Data Deletion Policy

The Company handles deletion in line with the California Consumer Privacy Act, as amended by the California Privacy Rights Act (California Civil Code sections 1798.105 and 1798.130), other applicable United States state consumer privacy laws that provide a right to delete, the Children's Online Privacy Protection Act (COPPA) where it applies, and any other deletion right that applies to the Member. Where the Company has collected tax information, it also follows Internal Revenue Service recordkeeping rules.

Connecting Instagram allows the Company to receive profile and related data from Meta. A Member can delete that data without closing the Bloomkare account:

1. [Sign in] Sign in to Bloomkare on the website with the account that connected Instagram.
2. [Open Socials] Open Settings and go to the Socials section.
3. [Disconnect Instagram] On the Instagram card, choose Disconnect and confirm. The Company then deletes the Instagram access token and the Instagram profile information stored for that account. An expired Instagram or TikTok login is not deletion: the Company keeps the stored profile so the Member can reconnect that account. Disconnect, or account deletion under Article 2, is what removes the stored profile.
4. [Removing Bloomkare inside Instagram or Facebook] Removing Bloomkare from Instagram or Facebook under Apps and Websites stops the Company from receiving new data from Meta. That removal does not erase data the Company already stored. To delete the stored copy, disconnect Instagram as described above, delete the Bloomkare account under Article 2, or send the email request under Article 5.

A creator can permanently delete their own Bloomkare account from Settings. The control is available when the creator is signed in as themselves. Deleting the account also deletes linked Instagram data and linked TikTok data.

1. [Open Profile settings] Sign in, open Settings, and go to the Profile section.
2. [Start deletion] Under Delete Account, choose Delete Account Permanently.
3. [Confirm] Type Delete my account exactly, then confirm. The Company signs the creator out and deletes the sign-in. This cannot be undone, and the same account cannot be restored.
4. [Campaigns in progress] Active campaign participations end, and pending shipments are canceled, as part of deletion. An open campaign does not block the request.

When a creator confirms account deletion, the Company does the following:

1. [Identity and contact details] The Company removes the creator's name, profile photo, date of birth, gender, phone number, and niche selections from the profile, replaces the account email with a non-identifying address, and deletes saved shipping addresses.
2. [Instagram and TikTok data] The Company deletes Instagram access tokens and stored Instagram profile data, and deletes TikTok access tokens and stored TikTok profile data. The Company does not keep the creator's Instagram or TikTok password; those services are connected only by their own login. Article 4 describes campaign posts, mirrored images, social-account history, and quality scores that can remain after those rows are deleted.
3. [Campaign and shipment history] Shipment recipient details, including street address, phone number, and email, are cleared. Campaign and shipment rows that brands rely on for fulfillment history remain, shown as an anonymized "Withdrawn user," without the creator's name or contact details.
4. [Rewards and saved campaigns] Any Bloom Points balance on the account is forfeited. Saved campaign favorites are deleted. Accounting entries that no longer carry the creator's name or contact details may remain.
5. [Service providers] The Company deletes the personal information from its own systems and directs service providers that process it for the Company, such as hosting, email, and logistics providers, to delete it, except where Article 4 allows the Company to keep it.

The right to delete is not absolute. California Civil Code section 1798.105(d), and similar state laws, allow a business to keep information when it needs that information to complete a contract, protect security, or meet a legal duty. On that basis, the Company may keep:

1. [Anonymized operations records] De-identified campaign, shipment, and accounting records described in Article 3, so the Company can finish fulfillment history and brand reporting without identifying the creator.
2. [Fraud and account-security records] A one-way record derived from the email address or phone number on the account, used only to recognize a later registration by the same person for fraud prevention and existing risk restrictions. The Company does not use that record to contact the creator or to restore the account. The Company does not use a shipping address as that record.
3. [Campaign posts and performance] Campaign post rows may keep the platform media identifier and the public post URL, along with performance snapshots such as views. Those rows stay attached to the anonymized withdrawn account so brands can keep campaign reporting. They do not include the creator's name, email, phone, or shipping address.
4. [Mirrored images] A copy of a profile image or cover image that the Company stored for display may remain in file storage after the profile row is deleted.
5. [Social account history] A record that the deleted account was linked to a particular Instagram or TikTok account may remain, without the access token, so the Company can apply existing fraud and risk restrictions if that social account is linked to a later registration.
6. [Quality scores] A numeric content-quality score previously stored for the account may remain on the anonymized profile. It is not a name or a contact detail.
7. [Legal claims and unpaid obligations] The minimum information required to resolve an open dispute, a claim for no-show liquidated damages, or another unpaid obligation, until that matter is closed. This is the same limit stated in the Privacy Policy.
8. [Tax and other legal duties] Tax or accounting information the Company is required to keep, including information collected for IRS reporting when rewards pass the applicable threshold. The ordinary federal period is at least three years after the return is filed, and at least four years for employment-tax records. The Company keeps these records only for that legal period.
9. [Backups] Copies that remain only in routine backups are overwritten on the normal backup cycle. The Company does not restore a backup in order to recreate a deleted account.

1. [When to use email] A Member who cannot sign in, including a person who has already removed Bloomkare from Instagram or Facebook, may request deletion by emailing glow@bloomkare.com. The message should come from the email on the account, or should include that email, and should state whether the request is to delete Instagram data, the Bloomkare account, or both. If Instagram was connected, include the Instagram username.
2. [Verification and timing] The Company may ask for information reasonably needed to confirm that the requester controls the account. A deletion completed inside Settings is processed when the creator confirms it. For a request sent by email, the Company completes a verified request within forty-five (45) days, as required by California Civil Code section 1798.130. If the Company needs more time, it will notify the requester of one extension of up to an additional forty-five (45) days and the reason for the extension.
3. [If the account is not found] If the Company has no Bloomkare account or stored Instagram data for the person identified in the request, it will say so. There is then nothing further to delete.

The Company's services are not available to anyone under 18. The Company does not knowingly collect personal information from children under 13. If the Company learns that it has collected personal information from a child under 13, or that a Member is under 18, it will suspend the account and delete the related personal information without undue delay, as required by COPPA and the Company's age rules.

Deletion requests and questions about this Policy must be sent through the channels below. This Policy is incorporated with the Privacy Policy, which describes the categories of personal information the Company collects.

• Company Name: BLOOMKARE INC
• US Office Address: 8 The Green, Ste A, Dover, DE 19901, United States
• Official Support Email: glow@bloomkare.com