Privacy Policy

Last updated 1 August 2026

The short version

We collect what we need to run your books and work out your tax, and nothing else. We don’t sell your information, we don’t use it for advertising, and you can export or delete it whenever you like.

1. Who we are

Jagganaut Ltd. (9429052945786) of 113 Jean Archie Drive, Rolleston is the agency responsible for personal information collected through Bloomly, under the Privacy Act 2020.

Privacy questions, requests and complaints: support@bloomlymoney.com.

2. What we collect

Almost everything comes directly from you, as you use the app.

Account information

your email address and name;
a securely hashed password — we never see or store your actual password.

Your business profile

trading and legal name, business structure, city, and the name of your bank;
GST number, GST registration status, filing frequency, accounting basis and filing cycle;
opening balance and any other taxable income you tell us about.

Your financial records

invoices and their line items, payments, and payment methods;
expenses, including merchant, category, amounts, GST and any notes and receipt images or PDFs you upload;
bank transactions you enter or import by CSV, including date, payee, reference and amount;
assets, their cost and depreciation;
GST returns and provisional tax instalments you record.

Information about other people

If you invoice someone, we store the customer details you enter — name, email and city. This is personal information about someone else, so clause 7 of the Terms of Service applies: you confirm you’re entitled to give it to us, and we process it only to provide the service to you.

Technical information

a session cookie so you stay signed in — strictly necessary for the app to work;
standard server logs, including IP address and timestamps, kept for security and troubleshooting.

We do not currently use advertising or third-party tracking cookies. If that changes we’ll update this policy and tell you first.

3. Why we collect it

to give you the service — record-keeping, invoicing and tax figures;
to authenticate you and keep your account secure;
to provide support when you ask for it;
to send service messages, such as billing or security notices;
to meet our own legal and tax obligations.

We do not sell your information, share it with data brokers, or use your financial records to build advertising profiles.

4. Who we share it with

Only the suppliers needed to run Bloomly, and only so they can perform that service for us:

Supabase — database, authentication and receipt file storage;
Vercel — application hosting and delivery;
Payment provider — if you subscribe to a paid plan, your card details are handled by our payment processor and never reach our servers;
Email provider — to send account and service emails.

We may also disclose information where the law requires it, or to establish or defend a legal claim. If our business is ever sold or transferred, information may transfer with it — we’d tell you first.

5. Where your information is stored

Your data is stored on servers located in Sydney, Australia. This means your personal information may be held outside New Zealand.

As required by information privacy principle 12, we only use providers that are subject to privacy safeguards comparable to those in the Privacy Act 2020, through their contractual commitments and the privacy laws that apply to them.

6. How we protect it

traffic is encrypted in transit with HTTPS, and data is encrypted at rest by our hosting providers;
every table uses row-level security, so the database itself enforces that you can only ever read or write your own business’s records;
receipt files are stored in a private bucket, reachable only through short-lived links generated for you;
passwords are hashed by our authentication provider.

No system is perfectly secure. If a privacy breach happens that could cause you serious harm, we will notify you and the Office of the Privacy Commissioner as the Privacy Act 2020 requires.

7. How long we keep it

while your account is open, we keep your records so the service works;
if you delete your account, we delete or anonymise your personal information within 90 days, except where we must keep it longer;
we may need to retain some records for up to seven years to meet our own obligations under the Tax Administration Act 1994.

Your own record-keeping

Inland Revenue requires you to keep business records for at least seven years. Don’t rely on Bloomly as your only copy — export a backup from Settings and keep it somewhere safe.

8. Your rights

Under principles 6 and 7 of the Privacy Act 2020 you can ask us to:

see the personal information we hold about you — most of it you can download yourself from Settings at any time;
correct anything that’s wrong;
delete your account and its information, subject to clause 7.

Email support@bloomlymoney.com and we’ll respond within 20 working days, as the Act requires.

9. Complaints

If you’re unhappy with how we’ve handled your information, tell us first at support@bloomlymoney.com and we’ll try to put it right. If you’re still not satisfied, you can complain to the Office of the Privacy Commissioner at privacy.org.nz, or on 0800 803 909.

10. Changes

We may update this policy. For material changes we’ll give reasonable notice by email or in the app. The date at the top shows when it last changed.