Last updated: 10 October 2026
The rules and expectations for using namaa bloom as an educator.
Read →What data we collect, how we use it, and your rights over it.
↓ You are hereOur 14-day refund window and how to request one.
Read →namaa bloom ("we", "us", "our") operates the platform at namaabloom.com. We are committed to protecting the privacy of educators and the students they serve. This Privacy Policy explains what data we collect, why we collect it, how we use it, and your rights in relation to it.
For privacy enquiries: hello@namaabloom.com
We process personal data only where we have a lawful basis to do so under the UK GDPR and EU GDPR.
Account data (name, email address)
Legal basis: Contract — necessary to provide and manage your account.
Collected when you sign in via Google OAuth or email magic link.
Content you create (student names, class names, observation notes, custom observation bank entries)
Legal basis: Contract — necessary to deliver the core service you have requested.
Stored in our platform and associated with your account only.
Optional voice observations (short teacher recordings and their transcripts)
When you choose to dictate an observation, the recording is sent to Google Cloud Speech-to-Text in the EU for transcription. NamaaBloom does not save the recording. You review and confirm the transcript before it becomes an observation in a report.
Payment and billing data
Legal basis: Contract and Legal Obligation.
Payment transactions are handled entirely by Paddle.com Market Limited, our Merchant of Record. We do not store card numbers or full payment details. Paddle shares with us only the data necessary to fulfil your order (e.g. subscription status, billing email). Paddle's processing is governed by Paddle's Privacy Policy.
Usage data (IP address, browser type, pages visited, timestamps)
Legal basis: Legitimate Interests — to maintain security, prevent fraud, and improve the Service.
Standard server logs retained for up to 90 days.
Support communications (emails you send us)
Legal basis: Legitimate Interests — to respond to and resolve your enquiries.
We use your data strictly for the following purposes. We do not use your data for advertising or sell it to third parties.
Marketing: We will only send you marketing communications if you have given explicit opt-in consent. You may withdraw that consent at any time by clicking "Unsubscribe" in any email or contacting us directly.
We share data with trusted sub-processors where necessary to deliver the Service. Each is bound by a data processing agreement and may only process your data for the specific purpose described.
Paddle.com Market Limited — Payment processing and Merchant of Record. Processes billing data, subscription status, and purchase history on our behalf. Paddle Privacy Policy · Paddle GDPR Resources
Google Cloud Platform — Secure hosting of account and content data. Data is stored in the European Union (europe-west1, Belgium). Google Cloud DPA
Google Cloud Speech-to-Text — Processes optional teacher voice recordings through its EU endpoint to return an editable transcript. NamaaBloom does not keep the audio recording.
Google Gemini API — Powers the AI report generation feature. When you generate a report, the content you provide (student name, observations, notes) is sent to the Gemini API to produce the written report text. Google does not use API inputs to train its models under the standard API terms. We recommend you do not enter sensitive special-category data when generating reports.
Email delivery provider — Transactional email delivery for report dispatch and authentication emails, sent from noreply@namaabloom.com.
You may request the full list of named sub-processors by emailing hello@namaabloom.com.
Reports are sent via our transactional email service using noreply@namaabloom.com. Family email addresses you provide are stored encrypted in your student roster and used solely to deliver reports on your explicit instruction. We do not contact families independently, nor use family addresses for any purpose other than delivering the reports you initiate.
Your account and student data is stored in the European Union (Google Cloud, Belgium). Report generation involves a transfer to the Google Gemini API; this is covered by Google's Standard Contractual Clauses approved by the European Commission. We do not transfer your data to any other third countries except as described in Section 4.
We retain your account and content data for as long as your account is active. If you request deletion, we will remove your personal data within 30 days, except where we are required to retain it for legal or regulatory obligations (e.g. financial records required by law). Server logs are retained for up to 90 days.
Under the UK GDPR and EU GDPR, you have the following rights:
To exercise any right, email hello@namaabloom.com. We will respond within 30 days. You also have the right to lodge a complaint with your national supervisory authority (in the UK: the ICO; in the EU: your local Data Protection Authority).
We use only essential session cookies required for authentication and security. We do not use tracking, advertising, or analytics cookies. No third-party cookies are set. You can disable cookies in your browser settings, but this may prevent you from signing in.
We implement the following security measures to protect your data:
No system is perfectly secure. Please report any security concerns promptly to hello@namaabloom.com.
namaa bloom is a tool for educators, not for direct use by children. Student data (names, observations) entered by educators is managed under the educator's responsibility and their institution's data protection policies. We act as a data processor for such data under your instruction. We do not knowingly collect data directly from individuals under 18.
namaa bloom serves schools in the Kingdom of Saudi Arabia. Where we process personal data of Saudi residents, we do so in compliance with the Saudi Personal Data Protection Law (Royal Decree M/19, 1443H / 2021 CE, as amended by Royal Decree M/148 / 2023).
Schools and institutions that require a formal Data Processing Agreement under GDPR Article 28 or the Saudi PDPL may request one by emailing hello@namaabloom.com. A countersigned copy will be returned within 5 business days. The DPA covers sub-processors, data categories, security measures, breach notification, and deletion obligations.
We may update this Privacy Policy periodically. We will notify registered users of material changes via email at least 30 days before they take effect. The "last updated" date at the top reflects the most recent revision.
Privacy questions or data requests: hello@namaabloom.com
Payment data queries: Paddle Privacy Policy