent to support@bloomplatform.app.