Security Overview
At Data Bloo, we take the security and privacy of customer data seriously. This page explains how Data Bloo handles data through its services, including Looker Studio connectors, Data Bloo Hub, and MCP-based connector access.
Our Data Processing Model
Data Bloo helps customers connect third-party data sources, such as marketing platforms, analytics tools, ecommerce platforms, and other supported services, to reporting and AI destinations.
For connector services, Data Bloo accesses customer data only with the customer’s authorization and only for the purpose of providing the requested functionality.
Connector data is generally processed on a passthrough basis. This means Data Bloo fetches the requested data from the connected platform and sends it to the selected destination, such as Looker Studio or an authorized MCP client.
Data Bloo does not warehouse, resell, or retain connector Customer Data beyond what is technically necessary to provide the service.
Data We May Process
Depending on the service used, Data Bloo may process:
- Customer Data retrieved from connected third-party platforms;
- Connection Data required to operate the service;
- account information;
- connector settings;
- authentication tokens or API credentials;
- usage logs;
- error logs;
- billing records;
- support communications.
Connection Data is used only to provide, secure, support, and maintain the Data Bloo services.
Looker Studio Connectors
For Looker Studio connectors, Data Bloo connects to the authorized third-party platform and retrieves the requested data through the relevant API.
The data is then returned to Looker Studio so the customer can create or refresh reports.
Data Bloo does not use connector Customer Data for advertising, resale, or unrelated purposes.
MCP Connectors
Data Bloo MCP allows authorized AI clients, such as ChatGPT, Claude, or other supported MCP-compatible environments, to query connected marketing, analytics, or ecommerce data.
MCP connector access is read-only. Data Bloo MCP connectors do not create, edit, update, or delete data in the connected source platforms.
Customer data is accessed only after the customer authorizes the relevant data source and only in response to permitted user requests.
Customers should also review the privacy and data handling terms of the AI client or MCP environment they choose to use.
And update the GDPR/DPA section like this:
Hosting and Infrastructure
Data Bloo uses trusted infrastructure and hosting providers to operate its services.
Current infrastructure and operational providers may include:
- Google Cloud Platform;
- Cloudways;
- Pressidium;
- Stripe;
- Klaviyo;
- Crisp.
A current list of sub-processors is available in our Data Processing Addendum.
Access Controls
Access to production systems and customer-related data is restricted to authorized personnel and service providers who require access to provide, secure, maintain, or support the service.
Data Bloo follows a need-to-know access approach.
Credentials and API Tokens
Where API credentials, OAuth tokens, or authentication keys are required to operate a connector, they are used only to connect the customer’s authorized data source and provide the requested service.
Customers can revoke access by disconnecting the data source in Data Bloo or by revoking API/OAuth access directly from the relevant third-party platform.
Encryption and Transmission
Data Bloo uses secure transmission methods where supported by the relevant platforms and services.
Third-party data is accessed through official APIs or authorized connection methods.
Logging and Monitoring
Data Bloo may process technical logs, usage logs, and error logs to:
- maintain service performance;
- investigate errors;
- prevent abuse;
- improve reliability;
- secure the platform.
Logs are not used to resell customer data or for unrelated purposes.
Data Retention
Data Bloo does not warehouse or retain connector Customer Data beyond what is technically necessary to provide the service.
Data Bloo may retain operational data, such as account details, connector settings, billing records, logs, and support communications, for as long as necessary to provide the service, comply with legal obligations, resolve disputes, prevent abuse, and maintain security.
Sub-processors
Data Bloo uses selected sub-processors only where necessary to provide, secure, host, bill, support, and communicate about the services.
Not all sub-processors process connector Customer Data. Some process only account, billing, support, website, or operational data.
Our sub-processor list is available in our Data Processing Addendum.
GDPR and Data Processing
Data Bloo P.C. is established in Greece, within the European Economic Area.
Where Data Bloo processes personal data on behalf of a customer, Data Bloo acts as a data processor and the customer acts as the data controller, unless otherwise agreed.
Our Data Processing Addendum is available here:
Incident Response
If Data Bloo becomes aware of a security incident affecting customer personal data, we will investigate the incident and notify affected customers where required by applicable law and contractual obligations.
Contact
For security, privacy, or compliance questions, please contact: info@databloo.com