Privacy Policy

Effective date: May 14, 2026
Last updated: May 14, 2026

BLOOM RISE MEDIA LLC (“Bloom Rise Media,” “we,” “us,” or “our”) operates the website bloomriseagencia.com and provides marketing services (websites, microsites, Google Ads, Local SEO, Meta and TikTok advertising, and competitor intelligence) to contractors in Northern Virginia. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the choices you have. It also describes the specific data practices that apply when our services integrate with Meta Platforms, Inc. (Facebook and Instagram).

1. Who we are and how to contact us

BLOOM RISE MEDIA LLC is the data controller for personal information processed through this website and the marketing services we deliver to our contractor clients. You can reach us at:

• Email: contact@bloomrisemedia.com
• Phone: (703) 555-0100
• Mailing address: Fairfax, Virginia 22030, United States

2. Information we collect

2.1 Information you provide directly

• Discovery form data: company name, contractor license number, services offered, target service area, brand assets, website URL, photos, testimonials, project history, and any other content you upload during onboarding.
• Account credentials: name, email address, and password (or magic-link token) used to access the client portal and dashboard.
• Contact and audit requests: name, business name, phone, email, vertical (Remodeling, Roofing, Moving), and any free-text message submitted through the audit, contact, or pricing forms.
• Payment information: billing name, billing address, and the last four digits of your payment method. Full card numbers are handled by our PCI-compliant payment processor and never stored on our servers.

2.2 Information collected automatically

• Device and log data: IP address, browser type, operating system, referring URL, pages viewed, time stamps, and approximate location derived from IP.
• Cookies and similar technologies: session cookies, preference cookies, and analytics identifiers set by Google Analytics 4, Vercel Analytics, and (only with consent where required) advertising pixels including the Meta Pixel and TikTok Pixel.
• Conversion events: form submissions, phone clicks, call-tracking metadata (where CallRail is enabled), and outbound clicks on client landing pages.

2.3 Information received from third parties

• Meta Platforms (Facebook and Instagram): when a client connects their Facebook Page or Instagram business account, or when an end user submits a Meta Lead Ad form, we receive the data described in Section 7 below.
• Google services: Google Ads conversion data, Google Business Profile insights, and Search Console performance data when a client links those accounts.
• Publicly available sources: for our competitor-intelligence service, we collect data published on public websites, business directories, and ad libraries (Google Ads Transparency Center, Meta Ad Library) about contractors operating in Northern Virginia.

3. How we use information

We use personal information for the following purposes and on the following legal bases:

• Service delivery (performance of a contract): build websites and microsites, run advertising campaigns, generate competitor reports, manage retainers, and provide the client portal.
• Account management and support (performance of a contract): authenticate users, respond to inquiries, and process payments.
• Analytics and product improvement (legitimate interest): measure how visitors use bloomriseagencia.com and our client landing pages so we can optimize copy, layout, and conversion paths.
• Marketing communications (consent or legitimate interest, depending on jurisdiction): send newsletters, case studies, and audit recaps. You can unsubscribe at any time using the link in every email.
• Security and fraud prevention (legitimate interest and legal obligation): detect abuse, block bots, and meet our compliance obligations.
• Legal compliance (legal obligation): respond to lawful requests, enforce our Terms of Service, and maintain financial records as required by U.S. and Virginia law.

4. How we share information

We do not sell personal information. We share it only with the following categories of recipients:

• Service providers (processors) who act on our instructions:
  • Supabase Inc. (database, authentication, file storage) — United States.
  • Vercel Inc. (hosting, edge functions, analytics) — United States.
  • Backblaze Inc. (B2 object storage for photos and brand assets) — United States.
  • Anthropic PBC (AI inference for content generation) — United States; inputs sent to Anthropic are configured for zero data retention where the API supports it.
  • Resend Inc. (transactional email delivery) — United States.
  • CallRail Inc. (call tracking) — only when a client enables call tracking.
  • Stripe Inc. (payments) — United States.
• Advertising and analytics platforms: Google LLC (Google Ads, Google Analytics 4, Google Business Profile), Meta Platforms Inc. (Facebook Ads, Instagram Ads, Meta Pixel, Conversions API), and TikTok Inc. (TikTok Ads), where a client has authorized the integration.
• Our clients: if you submit a lead through a website or microsite we operate on behalf of a contractor, your information is shared with that contractor so they can quote your project.
• Legal and safety recipients: courts, regulators, law-enforcement agencies, and our legal counsel when required by law or to protect our rights.
• Successors: in the event of a merger, acquisition, or sale of assets, personal information may be transferred to the successor entity, subject to this Privacy Policy.

5. Cookies and tracking technologies

We use first-party and third-party cookies and similar technologies to operate the site, remember preferences, measure performance, and (with consent where required) deliver and measure advertising. Categories include:

• Strictly necessary: session, CSRF, and authentication cookies. Cannot be disabled.
• Analytics: Google Analytics 4 and Vercel Analytics (aggregated, IP-anonymized where supported).
• Advertising: Meta Pixel, Meta Conversions API, Google Ads conversion tag, and TikTok Pixel. Loaded only after consent in regions that require it (EU/EEA, UK, California).

You can control cookies in your browser settings, opt out of Google Analytics via tools.google.com/dlpage/gaoptout, and adjust Meta ad preferences at facebook.com/adpreferences.

6. International data transfers

Our servers and most of our processors are located in the United States. If you access our services from outside the United States, your information will be transferred to, stored in, and processed in the United States. Where we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland, we rely on Standard Contractual Clauses or equivalent safeguards approved by competent authorities.

7. Meta Platforms: Facebook and Instagram

When you or one of our clients connects a Facebook Page, Instagram business account, Meta Business Suite asset, or Meta advertising account to our services, we act as the “Tech Provider” on behalf of the client (the Business User) under Meta’s Platform Terms. The following practices apply specifically to Meta data:

• What we receive from Meta: Page and ad-account identifiers, page insights, post and ad performance metrics, lead-ad form submissions, comments and messages where the client has granted access, and the limited profile information (name, email, phone) that lead-ad users have chosen to share.
• Why we use it: to publish content, manage advertising campaigns, deliver leads to the client’s CRM or portal, generate performance reports, and improve targeting on behalf of the client.
• How long we keep it: aggregated metrics are retained for the life of the engagement plus 24 months for reporting. Individual lead records are retained for the period the client requires to fulfill their contract with the lead, then deleted on the schedule below or at the lead’s request.
• What we do not do: we do not sell Meta data, do not use it to build advertising profiles for unrelated third parties, do not transfer it to data brokers, and do not use it for any purpose outside the permissions the client granted at connection time. We comply with Meta’s Platform Terms, Developer Policies, and Limited Use requirements.
• Revoking access: a client can disconnect any Facebook or Instagram integration at any time from the client portal at /portal, or by removing Bloom Rise Media from facebook.com/settings?tab=business_tools. An end user who submitted a lead-ad form can request deletion under Section 10.

8. Data retention

• Discovery-form content and project assets: life of the engagement plus 24 months.
• Account records: life of the account plus 12 months after closure.
• Lead and form submissions: 24 months unless the underlying client requires a different retention window.
• Billing and tax records: 7 years (U.S. statutory requirement).
• Server logs: 90 days.
• Aggregated analytics: indefinitely in de-identified form.

9. Security

We protect personal information using industry-standard administrative, technical, and physical safeguards including TLS 1.2+ in transit, AES-256 at rest, role-based access control, least-privilege database policies (Supabase RLS), audit logging, and quarterly access reviews. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security but we work continuously to maintain a strong defense.

10. Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete your information (see also our Data Deletion Instructions).
• Restrict or object to processing.
• Receive a portable copy of your information.
• Withdraw consent at any time where processing is based on consent.
• Opt out of the “sale” or “sharing” of personal information (we do not sell personal information).
• Appeal a denied request and lodge a complaint with a supervisory authority.

To exercise any of these rights, email contact@bloomrisemedia.com with the subject line “Privacy Request.” We respond within 30 days (or 45 days for complex requests, with notice). We may need to verify your identity before fulfilling a request.

10.1 California residents

Under the CCPA/CPRA, California residents have the rights listed above plus the right not to be discriminated against for exercising them. The categories of personal information we have collected in the last 12 months and the categories of recipients are described in Sections 2 and 4. We do not sell personal information and do not knowingly process the personal information of consumers under 16 for cross-context behavioral advertising without consent.

10.2 Virginia residents

Under the Virginia Consumer Data Protection Act, Virginia residents have the rights listed above and may appeal a denied request by emailing contact@bloomrisemedia.com with the subject line “VCDPA Appeal.” If the appeal is denied you may contact the Virginia Attorney General at oag.state.va.us.

11. Children’s privacy

Our services are intended for adults operating contracting businesses. We do not knowingly collect personal information from children under 13 (or under 16 in the EEA/UK). If you believe a child has provided us personal information, email contact@bloomrisemedia.com and we will delete it.

12. Third-party links

Our website and the client landing pages we build may link to third-party websites. We are not responsible for the privacy practices of those sites; review their policies before providing personal information.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be announced on this page and, where appropriate, by email at least 14 days before they take effect. The “Last updated” date above always reflects the most recent revision.

14. Contact

Questions, complaints, or requests under this Privacy Policy can be sent to:

BLOOM RISE MEDIA LLC
Attn: Privacy
Fairfax, Virginia 22030
United States
Email: contact@bloomrisemedia.com
Phone: (703) 555-0100