Privacy policy.

Bioom B.V. (the data controller) processes your personal data only when there is a clear lawful basis under the EU General Data Protection Regulation (GDPR) and Dutch Uitvoeringswet AVG. This policy explains what we collect, why, and how to exercise your rights. It covers both the Bioom website (including the pre-launch waitlist) and the Bioom application that account holders use to manage their farms and soil analyses.

1. 01Who we are

   Bioom B.V., a private company registered in the Netherlands. For the purposes of this policy and the GDPR, Bioom B.V. is the data controller for the personal data we process about you. You can reach our privacy team at privacy@bioom.app.

2. 02What we collect

   When you submit a pre-launch waitlist application we collect: your name, email address, organization, professional role, region (NL province or country), primary crop, intended sampling timing, the role-specific profile fields you provide (e.g. farm size, research focus), your consent flags, your selected language, and the UTM parameters and referrer of the page that brought you to /apply. If you hold a Bioom account and use the Bioom application, we additionally process: your account details (name, email address, securely hashed password, organization, role, and language preference); the farm and field records you create (field names, locations and boundary geometry / GPS coordinates, crop history, and tillage and input notes); the soil-sample orders you place and the resulting laboratory chemistry values, DNA-sequencing reads, and derived soil-health indices; the diagnostic reports generated for you; and basic security logs (such as sign-in events and IP address) needed to operate the service safely. We also use Vercel Web Analytics to measure aggregate site usage (such as page views, referrers, country-level location, and device/browser type). It is privacy-friendly by design: it sets no cookies, uses no third-party identifiers, and does not track you across other sites. Visits are recorded anonymously and are not tied to your IP address or to any individual.

3. 03Why we collect it (lawful basis)

   Pre-launch application data — lawful basis: consent (Article 6(1)(a) GDPR). You actively confirm consent before submission. You can withdraw consent at any time by emailing privacy@bioom.app. Bioom account and application data — lawful basis: performance of a contract (Article 6(1)(b) GDPR) to deliver the service you signed up for, together with our legitimate interest (Article 6(1)(f) GDPR) in keeping the service secure and reliable. Where the law requires us to keep certain records, the basis is our legal obligation (Article 6(1)(c) GDPR). Aggregate site analytics (Vercel Web Analytics) — lawful basis: legitimate interest (Article 6(1)(f) GDPR) in understanding, at an aggregate level, how the site is used so we can improve it. Because the data is anonymous, cookieless, and not tied to any individual, the impact on your privacy is minimal. You can object to this processing by emailing privacy@bioom.app.

4. 04Who we share it with

   We share the strict minimum needed to operate: For the website and waitlist: • Neon (Postgres database, EU region) — stores your application record at rest in the EU. • Vercel (hosting, EU edge) — serves the website pages and provides privacy-friendly, aggregate Vercel Web Analytics (no cookies, no third-party identifiers, no cross-site tracking). For the Bioom application (account holders): • Hetzner Online GmbH (cloud hosting, Germany — EU) — runs the Bioom application, its database, and file storage; all application data is kept within the EU. • Resend (Resend, Inc., United States) — delivers transactional account emails such as verification and password-reset links; only your email address is processed for this. Where personal data is transferred outside the EU/EEA, it is protected by appropriate safeguards (EU Standard Contractual Clauses). We never sell your data. We never share it with advertising networks. We never use it for purposes other than running Bioom and the pre-launch program.

5. 05How long we keep it

   Waitlist application data: retained for 24 months from your application date, unless you request earlier deletion. After 24 months we either delete or fully anonymize the record (you cannot be re-identified from anonymized records). Bioom account and application data (your farms, fields, sample results, and reports): kept for as long as your account is active. To close your account or request deletion, email privacy@bioom.app; we will delete or anonymize the personal data we hold about you without undue delay, and in any case within 90 days of completing your request, except where we are legally required to keep certain records for longer. Some data may remain in encrypted backups until those are rotated, and limited security logs (which can include an IP address) are kept only as long as needed to operate the service safely.

6. 06Your rights under GDPR

   You have the right to: • Access the personal data we hold about you (Art. 15) • Correct inaccurate data (Art. 16) • Request deletion of your data (Art. 17 — 'right to be forgotten') • Object to processing (Art. 21) • Receive your data in a portable format (Art. 20) • Withdraw consent at any time (Art. 7(3)) To exercise any of these rights, email privacy@bioom.app. We will respond within 30 days. If you are not satisfied with our response, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, https://autoriteitpersoonsgegevens.nl).

7. 07Security

   Personal data is encrypted in transit (HTTPS/TLS). Website and waitlist data is also encrypted at rest in our EU-region database (Neon Postgres). The Bioom application runs on access-controlled servers in the EU (Hetzner, Germany), with its database and file storage on a private network and off-site backups kept encrypted. Access to data is restricted to Bioom employees with a documented need. We log all administrative access and rotate credentials regularly. We have not, to date, suffered a breach. If we ever do, we will notify affected individuals and the AP within 72 hours, as required by Article 33 GDPR.

8. 08Changes to this policy

   We may update this policy as Bioom evolves — for example, when we add a feature that processes new categories of data. The 'last updated' date at the top will reflect any change. For material changes that affect your rights, we will email everyone with a current waitlist application.