Privacy policy
Last updated: 16 October 2026
In the course of its business and the provision of the Services, ProfBloom processes personal data concerning its users (the “Users”).
The purpose of this privacy policy is to inform you, in particular, of:
- the categories of personal data processed by ProfBloom;
- the purposes of that processing and its legal bases;
- ProfBloom's role in that processing;
- the recipients of the data;
- its retention periods;
- any transfers of data outside the European Economic Area;
- the rights available to you regarding your data;
- the use of cookies and other trackers.
Personal data means any information relating to an identified or identifiable natural person.
This policy supplements the legal notice and the Terms of Use available to Users.
ProfBloom attaches particular importance to respecting Users' privacy and the confidentiality of their personal data, and undertakes to process it in accordance with applicable laws and regulations, in particular French Act No. 78-17 of 6 January 1978 on information technology, data files and civil liberties (the “French Data Protection Act”) and Regulation (EU) 2016/679 of 27 April 2016 (the “GDPR”).
Personal data processed
Depending on how you use ProfBloom, the following categories of data may be processed:
Teachers
- ProfBloom account data: email address, surname, first name, information entered in the settings and answers given at sign-up (teaching setting, priorities, languages taught, where the visit came from).
- Data relating to the subscription and billing of the ProfBloom account.
- Data entered by the teacher in the course of the Services, in particular teaching, booking and administrative and financial management data.
Students
- ProfBloom account data: email address, surname, first name and information entered in the profile. The email address used for the initial invitation is provided by the teacher.
- Teaching data entered or generated in the course of the Services, in particular the subject taught, the level, results and progress.
- Data relating to bookings.
- Data produced in the course of interactive activities.
- Recordings of the student’s voice in the pronunciation review: the student records themselves to play it back and compare it with a model; these recordings stay on their device and are not sent to anyone. Only the recordings the student chooses to keep are stored by ProfBloom; their teacher can listen to them only if the student allows it, and the student can withdraw this permission at any time.
Students have their own ProfBloom account, from which they can view and, where the feature allows it, edit the data concerning them. Their teaching data may be kept in their account in order to ensure continuity of their progress tracking and to personalise the content and features offered to them.
Visitors and prospective customers
- Contact details voluntarily provided through the forms on the site, in particular first name and email address.
- Declared interests, in particular when signing up to a waiting list, a webinar or a newsletter.
- Answers given in qualification questionnaires.
- With your consent, browsing data on the site: pages viewed, navigation path, where the visit came from (including a click on one of our ads) and the identifiers of measurement and advertising cookies.
A teacher’s public page and reviews
A teacher may have a public page, whose address is built from their first name and the initial of their surname. This page is never put online automatically: it is visible only if the teacher chooses to publish it, and they can take it down at any time.
Once published, the page can be viewed by anyone, without an account. It shows the teacher’s first name and the initial of their surname, their photo if they have uploaded one, and the information they have chosen to include, in particular their introduction, subjects, prices and available time slots. The teacher’s full surname does not appear on it.
The page is offered to search engines only if the teacher turns on the dedicated setting, which is off by default. When that setting is turned off or the page is taken down, its removal from search results depends on the search engines concerned, within a time frame that ProfBloom does not control. In all cases, ProfBloom asks the crawlers of artificial intelligence assistants not to access these pages.
A student who has taken at least three confirmed lessons with a teacher may leave a review of that teacher: a rating and a comment. Before sending it, the student is informed that the review may be displayed on the teacher’s public page, together with their first name and the initial of their surname. The review is published only after the teacher has approved it. The student can edit or withdraw their review at any time from their own space; a withdrawn review is deleted.
A visitor can write to a teacher or request a booking from the teacher’s public page by giving their first name and email address. The contact message is forwarded to the teacher by email. A booking request must be confirmed through a link sent to the address provided: once confirmed, it creates a student record and a lesson on the teacher’s side, processed like the other data the teacher manages in ProfBloom. To prevent abuse, ProfBloom counts submissions using a non-reversible fingerprint of the visitor’s IP address.
ProfBloom publishes this page and processes these requests on behalf of the teacher, as a processor. The teacher is responsible for the information they choose to make public and for the use they make of the contact details they receive.
Purposes and legal bases
Where data is processed solely in order to provide the teacher with ProfBloom's Services, the teacher is the controller and ProfBloom acts as a processor, on their instructions. ProfBloom's teams access that data only at the teacher's explicit request or where necessary to provide, secure or support the Services. ProfBloom does not use it for its own purposes, does not sell it, and discloses it only to the processors necessary to provide the Services, under the conditions described in this policy.
| Data subject | Processing | Purpose | ProfBloom's role | Legal basis |
|---|---|---|---|---|
| Teacher or student | Data processed on the teacher's behalf | Provide the features requested by the teacher | Processor for the teacher | Determined by the teacher |
| Teacher | ProfBloom account | Create and manage the account | Controller | Performance of the contract |
| Teacher | Observation of how the application is used: pages visited, clicks, masked session recordings | Understand how the application is used in order to improve it | Controller | Consent, optional and withdrawable at any time in Settings |
| Teacher | ProfBloom subscription and billing | Manage the subscription and billing | Controller | Performance of the contract for managing the subscription; legal obligation for accounting requirements |
| Student | ProfBloom account and teaching data | Ensure continuity of the student's progress tracking and personalise the content and features offered to them | Controller | Performance of the contract |
| Visitor or prospective customer | Forms, waiting list, webinars and newsletter | Respond to enquiries and manage the communications requested | Controller | Pre-contractual steps for commercial enquiries; consent for the waiting list, webinars and the newsletter |
| Site visitor | Site audience measurement: pages viewed, navigation path, where visits come from (PostHog, Google Analytics) | Understand how the site is used in order to improve it | Controller | Consent, given or refused in the cookie banner, withdrawable at any time |
| Site visitor or teacher | Measurement of our Google Ads and Meta campaigns, sign-ups and subscriptions coming from an ad, ProfBloom advertising on other sites | Measure how effective our ads are and show ProfBloom ads | Controller; joint controller with Meta for collection through the Pixel | Consent, given or refused in the cookie banner, withdrawable at any time |
ProfBloom does not carry out any decision-making based solely on automated processing that produces legal effects concerning Users or significantly affects them.
Improving ProfBloom
ProfBloom may use previously anonymised data to analyse the use and performance of the Services, to improve its features and content and, in time, to develop and train its own artificial intelligence models. Only generation requests sent to the AI and Students’ work submitted to the AI may contribute to this, once anonymised. The following never contribute: Teaching Content imported or created manually by Teachers, Students’ identities and data from the connected calendar (Google Calendar or Outlook). ProfBloom never sends a Student’s identity to the AI. To date, ProfBloom does not train any model of its own.
Providers and processors
ProfBloom uses the following providers to deliver and operate its Services:
| Provider | Function | Where your data is stored | Transfer outside the EEA |
|---|---|---|---|
| Supabase | Database and file storage | Paris, France | No storage outside the EEA; remote access possible, governed by the standard contractual clauses |
| Vercel | Application hosting | Paris, France | No storage outside the EEA; remote access possible, governed by the standard contractual clauses |
| Brevo | Sending emails | France (backup copy in Belgium) | No |
| Stripe | Payment and subscription processing | European Union | No storage outside the EEA; remote access possible, governed by the standard contractual clauses |
| Mistral AI | AI-assisted generation of teaching content from anonymised data | European Union | No |
| Google Calendar or Microsoft Outlook (depending on the connected calendar) | Calendar synchronisation, where enabled | In your Google or Microsoft account, in the United States | Yes, only if you connect a calendar; governed by the standard contractual clauses |
| Zoom | Creation of video call links, if the teacher connects their Zoom account | In the teacher’s Zoom account, in the United States | Yes, only if the teacher connects Zoom; the teacher uses their own Zoom account, under Zoom’s terms |
| Sentry | Technical error monitoring from pseudonymised data | Frankfurt, Germany | No storage outside the EEA; remote access possible, governed by the standard contractual clauses |
| Crisp | Support chat, where used | Amsterdam, Netherlands | No storage outside the EEA; technical relays possible, governed by the standard contractual clauses |
| PostHog | Observation of how the application is used and site audience measurement, with your consent | Frankfurt, Germany | No storage outside the EEA; remote access possible, governed by the standard contractual clauses |
| Google (Google Ireland Limited) | Audience measurement (Google Analytics) and ad measurement (Google Ads), with your consent | European Union and United States | Yes, only with your consent; governed by the EU–US Data Privacy Framework |
| Meta (Meta Platforms Ireland Limited) | Ad measurement and ProfBloom advertising on Facebook and Instagram (Meta Pixel), with your consent | Ireland and United States | Yes, only with your consent; governed by the EU–US Data Privacy Framework |
Transfers of data outside the European Economic Area
ProfBloom’s data is stored in the European Union, as shown in the providers table. Where a provider is established outside the European Economic Area (EEA), remote access to that data from its country remains possible, for example for maintenance; where you choose to connect an external calendar (Google Calendar or Outlook), your calendar data is processed in the United States. In both cases, the transfer is governed by the standard contractual clauses adopted by the European Commission, incorporated into the data processing agreement concluded with each provider. If you accept audience measurement or advertising in the cookie banner, your browsing data on the site is also sent to Google and Meta, which may process it in the United States; these transfers are governed by the EU–US Data Privacy Framework.
Data retention period
ProfBloom retains data only for as long as necessary for the purposes for which it is processed, subject to applicable legal obligations.
| Category of data | Retention period |
|---|---|
| Teacher or student account data | For the lifetime of the account, then deleted within 30 days of its closure |
| Data processed on the teacher's behalf | For the duration of the provision of the Services, then deleted within 30 days of the closure of the teacher's account, or on their instruction |
| Pronunciation review recordings | Attempts: never sent or kept (they stay on the student’s device). Recordings kept by the student: until the student deletes them, deletes their account, or their teacher deletes their profile or their own account |
| ProfBloom subscription billing data | The period required by applicable legal obligations |
| Prospective customers and waiting list | Until consent is withdrawn, or for three years from the last contact |
| Requests sent from a teacher’s public page | Unconfirmed booking request: deleted within two days after the confirmation link expires. Abuse-prevention counters: eight days at most. |
| Newsletter | Until unsubscription or withdrawal of consent |
| Connected calendar data | Until the calendar is disconnected, as described in the dedicated section |
| Requests sent to the AI (Mistral AI) | The text of the request and the generated answer are kept by Mistral AI for at most 30 days, solely for abuse monitoring, then deleted. They are not used to train Mistral AI’s models. Generated exercises are kept in ProfBloom with the teacher’s data |
| Usage observation (consenting teachers) | Statistics: viewable for 12 months. Session recordings: 1 month at most. Collection stops when consent is withdrawn. Your data is erased on simple request |
| Audience measurement and advertising (consenting visitors) | Measurement and advertising cookies: 13 months at most. PostHog statistics: 12 months; Google Analytics: 14 months. Collection stops and cookies are deleted when consent is withdrawn |
| Your cookie choices | Choice kept for 6 months in your browser, after which you are asked again. Proof of the choice (without your account, email address or IP address): 13 months |
| Technical, security and log data | A limited period necessary for the security and operation of the Services |
Where ProfBloom acts as a processor handling the teacher's accounting data, it is for the teacher, as controller, to determine and comply with the retention periods applicable to them. ProfBloom retains and processes that data in accordance with the teacher's instructions and the conditions laid down for the provision of the Services.
Security and data protection
Data security is a priority for ProfBloom. Technical and organisational measures are in place to protect the confidentiality, integrity and availability of the data processed. The main measures are as follows:
- Encryption in transit: all communications between your browser, our servers and third-party services are encrypted (HTTPS/TLS); unencrypted access to the site is refused.
- Encryption at rest: the database is encrypted by our host; the most sensitive secrets, in particular access tokens for connected services such as Google Calendar or Outlook, are further encrypted by the application itself (AES-256-GCM), with a key separate from the database, before any storage.
- Authentication: sign-in is by single-use link sent by email or via Google or Microsoft; teachers are strongly encouraged to enable two-factor authentication (TOTP app or security key/passkey).
- Data separation: data is attached to the accounts concerned, and controls at both application and database level (row-level access rules) prevent access to another account's data. Students only access the data and features available to them within their own space.
- Least privilege: technical access to the database is limited to what is strictly necessary; ProfBloom's teams access the content of the data only where necessary to provide, secure or support the Services, or where a legal obligation requires it.
- Monitoring: technical errors and incidents are logged in order to detect and correct malfunctions. Cookies, tokens and secrets are redacted from those logs, and accounts are identified only by a technical identifier.
- Handling of breaches: in the event of a personal data breach, ProfBloom applies the notification and information procedures laid down by the GDPR.
Connected calendar data (Google Calendar or Outlook)
If the teacher connects their Google or Microsoft calendar, ProfBloom accesses only the data necessary to synchronise their schedule:
- Read (
calendar.calendarlist.readonlyandcalendar.events.readonly) : the list of the teacher's calendars and the events of the selected calendars (title, dates, participants), in order to import existing lessons and determine availability. - Write (
calendar.events.owned, limited to calendars the teacher owns) : creation, update and deletion of the events corresponding to lessons booked in ProfBloom (student's first name, time, video call link).
Imported events are stored in ProfBloom's database and reduced to the minimum necessary to synchronise the schedule. Google or Microsoft access tokens are encrypted (AES-256-GCM) before storage, and the measures described in the “Security and data protection” section apply to that data.
When Google Calendar is disconnected, ProfBloom asks Google to revoke the authorisation and deletes the access tokens. When Outlook is disconnected, ProfBloom deletes the access tokens; Microsoft does not allow revocation from an application: the permission granted to ProfBloom remains visible in the Microsoft account (Privacy, Apps and services) until the teacher withdraws it. In both cases, imported events with no associated lesson are also deleted. If access is revoked directly from the Google or Microsoft account, the connection is disabled and the access tokens that have become invalid are erased.
Data from the connected calendar is never sold, used for advertising purposes or used to train artificial intelligence models. It is disclosed only to the processors necessary to provide and secure the Services, under the conditions described in this policy.
The teacher may revoke this access at any time from ProfBloom's settings or from their Google or Microsoft account permissions. On disconnection, or when a calendar is deselected, imported events with no associated lesson are deleted. Lessons created from calendar events remain under the teacher's control and can be deleted from ProfBloom.
ProfBloom's use of information received from Google APIs, and its transfer to any other application, complies with the Google API Services User Data Policy, including its Limited Use requirements.
Data from the connected Zoom account
If the teacher connects their Zoom account, ProfBloom creates for them, in that account, one permanent video call room per student or per group. ProfBloom does not access the meetings themselves, their content, recordings or the list of participants.
Data sent to Zoom: the name given to the room, that is, the student’s first name or the group’s name. No student email address and no teaching content is sent.
Data kept by ProfBloom: the identifier of the teacher’s Zoom account, the link and identifier of each room created, and the Zoom access tokens, encrypted (AES-256-GCM) before storage. The room link is shown to the teacher and to the student concerned, and copied into the lesson’s calendar event if a calendar is connected.
The teacher may disconnect Zoom at any time from the ProfBloom settings: ProfBloom then asks Zoom to remove the authorisation and deletes the access tokens. If the teacher removes ProfBloom from their Zoom account, or deletes their ProfBloom account, the tokens are deleted in the same way. Rooms already created remain in the teacher’s Zoom account, where the teacher can delete them.
Data from the Zoom account is never sold, used for advertising purposes or used to train artificial intelligence models.
Cookies
Some cookies are essential for the site and the application to work. The others, for audience measurement and advertising, are only set with your consent, given or refused in the banner shown on your first visit. No browsing data is sold.
ProfBloom is served from three addresses: profbloom.com (website and tutors' public pages), app.profbloom.com (tutor and student spaces) and profbloom.live (live sessions). Sign-in cookies are only set on app.profbloom.com and are never read by the other two addresses; the profbloom.com website only sets its language and consent-choice cookies. Only the cookie that stores your cookie choice is shared by profbloom.com and app.profbloom.com: a choice made on one of these addresses applies to the other.
The following essential cookies do not require prior consent, in accordance with Article 82 of the French Data Protection Act:
- Session cookies : keep you signed in to your space. Duration: the length of the session, extended on each visit.
pb_consent: keeps your cookie choices (audience measurement, advertising) and the version of the banner they answer. Duration: 6 months, after which you are asked again.pb_locale: stores the language you have chosen. Duration: 1 year.pb_locale_hint: stores the language of the last page of the site you viewed, so that sign-in and sign-up are shown in the same language. Duration: 1 year.pb_newsletter_optin: temporarily stores the choices made at sign-up (newsletter, taking part in improving features, answers given on the order page, where the visit came from), until your address is confirmed. Duration: 1 hour, then deleted as soon as it has served its purpose.pb_analytics_optin: temporarily stores your choice regarding usage observation, until your address is confirmed. Duration: 1 hour, then deleted as soon as it has served its purpose.pb_active_fiche: for a student taught by several teachers, stores the space currently being viewed. Duration: 1 year.
The Crisp messaging tool sets its own cookies when you start a conversation, in order to keep the thread. Those cookies are only created when you use that feature.
Audience measurement, with your consent. PostHog, hosted in the European Union, records the pages viewed, the navigation path and where the visit came from; it sets no cookie but stores a technical identifier in your browser’s local storage. Google Analytics measures the same information with the _ga and _ga_* cookies, lasting 13 months at most.
Advertising, with your consent. Google Ads (_gcl_* cookies) and Meta Pixel (_fbp and _fbc cookies) measure visits, sign-ups and subscriptions coming from our ads and let us show you ProfBloom ads on other sites, including Facebook and Instagram. If you create an account after accepting advertising, your email address is sent to Google and Meta in hashed (pseudonymised) form, to link the sign-up to the ad. For collection through the Pixel, Meta and ProfBloom are joint controllers.
Without your consent, only an anonymous count of visits is made, with no cookie and no identifier (Vercel Web Analytics).
You can change or withdraw your choice at any time with the “Manage cookies” link at the bottom of every page of the site. Withdrawing immediately stops measurement and advertising and deletes their cookies from your browser.
Each choice is recorded without your account, email address or IP address (only a random identifier, also kept in your browser, the banner version, your choices and their date) so that it can be proven. This record is kept for 13 months.
Usage observation (teachers only). If you tick the box offered at sign-up, or switch the setting on in Settings, ProfBloom records the pages you visit, your clicks and session recordings in which all text, input fields and media are masked. This is done with PostHog, hosted in the European Union. It sets no cookie: it stores a technical identifier in your browser's local storage. It is never active in the student space, nor before you have consented. You can turn it off at any time in Settings: recording stops at once in the current tab, and in your other open tabs as soon as they load their next page; local storage is cleared.
You can delete or block cookies from your browser settings. Some features may then be affected, in particular staying signed in and remembering your language.
Your rights
In accordance with the GDPR, you have, depending on the processing concerned, rights of access, rectification, erasure, portability, objection and restriction of processing. Where processing is based on your consent, you may withdraw it at any time.
Where ProfBloom acts as a controller, in particular for teacher and student account data, you may exercise your rights directly with ProfBloom.
Where ProfBloom acts as a processor for the teacher, requests relating to the data processed on their behalf must be addressed to the teacher concerned in the first instance. ProfBloom assists them in handling such requests in accordance with the GDPR.
To exercise your rights with ProfBloom: privacy@profbloom.com
Contact and complaints
ProfBloom is the controller for the processing identified as such in this policy.
For any question relating to the protection of your personal data, or to exercise your rights, you may contact ProfBloom at the following address: privacy@profbloom.com
You also have the right to lodge a complaint with the French data protection authority (CNIL).