bloe
Privacy policy
Last updated:
This page explains what personal data bloe collects, why, who it is shared with, how long it is kept and what you can do about it. It is written mainly for the providers who use bloe; section 3 is for the clients who message them.
Contents
1. Who we are
We decide how and why the personal data described here is used, which makes us the controller under UK data protection law (UK GDPR and the Data Protection Act 2018).
Message us through the bloe bot on Telegram.
2. What we collect about you
- Your account: your Telegram user id, the name and username Telegram shares with us, your language, and the application you send (including the photo you attach).
- Verification: a selfie of you holding a code word, which we compare with your application photo to check you are the person applying. An AI model helps with the comparison; a person makes the decision.
- Your profile: what you enter in the profile form, such as your working name, services, prices, hours, area, rules and photos.
- Conversations: the WhatsApp messages between the number we run for you and your clients, including photos and files they send, so the agent can reply.
- Bookings: the details of bookings the agent agrees, which are passed to your booking bot for you to accept or decline.
- Credits and payments: your balance, the hours you were online, your top-ups, and the record of charges, bonuses and refunds. Card payments are taken by Stripe and crypto payments by our own BTCPay Server. We never see or store your card number.
- Technical data: a sign-in cookie if you use the web dashboard (see section 9) and server logs, including IP addresses, used to keep the service secure and to stop repeated failed sign-ins.
3. If you messaged a provider
If you sent a message to a WhatsApp number that bloe runs for a provider, we process your phone number, your messages, any photos you sent and any booking you agreed, on that provider's behalf, so she can answer you and take bookings. We do not market to you and we never show your conversation to another provider. Conversations are kept while the provider's account is open. When she deletes her account, your phone number, name, photos and other personal details are removed, and what is left of the conversation is anonymised and may be kept to improve the service (see section 7). You can use the rights in section 8 by contacting us.
4. Why we use it, and our lawful basis
- To run the service you signed up for: running your number, replying to clients, passing bookings to you, billing your hours. Basis: our contract with you.
- To check who you are and keep the service for adults: the selfie check, and stopping conversations with anyone who says they are under 18. Basis: our legitimate interest in keeping the service lawful and safe, and our legal obligations.
- To take payments and keep accounts. Basis: contract and legal obligation.
- To keep the service secure and fix faults, including our staff reading a conversation when you ask for help or when the agent hands a chat over. Basis: legitimate interests.
- Clients' messages are processed so the provider they contacted can answer them. Basis: the legitimate interests of that provider and of bloe in answering enquiries she has asked us to answer.
- To improve the service: after an account is deleted, the anonymised text of its conversations, with names, phone numbers, addresses and photos removed, may be used to improve how the agent replies. Basis: legitimate interests.
Because of the nature of the services our providers offer, conversations can reveal information about people's sex lives, which the law treats as sensitive. We use it only to write the replies you asked for, keep it only for the periods in section 7, and never use it for advertising or share it with other providers or agencies. Where the law requires your explicit consent for this, you give it when you accept these terms in the booking bot and turn the agent on, and you can withdraw it at any time by turning the agent off and deleting your data.
We do not sell personal data and we do not use it for advertising.
5. Who we share it with
We use these service providers to run bloe. Each gets only what it needs for its part:
- Anthropic and xAI: the AI models that write the replies and help check verification photos. They receive the conversation text and images needed for the task.
- Supabase: database and file storage.
- Hetzner: the servers the service runs on.
- Our cloud-phone provider: the virtual Android phones the WhatsApp numbers run on, so messages pass through them.
- WhatsApp (Meta): messages to and from clients travel over WhatsApp, under WhatsApp's own terms and privacy policy.
- Telegram: the bots you use to control bloe and manage bookings.
- Stripe: card payments. BTCPay Server for crypto payments is run by us, on our own server, so no payment company sees those; the payment itself is public on the blockchain, as all crypto payments are.
- Mapping services (Google Maps routing and postcodes.io): to estimate travel time for outcall enquiries. Only locations are sent, never names or messages.
We may also disclose data where the law requires it, or to the police or other authorities where we believe a child is at risk or someone is being exploited.
6. International transfers
Some of the providers above (including Anthropic, xAI, Stripe, Telegram and Google) are based in, or process data in, the United States or other countries outside the UK. Where they do, the transfer is covered by UK adequacy regulations (such as the UK Extension to the EU-US Data Privacy Framework) or by the UK International Data Transfer Agreement or Addendum in their contracts with us.
7. How long we keep it
- WhatsApp conversations: kept while your account is open, so the agent keeps each client's context and you can pull reports. Nothing is deleted on a timer. When you delete your account, your clients' personal data is removed: their phone numbers and names are replaced with a code, phone numbers, emails, addresses and similar details are taken out of the messages, and screening answers such as age and nationality are deleted. The rest of the conversation text is anonymised and may be kept to improve the service.
- Photos and files sent in chats are kept on the phone that runs your number. When you delete your account, the links to them are removed at once and the files themselves within 30 days.
- Account, profile and verification data: while your account is open, and for up to 12 months after it closes so we can deal with questions and disputes, unless you ask us to delete it sooner.
- Payment and credit records: kept for 6 years, as UK accounting law requires. They contain no conversation content and no client phone numbers, and they are kept even after you delete your data.
8. Your rights
You have the right to see the personal data we hold about you, to have it corrected, to have it deleted, to restrict or object to how we use it, to receive a copy in a portable format, and to withdraw consent where we rely on it.
The quickest way: in the booking bot, open My Profile and use Download my data or Delete my data. Deleting removes your profile record and your clients' personal data straight away, anonymises what is left of your conversations, and closes your account. For anything else, through the bloe bot. We answer within one month.
If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to put it right first.
9. Cookies
bloe.app sets cookies to keep you signed in: one for the web dashboard and one for the provider portal when you sign in with your provider key. They are strictly necessary, so they do not need consent.
The public pages set one cookie, and only when you arrive through a bloe link (bloe.app/j/..., or a bloe.app link with ?r= in it): bloe_ref, which remembers for 30 days which link brought you, so your application shows where it came from. The page also keeps the same code in your browser's local storage for the same reason.
We count visits to our public pages ourselves, on our own server, to see which pages and links help people find bloe: the page, where the visit came from (for example a search engine or a bloe link), the kind of device, a rough region worked out from your browser's time zone, and your browser's language. To tell visits apart within one day, your IP address and browser details are used for a moment to make a code, together with a random value that is replaced every day; the IP address and browser details themselves are never stored, and the code cannot be linked to you or to your visits on other days. No other company receives this data, and we use no third-party analytics, tracking or advertising cookies. These records are deleted after 180 days.
Our pages load fonts from Google Fonts, so your browser contacts Google's servers when it opens them.
10. Adults only
bloe is only for adults aged 18 or over. We review every applicant personally, including the selfie check. The agent stops any conversation in which the client says or suggests he is under 18. If we learn that an account belongs to someone under 18, we close it and delete its data.
11. Changes to this policy
If we change this policy we will update this page and the date at the top. If a change matters to how your data is used, we will tell you in the bot before it takes effect.
12. Contact
Message us through the bloe bot on Telegram.