Privacy Policy
Last updated 15 September 2026
The short version
We collect what we need to run your books and work out your tax, and nothing else. We don’t sell your information, we don’t use it for advertising, and you can export or delete it whenever you like.
1. Who we are
Jagganaut Ltd. (9429052945786) of 113 Jean Archie Drive, Rolleston is the agency responsible for personal information collected through Bloomly, under the Privacy Act 2020.
Privacy questions, requests and complaints: support@bloomlymoney.com.
2. What we collect
Almost everything comes directly from you, as you use the app.
Account information
- your email address and name;
- a securely hashed password — we never see or store your actual password.
Your business profile
- trading and legal name, business structure, city, and the name of your bank;
- the bank account number you want customers to pay into — it is printed on the invoices you send and nowhere else;
- GST number, GST registration status and date, filing frequency, accounting basis and filing cycle;
- opening balance, any other taxable income you tell us about, and any tax-withholding rate your payers apply.
Your financial records
- invoices and their line items, payments, and payment methods;
- expenses, including merchant, category, amounts, GST and any notes and receipt images or PDFs you upload;
- bank transactions you enter or import by CSV, including date, payee, reference and amount;
- assets, their cost and depreciation;
- purchases you paid for personally and what the business has repaid you, if you use that feature;
- GST returns and provisional tax instalments you record.
Information about other people
If you invoice someone, we store the customer details you enter — name, email and city. This is personal information about someone else, so clause 7 of the Terms of Service applies: you confirm you’re entitled to give it to us, and we process it only to provide the service to you.
Technical information
- a session cookie so you stay signed in — strictly necessary for the app to work;
- standard server logs, including IP address and timestamps, kept for security and troubleshooting;
- error reports: when something in Bloomly breaks, a report of what went wrong — the page, the error, and your browser type — is sent to our error-monitoring service so we can fix it. These reports are configured not to include your name, email or what you typed.
We do not currently use advertising or third-party tracking cookies. If that changes we’ll update this policy and tell you first.
3. Why we collect it
- to give you the service — record-keeping, invoicing and tax figures;
- to authenticate you and keep your account secure;
- to provide support when you ask for it;
- to send service messages, such as billing or security notices;
- to meet our own legal and tax obligations.
We do not sell your information, share it with data brokers, or use your financial records to build advertising profiles.
4. Who we share it with
Only the suppliers needed to run Bloomly, and only so they can perform that service for us:
- Supabase — database, authentication and receipt file storage (Sydney, Australia);
- Vercel — application hosting and delivery (Sydney, Australia);
- Stripe — subscription billing. Your card details are entered on Stripe’s own pages and never reach our servers; Stripe holds your email address and billing history (United States);
- Resend — sends email on our behalf: sign-in and password-reset emails to you, and invoices to your customers when you choose to email one. An invoice email carries the customer’s address and the invoice contents (United States, with sending infrastructure in the Asia-Pacific region);
- Sentry — error monitoring, as described under technical information above (European Union).
We may also disclose information where the law requires it, or to establish or defend a legal claim. If our business is ever sold or transferred, information may transfer with it — we’d tell you first.
5. Where your information is stored
Your books — the database and your receipt files — are stored on servers in Sydney, Australia, and the app runs there too. Billing records sit with Stripe in the United States, emails pass through Resend, and error reports are held by Sentry in the European Union, each as set out in section 4. This means your personal information is held outside New Zealand.
As required by information privacy principle 12, we only use providers that are subject to privacy safeguards comparable to those in the Privacy Act 2020, through their contractual commitments and the privacy laws that apply to them.
6. How we protect it
- traffic is encrypted in transit with HTTPS, and data is encrypted at rest by our hosting providers;
- every table uses row-level security, so the database itself enforces that you can only ever read or write your own business’s records;
- receipt files are stored in a private bucket, reachable only through short-lived links generated for you;
- passwords are hashed by our authentication provider.
No system is perfectly secure. If a privacy breach happens that could cause you serious harm, we will notify you and the Office of the Privacy Commissioner as the Privacy Act 2020 requires.
7. How long we keep it
- while your account is open, we keep your records so the service works;
- if you close your account from Settings, your records, receipt files and login are deleted straight away, and any copies in our providers’ backups expire within 90 days;
- billing records stay with Stripe, and we keep the invoices we issued you, for up to seven years to meet our own obligations under the Tax Administration Act 1994;
- error reports are kept by Sentry for 90 days, then discarded.
Your own record-keeping
Inland Revenue requires you to keep business records for at least seven years. Don’t rely on Bloomly as your only copy — export a backup from Settings and keep it somewhere safe.
8. Your rights
Under principles 6 and 7 of the Privacy Act 2020 you can ask us to:
- see the personal information we hold about you — most of it you can download yourself from Settings at any time;
- correct anything that’s wrong;
- delete your account and its information, subject to clause 7.
Email support@bloomlymoney.com and we’ll respond within 20 working days, as the Act requires.
9. Complaints
If you’re unhappy with how we’ve handled your information, tell us first at support@bloomlymoney.com and we’ll try to put it right. If you’re still not satisfied, you can complain to the Office of the Privacy Commissioner at privacy.org.nz, or on 0800 803 909.
10. Changes
We may update this policy. For material changes we’ll give reasonable notice by email or in the app. The date at the top shows when it last changed.