Privacy Policy

1. Introduction

IndieBloom AI ("IndieBloom," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform at indiebloom.ai (the "Platform").

By creating an account or using the Platform, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Platform.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, username, handle, and password when you register
• Profile Information: Bio, profile photo, links, social media handles, and location (optional)
• Payment Information: Processed securely by Stripe. We do not store your card details
• Content: Posts, comments, music uploads, artwork, and other content you submit
• Communications: Messages you send through the Platform or to our support team

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, time spent, and click patterns
• Device Information: Browser type, operating system, IP address, and device identifiers
• Log Data: Server logs including access times and error reports
• Cookies: Session management, authentication, and preference storage (see Section 7)

2.3 Information from Third Parties

• Google OAuth information if you sign in with Google
• Spotify account and listening data if you connect your Spotify account

3. How We Use Your Information

• To create and manage your account
• To provide, operate, and improve the Platform
• To process payments and transactions
• To send transactional emails (account confirmation, approval notifications)
• To send platform updates and newsletters (you may opt out at any time)
• To power AI tools and features you use on the Platform
• To detect and prevent fraud, abuse, and security incidents
• To comply with legal obligations
• To respond to your support requests

4. How We Share Your Information

We do not sell your personal information. We share information with the following service providers, each of which receives only what is needed for the stated function:

• Supabase: authentication, database, and file storage
• Lovable: application hosting and the AI gateway described in Section 5
• Google: Gemini AI, Maps and Places, Custom Search, Safe Browsing, and Calendar OAuth where you connect it
• OpenAI: content moderation and AI image generation
• Stripe: payment processing and tax calculation
• Resend: transactional email
• Twilio: SMS messages
• Spotify: where you connect your Spotify account
• YouTube Data API and Ticketmaster: public data lookups

These providers have their own privacy policies, which we encourage you to review.

We may also share information with:

• Other Users: Your public profile, posts, and content you share publicly on the Platform
• Legal Requirements: When required by law, court order, or to protect our legal rights
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with notice to you

5. AI and Automated Processing

The Platform's AI features are powered by third-party model providers:

• Lovable's AI gateway: Ronin, the specialist advisors, and most AI tools
• Google Gemini, called directly: contract analysis, grant finder, and sync scout
• OpenAI, called directly: content moderation and AI image generation

When you use an AI feature, the content you submit is transmitted to the relevant provider in order to produce a result. This includes text you type into tools, contract documents you upload, artist profile information used to personalise results, and messages you send to Ronin.

Your Ronin conversations are stored in your account, along with a running summary used to give Ronin context. They are retained until you delete them or close your account.

Outputs from AI tools — such as generated contracts, brand documents, one-sheets, cover art, and saved results — are saved to your account so you can return to them.

AI outputs may be inaccurate, incomplete, or misleading. Review them before relying on them. See our Terms of Service for the professional-advice disclaimer.

We do not use your content to train AI models ourselves. We do not make any representation about whether the third-party providers listed above use submitted content for their own model training; that is governed by each provider's own terms.

6. Data Retention

Account data is retained for as long as your account is active. AI conversation history and saved tool outputs are retained until you delete them or close your account. When an account is closed it enters a 30-day restore window before it is permanently removed. Some records may be retained where retention is required by law.

7. Your Rights and Account Deletion

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Delete your account and associated data
• Portability: Request your data in a machine-readable format
• Objection: Object to certain processing of your personal information
• Opt-out: Opt out of marketing communications at any time
• CCPA: California residents may opt out of the sale of personal information (we do not sell data)
• GDPR: EU/UK residents may lodge complaints with their local data protection authority

Deleting your account: Go to Account Settings and type DELETE to confirm. Your account is deactivated immediately and you have 30 days to restore it from the account restore page. After that window, your account data is permanently removed across the Platform.

Uploaded files: when the 30-day period ends, the files you uploaded (images, audio, video and documents) are erased from our storage as part of the same automated deletion process that removes your account data.

To exercise any other right, contact us at indiebloomai@gmail.com.

8. Cookies and Local Storage

We use cookies and browser local storage for authentication, session state, and application preferences such as saved settings and layout choices. Disabling them will prevent you from signing in and using the Platform.

Usage analytics are first-party: activity such as page views and feature usage is recorded in our own database and is not sent to a third-party analytics product. We do not use third-party advertising or analytics trackers, and there is no advertising network cookie on the Platform.

9. Age Requirement

The Platform is intended only for people aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we learn that a user is under 18, we will delete their account and their personal information. If you believe someone under 18 has provided us with personal information, please contact us at indiebloomai@gmail.com.

We collect your date of birth when you create an account, solely to confirm that you are 18 or over. It is kept private, is never shown on your profile, and is not shared with other users.

10. Security

We use encryption in transit (TLS), encrypted storage, database-level access controls, and encryption of stored third-party access tokens. However, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security of your information.

11. Security Incidents

If we become aware of a security breach affecting your personal information, we will notify affected users and the relevant supervisory authorities as required by applicable law.

12. International Transfers

Your information may be transferred to and processed in the United States and other countries. By using the Platform, you consent to such transfers. We ensure appropriate safeguards are in place for international transfers in compliance with applicable law.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the Platform. Your continued use of the Platform after changes become effective constitutes your acceptance of the updated policy. We will ask you to re-accept if changes are material.

14. Contact Us

For privacy-related questions, requests, or concerns: