Privacy policy

INNERBLOOM

Dream. Manifest. Glow.

PRIVACY POLICY

Version 1.1 — 27 October 2026


1. Who we are

SC INNERBLOOM BRAND SRL, registered with the Romanian Trade Register under tax ID (CUI) RO47604160, with its registered office at Strada Ciprian Porumbescu 48C, Otopeni, Ilfov, Romania, operates the e-commerce platform www.innerbloom.ro and is the Data Controller within the meaning of Regulation (EU) 2016/679 (GDPR).

Data Protection Officer (DPO): Mihai Cristiana Andreea

GDPR contact: contact@innerbloom.ro


2. What data we collect and why

2.1 Data collected when you place an order

  • Full name

  • Delivery and billing address

  • Email address

  • Phone number

  • Payment data (processed securely by our payment processor — we do not store card data)

Legal basis: performance of the sales contract (Art. 6(1)(b) GDPR).

2.2 Data collected through your customer account

  • Order history

  • Product preferences

  • Login data (email + encrypted password)

Legal basis: your consent and the controller's legitimate interest (Art. 6(1)(a) and (f) GDPR).

2.3 Data collected through the IRIS AI assistant

Our website uses IRIS, an AI assistant based on Claude technology developed by Anthropic PBC (USA). When you interact with IRIS:

  • The content of your conversations is processed in real time through the Anthropic API to generate answers

  • If you are logged in, IRIS can access your order history on the Shopify platform to offer personalised recommendations

  • Conversations are stored temporarily in your browser (localStorage) or, in the mobile app, only on your phone, and are deleted when you clear the cache, tap “Clear” in the chat or uninstall the app

  • We do not permanently store conversation content on our servers, except for answers you choose to report with the “Report” button (see section 2.5)

Legal basis: explicit consent given the first time you use the IRIS widget (Art. 6(1)(a) GDPR).

Note: Anthropic processes data in the USA on the basis of the standard contractual clauses approved by the European Commission (Art. 46 GDPR).

2.4 Browsing data and cookies

  • IP address

  • Browser and device type

  • Pages visited and session duration

  • Advertising conversion data (Meta Pixel, Google Analytics, TikTok Pixel)

Legal basis: consent given through the cookie banner (Art. 6(1)(a) GDPR).


2.5 The InnerBloom mobile app (iOS and Android)

The InnerBloom app uses the same customer account as the innerbloom.ro website and the same data described in sections 2.1–2.3. In addition, the app processes:

  • Push notification token — only if you turn on notifications in the app; it is used exclusively to send you notifications about orders, launches and offers. Delivery is handled by Expo (650 Industries, USA), Apple Push Notification Service (iOS) and Google Firebase Cloud Messaging (Android)

  • In-app usage statistics (products viewed, items added to cart, checkout started), linked to an identifier generated by the app and, if you are logged in, to your email address — used for analytics and for marketing communications via theMarketer

  • Reported IRIS answers — when you tap “Report” under an IRIS answer, we keep the reported answer, the reason and the preceding question so that we can review and improve the assistant

  • Search terms entered in the app — used only to display results

The app does not access your location, contacts, photos, camera or microphone and does not use the device advertising identifier. Payment is made through the secure Shopify checkout; the app does not store card data.

You can delete your account directly in the app (Account → Delete account) or without the app, by following the instructions at https://innerbloom.ro/pages/stergere-cont.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) for running the app; consent (Art. 6(1)(a) GDPR) for push notifications and marketing; legitimate interest (Art. 6(1)(f) GDPR) for statistics and the safety of the IRIS assistant.


3. How long we keep data

  • Order and invoice data: 10 years (statutory accounting obligation)

  • Customer account data: until the account is deleted + 30 days

  • Marketing data (email, SMS): until consent is withdrawn

  • Analytics cookie data: up to 13 months

  • IRIS conversations: the current session (browser localStorage) or on your phone, in the app, until you delete them

  • Reported IRIS answers: up to 12 months

  • Push notification token: until notifications are turned off, the account is deleted or the app is uninstalled


4. Who we share data with

We do not sell your data. We may share it with:

  • Shopify Inc. (USA) — e-commerce platform, on the basis of Privacy Shield/SCC

  • Anthropic PBC (USA) — processing of IRIS AI conversations, on the basis of SCC

  • Fan Courier / GLS — order delivery

  • theMarketer (Romania) — newsletter, email automation and usage statistics

  • Expo / 650 Industries (USA) — delivery of push notifications and app updates, on the basis of SCC

  • Google (Firebase Cloud Messaging) and Apple (Apple Push Notification Service) — delivering push notifications to your phone

  • Payment providers (Stripe, local processors) — exclusively for processing transactions

  • Google Analytics, Meta, TikTok — anonymised traffic and advertising data, with your consent

  • Public authorities — only when required by law


5. Your rights (GDPR)

You have the right to:

  • Access — request a copy of the data we hold about you

  • Rectification — have inaccurate data corrected

  • Erasure (“right to be forgotten”) — under the conditions laid down by the GDPR

  • Restriction of processing — in certain circumstances

  • Portability — receive your data in a structured format

  • Objection — to processing based on legitimate interest or for direct marketing

  • Withdrawal of consent — without affecting the lawfulness of earlier processing

To exercise your rights: contact@innerbloom.ro — we reply within 30 days at the latest.

Account deletion: in the InnerBloom app (Account → Delete account) or by following the instructions at https://innerbloom.ro/pages/stergere-cont.

You have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP): www.dataprotection.ro


6. Data security

We apply appropriate technical and organisational measures: HTTPS/TLS connections, restricted access to data, security monitoring and encrypted passwords. If a security incident affects your data, we will notify you within the time limits set by the GDPR.


7. Cookies

We use essential cookies (needed for the website to work), analytics cookies and marketing cookies. You can manage your preferences through the cookie banner or in your browser settings. Refusing marketing cookies does not affect the main functionality of the website.


8. Changes to this policy

We update this policy periodically. The current version is always available on the website. Significant changes will be communicated by email to registered customers.


9. Contact

SC INNERBLOOM BRAND SRL

Strada Ciprian Porumbescu 48C, Otopeni, Ilfov, Romania

Email: contact@innerbloom.ro

Website: www.innerbloom.ro

DPO: Mihai Cristiana Andreea

Last updated: 27 October 2026