Privacy Policy

Bouquet Designer is operated by TwentyFive Labs Ltd, a UK-registered company, based in the United Kingdom. We are registered with the Information Commissioner's Office (ICO) under registration number ZC164116. You can verify ICO registrations at ico.org.uk.

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us via the support link in the app or at the email address displayed in the app's Profile screen.

This Privacy Policy should be read alongside our Terms of Use.

We collect and process the following personal data:

• Account information — your name and email address when you create an account.
• Authentication data — if you sign in with Google or Apple, we receive a token confirming your identity; we do not receive your password from those providers.
• Payment information — transaction records and token balance. Full payment card details are handled directly by Stripe and are never stored on our servers.
• Generated bouquet images — the AI-generated images you create, which are stored in your gallery.
• Design choices — your flower selections, colours, presentation styles, and other inputs you provide when creating a bouquet.
• Usage data — token usage history and general app activity (e.g. number of generations).
• Technical information — we may automatically collect:
  • Device type
  • Browser type
  • Operating system
  • App version
  • Usage statistics
  • Error and crash reports

We use your personal data to:

• Create and manage your account.
• Process your payments and maintain your token balance.
• Generate and store your bouquet designs.
• Respond to any enquiries or support requests you send us.
• Improve the reliability and performance of the service.

We process your data on the following legal bases under UK GDPR:

• Performance of a contract — processing your account information and payments is necessary to provide you with the service you have paid for.
• Legitimate interests — we have a legitimate interest in maintaining the security and reliability of our service, and in understanding how the app is used so we can improve it.
• Legal obligation — we may be required to retain certain records (such as payment records) to comply with applicable law.

We do not send marketing communications. If we ever introduce them, we will ask for your explicit consent first.

We share your data with the following third-party processors, each of whom acts only on our instructions and has agreed to appropriate data processing terms:

• OpenAI (USA) — we send your bouquet design inputs (flower choices, colours, styles) to OpenAI's GPT Image 1.5 model to generate the bouquet images. OpenAI processes this data in the United States. See OpenAI's privacy policy at openai.com/privacy.
• Stripe (USA) — we use Stripe to process payments. Stripe handles your payment card details directly and does not share them with us. See Stripe's privacy policy at stripe.com/gb/privacy.
• Replit (USA) — our application and backend are hosted on Replit's cloud infrastructure. See Replit's privacy policy at replit.com/site/privacy.

Some of our third-party processors are based in the United States. Transfers of your personal data to the US are made on the basis of Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner, or other appropriate safeguards as recognised under UK GDPR.

• Account and profile data — retained for as long as you hold an active account.
• Generated bouquet images — retained in your gallery for as long as your account is active, and deleted when you remove them or close your account.
• Payment records — retained for 7 years to comply with financial record-keeping obligations.
• Usage data — retained for up to 12 months.

When you delete your account, we will delete your personal data within 30 days, except where retention is required by law (e.g. payment records).

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your data (subject to legal obligations to retain certain records). You can also delete your account directly in the app via Profile → Delete Account.
• Restriction — ask us to restrict how we process your data in certain circumstances.
• Portability — receive your data in a commonly used, machine-readable format.
• Object — object to processing based on legitimate interests.

To exercise any of these rights, please contact us via the support link in the app or at the contact email shown in the app's Profile screen. We will respond within one month.

If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. Sensitive data (such as authentication tokens) is encrypted in transit and at rest. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

Bouquet Designer is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

For any questions, requests, or concerns regarding this Privacy Policy or your personal data, please email us at Support@bouquetdesigner.co.uk or use the support link in the app's Profile screen.