blumee

Privacy Policy

English summary · last reviewed 2026-10-03

Blumee is a German AI bouquet search service. We are committed to collecting as little personal data as possible. The legally binding version of this notice is the German Datenschutzerklärung.

Controller

Andrei Antonov (Einzelunternehmer). Contact: [email protected].

What we collect

  • A pseudonymous device identifier (stable, stored locally on your device). Under GDPR Art. 4 (5) this is pseudonymous, not anonymous data.
  • Search interactions, result counts, and pseudonymous click-throughs to partner stores.
  • Photos you submit for visual search — processed transiently, never stored. Only the photo or text itself goes to Pl@ntNet and OpenAI, never the device identifier.

Using Blumee through an AI assistant (ChatGPT plugin / MCP)

Blumee offers a Model Context Protocol endpoint at https://api.blumee.app/mcp that AI assistants such as ChatGPT use as a plugin. The assistant's provider (e.g. OpenAI) is the independent controller of your conversation; Blumee only receives what the assistant passes to the plugin for a search:

  • Search parameters (search text, flowers, colours, occasion, recipient, price and delivery limits) — purpose: finding matching offers. Kept: only a summary (detected filters, number of results, a one-way hash of the text, never the text itself) for at most 90 days.
  • Photos you attach or link for photo search — downloaded from the temporary address the assistant provides, sent to Pl@ntNet and OpenAI for identification, never stored.
  • IP address of the calling server (for ChatGPT usually the provider's server) — purpose: abuse prevention, rate limits and daily quotas. Counters are deleted within 24 hours; server logs after 14 days.
  • Clicks on “Go to shop” go through blumee.app/go/… and are recorded as a click event (source “mcp”, no device identifier) for affiliate billing with Awin; kept at most 90 days.

Recipients: Pl@ntNet and OpenAI (photo and text understanding), Awin (only after you click through to a shop), our EU hosting. Not processed: accounts, names, email addresses or other contact data. Your controls: you can disconnect the plugin at any time in your assistant's settings, and exercise the rights below by email.

What we don't do

  • We don't link data to your identity, phone or email.
  • We don't use third-party ad SDKs or trackers.
  • We don't sell or rent your data.

Recipients of your data

  • Pl@ntNet (CIRAD, France) — flower species identification. We send only the photo, with no device identifier or other information about you. Under its terms of use Pl@ntNet keeps the photo in memory during identification and does not store it; it logs the date and time of our API account's requests (quota and statistics). Pl@ntNet offers no data processing agreement, so it processes the request as an independent recipient under its own terms. Legal basis for the transfer: GDPR Art. 6 (1) (b) — carrying out the photo search you started.
  • OpenAI Ireland Ltd. — semantic understanding of search queries and bouquet photos. Processing may take place in the USA; we rely on EU Standard Contractual Clauses (GDPR Art. 46 (2) (c)) plus supplementary measures required by Schrems II: TLS 1.2+ in transit, AES-256 at rest, contractual opt-out from training on your inputs (zero data retention), pseudonymisation of requests and a short server-side retention of at most 30 days.
  • Awin AG (Berlin, Germany) and its affiliated Awin Ltd. (London, UK) — affiliate click tracking after you tap through to a partner. The UK transfer is covered by the EU adequacy decision for the UK (GDPR Art. 45), renewed on 19 December 2025 and valid until 27 December 2031.

Cookies and consent

The blumee.app website and the Blumee app load no advertising cookies or comparable trackers. No cookie banner is required since only strictly necessary storage access (language preference, session) takes place (§ 25 (2) no. 2 TDDDG).

When you tap a partner link (“Order on …” in the app, “Beim Partner ansehen” on the website), we send you to the partner's shop through a tracking link of the affiliate network Awin. We pass Awin a pseudonymous click reference (the device identifier in the app, a random per-session ID on the website) — never a name, email address or phone number. Awin and the partner shop may then store cookies or similar identifiers on your device so the purchase can be attributed to our link. That storage is done by Awin and the partner under their own responsibility, not by us; whether and how they ask for your consent depends on their settings, usually the partner shop's cookie banner. See Awin's privacy policy. Without a tap, nothing is sent to Awin.

Server logs

When you visit blumee.app our hosting provider automatically records technical access data: IP address, date and time, requested URL, HTTP status, transferred bytes, referrer, user-agent. These logs are not combined with other data sources and not used to build user profiles. Legal basis: GDPR Art. 6 (1) (f) — legitimate interest in operating a stable, secure website and in abuse prevention. Logs are deleted after 14 days; longer retention only for investigating a concrete security incident.

We deliberately do not run any web analytics: no Google Analytics, no Matomo, no Plausible, no comparable tool.

Retention

Search and click events are kept for at most 90 days in identifiable form, then deleted. Photos (app, website and plugin) are not stored after processing. IP-based rate-limit and quota counters are deleted within 24 hours. Favourites and history live exclusively on your device.

Your rights

Under GDPR you can request access, correction, deletion, restriction, portability, and object to processing of your data. Write to [email protected].

Supervisory authority

You may lodge a complaint with the competent supervisory authority. For us this is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW), Postfach 20 04 44, 40102 Düsseldorf, www.ldi.nrw.de.