Privacy policy

Privacy Policy

Last updated: June 16, 2026

BUXAP | bloom ("we", "us", "our") operates this store and website, including all related information, content, features, tools, products and services, to provide you, the customer, with a curated shopping experience (the "Services"). BUXAP | bloom is powered by Shopify, which enables us to provide the Services to you. This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase or other transaction using the Services, or otherwise communicate with us. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use, and disclosure of your information as described herein.

Age requirement

You must be at least 18 years old (or have reached the age of majority in your state or country of residence) to make a purchase from BUXAP | bloom. By placing an order you confirm that you meet this requirement and are legally able to enter into a binding contract.

Personal information we collect or process

When we use the term "personal information," we are referring to information that identifies or can reasonably be linked to you. We may collect or process the following categories, depending on how you interact with the Services and where you live:

  • Contact details — name, shipping address, billing address, phone number, email address.
  • Financial information — payment card information, transaction details, form of payment, payment confirmation and other payment details. Card numbers are entered directly into our PCI‑DSS compliant payment provider and are never stored on our servers.
  • Account information — username, password (hashed and salted), security questions, preferences and settings.
  • Transaction information — items you view, add to cart or wishlist, purchase, return, exchange or cancel, and your past transactions.
  • Communications with us — information you include when contacting customer support.
  • Device information — device, browser and network information, IP address, and other unique identifiers.
  • Usage information — how and when you interact with or navigate the Services.

Sources of personal information

  • Directly from you when you create an account, use the Services, or contact us.
  • Automatically through cookies and similar technologies when you use the Services.
  • From our service providers acting on our behalf.
  • From our partners or other third parties (e.g. social login providers when you use them).

How we use your personal information

  • Provide and improve the Services — to perform our contract with you, process payments, fulfill orders, manage your account, arrange shipping with our supplier, handle returns and exchanges, remember your preferences, recommend products, and improve the shopping experience.
  • Marketing and advertising — to send marketing communications (only with your consent where required) and to show you relevant advertising. You may opt out at any time via the unsubscribe link in any marketing email.
  • Security and fraud prevention — to authenticate your account, secure payments and detect or prevent fraudulent, illegal or malicious activity.
  • Communicating with you — to provide customer support and maintain our business relationship.
  • Legal reasons — to comply with applicable law, respond to lawful requests, and enforce our terms and policies.

How we disclose personal information

We share personal information only with service providers that help us operate the store, and only to the extent needed for them to perform their service:

  • Shopify Inc. (USA) — e‑commerce platform, checkout, cart and payment processing.
  • Trendsi (USA) — supplier and fulfilment partner that prepares and ships your order.
  • Lovable Cloud / Supabase (EU) — authentication, account data, wishlist and order history.
  • Resend (USA) — transactional and (with your consent) marketing emails.
  • PostHog (USA) — product analytics and session replay, only with consent to analytics cookies.
  • Microsoft Clarity (USA) — heatmaps and anonymised session recordings, only with consent to analytics cookies.
  • Meta Platforms, Inc. (USA) — Meta Pixel for advertising and conversion measurement, only with consent to marketing cookies.
  • Google LLC (USA) — optional Google Sign‑In, only when you choose it.

We may also disclose information: with your direction or consent; within our corporate group; in connection with a business transaction such as a merger or bankruptcy; to comply with legal obligations or respond to subpoenas, search warrants and similar requests; and to enforce our terms or protect our rights, our users or the public. We do not sell your personal information for money.

Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve the Services. Information you submit will be transmitted to and shared with Shopify and third parties that may be located in countries other than where you reside. To help protect, grow, and improve our business, we use certain Shopify enhanced features that incorporate data and information obtained from your interactions with our store, along with other merchants and with Shopify. In these circumstances, Shopify is responsible for the processing of your personal information, including for responding to your requests to exercise your rights. To learn more, visit the Shopify Consumer Privacy Policy, and where available the Shopify Privacy Portal.

Third party websites and links

The Services may link to websites or platforms operated by third parties. We are not responsible for the privacy or security of those sites. Please review their policies before sharing information with them.

Children's data

The Services are not intended for children. We do not knowingly collect personal information from children under 13 (or the equivalent minimum age in your jurisdiction), in line with the U.S. Children's Online Privacy Protection Act (COPPA) and applicable EU/EEA law. As of the Effective Date, we do not have actual knowledge that we "share" or "sell" personal information of individuals under 16 years of age. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will delete it.

Security and retention

We use industry‑standard safeguards including HTTPS/TLS encryption across the entire site, PCI‑DSS compliant payment processing, hashed and salted passwords, access‑controlled hosting infrastructure with monitoring and backups, strict internal access policies, and ongoing dependency and vulnerability checks. No security measures are perfect or impenetrable, and we cannot guarantee "perfect security." We recommend you use a strong, unique password and do not use unsecure channels to share sensitive information.

How long we retain your personal information depends on factors such as whether we need it to maintain your account, provide the Services, comply with legal obligations (including EU/US tax and accounting requirements), resolve disputes, or enforce our contracts and policies.

Your rights and choices

Depending on where you live, you may have the following rights regarding your personal information. These rights are not absolute and may not apply in every circumstance:

  • Right to access / know — request access to the personal information we hold about you.
  • Right to delete — request that we delete personal information about you.
  • Right to correct — request that we correct inaccurate personal information.
  • Right of portability — receive a copy of your personal information and, where applicable, request its transfer.
  • Right to opt out of sale/sharing or targeted advertising — where applicable. If you visit our website with the Global Privacy Control (GPC) signal enabled, we will treat this as a valid opt‑out request for the device and browser used. We do not recognize other "Do Not Track" signals.
  • Managing communication preferences — opt out of marketing emails at any time via the unsubscribe link. We may still send non‑promotional messages such as order updates.

You may exercise these rights by emailing leandroschvetz@gmail.com or by using the in‑app tools at /account/privacy (download your data or delete your account in real time, per Art. 15 & 17 GDPR). To learn more about how Shopify uses your personal information and any rights you may have with Shopify, visit https://privacy.shopify.com/en.

We will not discriminate against you for exercising any of these rights. We may need to verify your identity before processing your request. You may also designate an authorized agent to act on your behalf, subject to verification.

Complaints

If you have complaints about how we process your personal information, please contact us using the details below. Depending on where you live, you may have the right to appeal our decision or lodge a complaint with your local data protection authority.

International transfers

We may transfer, store and process your personal information outside the country in which you live. Where we transfer personal information out of the European Economic Area, the United Kingdom or Switzerland, we rely on recognized transfer mechanisms such as the European Commission's Standard Contractual Clauses (or equivalent UK/Swiss clauses), unless the transfer is to a country deemed to provide an adequate level of protection.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our practices or for operational, legal, or regulatory reasons. We will post the revised Privacy Policy here, update the "Last updated" date, and provide notice as required by law.

Contact

For questions about our privacy practices or this Privacy Policy, or to exercise any of your rights, contact us at:

BUXAP | bloom Tschernihovsky 3, Haifa 3570103, Israel Email: leandroschvetz@gmail.com