Privacy Policy

This site is operated by Bloombilt LLC, a Minnesota limited liability company. We've kept this short and in plain language. If anything's unclear, email hello@bloombilt.com.

Who we are

Bloombilt LLC. Minnesota LLC, file #1647899600022. Registered agent: Northwest Registered Agent, Owatonna, MN. For all privacy questions: hello@bloombilt.com.

What we collect from site visitors

This section covers visitors to bloombilt.com. If your business uses one of our products, we also process data on your behalf. That's covered separately under Customer product data below.

Information you send us. When you fill in the contact form or email hello@bloombilt.com, we receive the name, email address, and message you submit. We use this to reply to you and to manage the engagement if you become a client.

Aggregate analytics. We use Cloudflare Web Analytics to count page views and referrers in aggregate. It does not set cookies, does not fingerprint browsers, and does not collect IP addresses we can tie back to you.

Usage analytics and session recording. We also use PostHog to see how people use the site: the pages you open, what you click, where you came from, your browser and device, and your rough location (city and country, worked out from your IP address). PostHog also records the visit itself (scrolling, clicks, and what's on the screen), and that includes what you type into the contact form, even if you don't send it. A PostHog cookie tells one visit from the next. We use this to find the parts of the site that confuse people and fix them.

Server logs. Cloudflare keeps standard request logs (IP, user agent, timestamp) for a short window for security and abuse prevention. We don't combine these with any other data.

What we don't collect. No advertising cookies, no pixel tags, and nothing sold or shared for advertising.

How we use it

• To reply to your enquiries and run the engagement if you hire us
• To improve the site (analytics and session recordings)
• To meet legal and tax obligations

We don't sell your data. We don't share it for advertising.

Who processes site-visitor data for us

We use a small number of vendors for the site itself. Each one is contractually bound to handle data per our instructions. (For the vendors involved in delivering our products to customers, see Customer product data below.)

• Cloudflare: hosting, CDN, DNS, analytics, edge security
• PostHog: usage analytics and session recording, stored in the United States
• Resend: sending and receiving transactional email on bloombilt.com
• GitHub: code repository (not visitor data)

Customer product data

If your business uses one of our products, we process data on your behalf as part of running it. This is separate from the site-visitor data above and is governed by our service agreement with you.

What we process. Lead data captured by the AI intake (caller name, callback number, address, and the nature of the request), call recordings and transcripts where applicable, content you provide for your website (logos, photos, copy, team information), and the operational records you keep in our apps (clients, properties, jobs, schedules, crew assignments, and job photos).

Accounting integrations. If your business connects QuickBooks Online, we access your QuickBooks data only with your authorization, through Intuit's official interfaces. We read your customer list and service items to link them to records in our apps, and we create and send invoices you ask us to create. We store the connection tokens encrypted, and we don't pull anything we don't need for those features. We use this data solely to provide the product to you; we act as an independent business and don't process it on Intuit's behalf. We never sell it or share it with anyone other than the subprocessors that run the product. If you disconnect QuickBooks (from our app or from Intuit's side), we stop accessing it immediately, delete the connection tokens, and delete the QuickBooks-sourced records on request.

Protection. Encrypted in transit (TLS 1.2 or better) and at rest, isolated from every other customer, and protected with reasonable administrative, technical, and physical safeguards.

No AI training. We don't use your lead data, call recordings, transcripts, or content to train AI or machine-learning models. The third-party AI services we use to deliver our products have confirmed they don't either.

Subprocessors. In addition to the site-visitor vendors above, we use third-party services for telephony, AI inference, hosting, error monitoring, usage analytics and session recording (PostHog, see below), email delivery, and accounting integrations (Intuit, for QuickBooks Online) to run our products. A current list of those subprocessors and the data each one processes is available on request, and we give customers reasonable notice before adding or replacing a material subprocessor.

Sensitive data. Our products aren't designed for health, biometric, financial-account, or government-identification data, and customers agree not to submit it through the AI services.

After an engagement ends. Customers can export their lead data as a CSV on request. We then delete it after a short retention window so there's time to migrate, except for routine backups that we don't access for any other purpose.

The Bloombilt Dispatch mobile app

Bloombilt Dispatch is the phone app crews use when their employer runs their schedule on our Dispatch product. The employer is the one who decides what goes into the system; we process it on their behalf, same as the rest of the customer data above. This section spells out what the app itself touches on a worker's phone.

Location. The app uses location while a worker's day is running: from the tap on Start day until the tap on End day, and never outside that window. What it's for: working out how long each job took without the crew pressing anything on each stop, and tying proof photos to the right property. The office sees the time per job that comes out of it. No screen in the product shows a live map of where a worker is.

On iPhone, the app draws a circle of about 150 meters around each of the day's stops when the day starts and asks iOS to say when the phone arrives at or leaves one. That is what powers the crew member's own day: when they pull up, that stop's timer starts and a note puts the gate code and job notes a tap away, and once they are about 400 meters from a stop they haven't finished, a reminder asks whether they left and to add the proof photo. It is why the app asks for "Always" location access: the arrival has to be noticed with the phone in a pocket. Nothing is recorded between stops, and no trail of where the phone went is kept; what is stored is the time of each arrival and departure, which is also where the time per stop comes from, and those records are deleted after 30 days. The circles are removed at End day.

On Android, the app runs a location service with a visible notification for the length of the work day and takes a reading about every 40 meters of movement, so a parked phone records nothing. It asks only for "While using the app" access; the notification is what keeps it running with the screen off. Our server discards any reading that arrives outside a running work day. The raw readings are permanently deleted after 30 days; the per-job times worked out from them stay with the job record. The same readings start a stop's timer when the crew pulls up to it, and ask whether they left once they are about 400 meters away.

On either phone, a worker can say no to location, or allow it only while using the app, and the app still works; only the automatic time on each job is lost, and on iPhone the reminders that come with it.

Photos and videos. Proof photos, and site-walk videos with sound, that a worker takes (or attaches from their photo library) are uploaded to the employer's account and shown to the office. The app only accesses photos the worker picks or takes; it doesn't scan the library. The microphone is used only while recording a video, or a voice note in Send feedback after the person taps record.

Send feedback. A crew member on the phone, or an owner or dispatcher on the web, can send us a typed message, a voice note, and a screenshot they pick. It comes to Bloombilt, not to their employer, by email at dispatch@bloombilt.com, with their name, company, role, app version, device, and the screen they sent it from, so we can reply and fix what went wrong. We keep it the same way as contact form submissions (see How long we keep it).

Who the worker is. The app knows a worker's name, email address, and work phone number because their employer put them in the system and invited them. Sign-in runs on Clerk, our authentication provider.

Face ID and Touch ID. Unlocking the app with Face ID or Touch ID happens entirely on the phone through Apple's own mechanism. Biometric data never reaches us, and we couldn't read it if we wanted to.

Notifications. If a worker allows notifications, we store the device's push token so the office's schedule updates can reach them. That's the token's only use. The iPhone app's arrival and leaving reminders described above are made on the phone itself and send nothing to us.

Crash reports. If the app crashes or hits an error, a report goes to Sentry, our crash-reporting provider, with the device model, OS version, what the app was doing at the time, and who it happened to (their account ID, name, role, and company), so we can fix it and reach the right person. It doesn't include the worker's email or any location readings.

Usage analytics and session recordings. The app sends PostHog a record of the screens a worker opens and what they tap, and a recording of the screen with typed text, photos, and customer details hidden. What's collected, who sees it, and how to opt out are under Usage analytics and session recordings in Dispatch below.

What's not in the app. No ads, no advertising or tracking SDKs, and nothing is sold or shared for advertising. Besides our own servers, the only third parties the app itself talks to are Clerk for sign-in, Expo for app updates and push notifications, Sentry for crash reports, and PostHog for usage analytics and session recordings.

Retention and deletion. Work records (stops, photos, videos, and the per-job times worked out from location) belong to the employer's account and follow the retention terms above; the raw location readings themselves are deleted after 30 days as described under Location. Workers who want their data corrected or deleted can ask their employer, or email us directly at hello@bloombilt.com and we'll help within 30 days.

Usage analytics and session recordings in Dispatch

We watch how people use Dispatch so we can see where someone got stuck, fix it, and reach out to help. This covers the web app at dispatch.bloombilt.com and the Dispatch phone app. It runs on PostHog, our product analytics provider, which stores the data in the United States.

What's collected. The pages and screens someone opens, what they click or tap, clicks that do nothing or get repeated in frustration, the device, browser or app version, and rough location (city and country, worked out from the IP address). Each session is tied to the person's Dispatch account, with their name, role, and company, so we know whose session we're looking at.

Session recordings. On the web, we record the sessions of owners and dispatchers once they've signed in. Public pages and the sign-in page are never recorded. On the phone app, we record the app's screens. In both, anything typed into a field is hidden before the recording leaves the device, and so are customer names, addresses, and phone numbers. On the phone, photos are hidden too. A recording shows where someone tapped and what the screen looked like, not what they typed.

Who sees it. Only Bloombilt staff. We use it to fix problems and to help the person who ran into one. We don't use it to judge anyone's work, we don't sell it, and we don't use it for advertising.

How long we keep it. Recordings are deleted after 90 days at most. The record of pages, screens, and clicks is kept as long as our analytics provider keeps it.

Saying no. If you don't want your sessions recorded, or want the recordings of you deleted, email hello@bloombilt.com. We'll stop recording your account and delete what we have within 30 days.

Legal basis (for visitors in the EU/UK)

• Contact form submissions: processing is necessary to respond to your request and, if you become a client, to perform the contract.
• Aggregate analytics: our legitimate interest in understanding how the site is used. Cloudflare's analytics are cookieless.
• Usage analytics and session recording: our legitimate interest in finding and fixing the parts of the site that don't work for people.
• Server logs: legitimate interest in operating the site securely.

How long we keep it

• Contact form submissions and feedback sent from Dispatch: as long as needed to reply, then up to 24 months for follow-up
• Active client correspondence: for the duration of the engagement plus 7 years for tax records
• Server logs: 30 days at Cloudflare's default
• Aggregate analytics: retained at Cloudflare's defaults, not tied to individuals
• Session recordings: 90 days at most; the record of pages and clicks, as long as PostHog keeps it

Your rights

If you're in the EU, UK, or California, you have the right to access, correct, delete, or export the data we hold about you, and to object to how we process it. Email hello@bloombilt.com and we'll respond within 30 days. You can also complain to your local data protection authority.

Children

The site isn't directed at children under 16, and we don't knowingly collect data from them. If you think we have, email us and we'll delete it.

International transfers

Cloudflare and Resend operate globally, and PostHog stores our analytics data in the United States. Data may be processed in the United States or other jurisdictions. Where applicable, transfers from the EU/UK are covered by Standard Contractual Clauses.

Changes

We'll update the "Last updated" date at the top when we change this policy. Material changes get a notice on the site.