Privacy Policy

How we collect, use, and protect your information at Blue.

Last updated: April 12, 2026

1. Introduction

This Privacy Policy explains how Bloo, Inc. (“Blue”, “we”, “us”, or “our”) collects, uses, discloses, and protects information about you when you use our process management platform and related services (collectively, the “Service”).

This Privacy Policy applies to information we collect when you use our Service, visit our websites, or otherwise interact with us. By using our Service, you agree to the collection and use of information in accordance with this policy.

2. Definitions

  • “Personal Data” means any information relating to an identified or identifiable natural person
  • “Processing” means any operation performed on Personal Data
  • “Data Controller” means the entity that determines the purposes and means of Processing
  • “Data Processor” means an entity that Processes Personal Data on behalf of the Data Controller
  • “User” means an individual who uses our Service
  • “Customer” means the entity that has entered into an agreement with us

3. Information We Collect

3.1 Information You Provide

Account Information:

  • Name and email address (required)
  • Job title and phone number (optional)
  • Company or organization name
  • Profile picture (optional)

Payment Information:

  • Billing name and address
  • Payment method details (processed by Stripe - we only store last 4 digits)
  • Tax identification numbers where required

Content and Files:

  • Any content you create, upload, or share within the Service
  • Files and attachments you add to projects
  • Comments and communications within the platform

Support and Communications:

  • Information you provide when contacting support
  • Feedback and suggestions about our Service
  • Testimonials and case studies (with your consent)

3.2 Information We Collect Automatically

Usage Data:

  • Features you use and actions you take
  • Time spent on different parts of the Service
  • Search queries within the platform
  • Performance metrics and error reports

Device Information:

  • IP address and approximate location
  • Browser type and version
  • Operating system
  • Device type and unique identifiers
  • Language preferences

Log Data:

  • Access times and dates
  • Pages viewed and features accessed
  • System activity and error logs
  • Referral URLs

3.3 Information from Third Parties

  • Information from integration partners (with your authorization)
  • Publicly available information for verification purposes

4. Cookies and Tracking Technologies

We use only strictly necessary cookies to keep you logged in and maintain your session. We do not use analytics cookies, preference cookies, or any third-party tracking cookies.

Types of Cookies We Use:

  • Essential Cookies: Required for authentication and session management

These cookies are strictly necessary for the Service to function. They cannot be disabled without preventing access to the Service.

5. How We Use Your Information

We use the information we collect to:

5.1 Provide and Maintain the Service

  • Create and manage your account
  • Provide customer support
  • Process transactions and billing
  • Send service-related communications

5.2 Improve and Develop the Service

  • Analyze usage patterns and trends
  • Test new features and improvements
  • Fix bugs and technical issues
  • Conduct research and analysis
  • Comply with legal obligations
  • Protect against fraud and abuse
  • Enforce our Terms of Service
  • Protect our rights and property

5.4 Automated Content Analysis

We use artificial intelligence services (including Anthropic and OpenAI) to automatically scan files, content, and data stored on the Service for the following purposes:

  • Terms of Service enforcement: Detecting content that violates our prohibited uses, including illegal content, malware, phishing, and spam, as defined in our Acceptable Use Policy
  • Abuse detection: Identifying patterns of misuse, automated scraping, or other prohibited activities
  • Compliance: Ensuring content complies with applicable laws and regulatory requirements
  • Platform safety: Protecting the integrity of the Service and the safety of our users

Blue is not obligated to monitor Content, but has the right to access, review, and examine any Content stored on the Service, including file contents, for the purpose of operating the Service, ensuring compliance with our Terms of Service, and complying with applicable law. This includes both automated AI scanning and human review, at any time, without prior notice. AI systems flag potential violations; all enforcement decisions are made by humans.

We do not use Customer Data to train AI models without explicit consent.

File contents may be processed by third-party AI service providers (OpenAI, Anthropic) located within the European Union for scanning purposes. These providers are maintained in our Data Processing Agreement.

5.5 Communications

  • Send product updates and announcements
  • Provide tips and best practices
  • Respond to your inquiries
  • Send marketing communications (with consent)

We process Personal Data on the following legal bases:

  • (a) Contractual necessity: Processing required to deliver the Service, including account management, billing, and providing core platform functionality.
  • (b) Legitimate interest: Processing for analytics and service improvement, security and fraud prevention, content scanning for Terms of Service enforcement, and platform safety. Our legitimate interests in maintaining a safe and compliant platform are balanced against users’ reasonable privacy expectations.
  • © Consent: Processing for marketing communications where you have opted in.
  • (d) Legal obligation: Processing required to comply with applicable law, including retention of tax and financial records.

For users in the European Economic Area, please see our GDPR Policy for additional detail on our legal basis for processing.

7. How We Share Information

We do not sell your Personal Data. We share information only in these circumstances:

  • When you explicitly authorize sharing
  • For testimonials or case studies
  • When you use third-party integrations

7.2 Service Providers

We share data with third-party service providers who assist us in operating and providing the Service, including providers of infrastructure, payments, communications, AI services, mobile platforms, monitoring, and integrations.

All service providers are contractually required to protect your data and use it only for specified purposes. A complete and current list of our subprocessors is maintained in our Data Processing Agreement.

We may disclose information if required by law:

  • In response to valid legal process (warrant, subpoena, court order)
  • To protect our rights, privacy, safety, or property
  • To prevent fraud or illegal activity
  • In connection with a merger or acquisition

8. Data Retention

We retain your information for as long as necessary to provide the Service and fulfill the purposes outlined in this policy:

  • Account Data: Retained while your account is active
  • Usage Data: Retained for up to 2 years for analytics
  • Support Tickets: Retained for 3 years for quality assurance
  • Billing Records: Retained for 7 years for tax compliance
  • Deleted Content: Removed from active systems within 90 days of deletion
  • Backups: May persist for up to 90 days after deletion

9. Your Privacy Rights

9.1 Access and Portability

You have the right to:

  • Access your Personal Data
  • Receive a copy in a portable format
  • Know what data we hold about you

9.2 Correction and Deletion

You have the right to:

  • Correct inaccurate data
  • Update incomplete information
  • Request deletion of your data (“right to be forgotten”)

9.3 Restriction and Objection

You have the right to:

  • Restrict Processing of your data
  • Object to certain types of Processing
  • Opt out of marketing communications

9.4 How to Exercise Your Rights

To exercise any of these rights:

  • Email us at [email protected]
  • Use in-app privacy controls where available
  • We will respond within one month

9.5 Right to Lodge a Complaint

You have the right to lodge a complaint with your local data protection supervisory authority. If you are in the EU or EEA, this is the data protection authority in your country of residence or place of work. For additional information on supervisory authorities, see our GDPR Policy.

10. US State Privacy Rights

10.1 California

California residents have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

  • Right to Know: What Personal Data we collect, use, and share
  • Right to Delete: Request deletion of your Personal Data
  • Right to Correct: Request correction of inaccurate Personal Data
  • Right to Opt-Out: We do not sell Personal Data
  • Right to Non-Discrimination: Equal service regardless of privacy choices

10.2 Other US States

Residents of other US states with applicable privacy laws — including Delaware, Iowa, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, and Kentucky — may have similar rights under their respective state laws, including the right to access, delete, and correct your Personal Data, and the right to opt out of the sale of Personal Data. We do not sell Personal Data.

To exercise any US state privacy rights, contact [email protected].

11. International Data Transfers

All customer data is stored and processed within the European Union (Germany). All AI content scanning is performed using EU-based endpoints. Customer data is not transferred outside the EU for scanning purposes.

Limited operational data (such as support communications) may be transferred to the United States (our headquarters). For any transfers to countries without an adequacy decision, we use Standard Contractual Clauses (SCCs) as the transfer mechanism. We ensure appropriate safeguards are in place for all international transfers.

For EU residents, please see our GDPR Policy for specific information about transfers outside the EEA.

12. Data Security

We implement appropriate technical and organizational measures to protect your information:

  • Encryption at rest and in transit (TLS/SSL)
  • Access controls and authentication
  • Regular security audits and testing
  • Incident response procedures
  • Employee training on data protection

While we strive to protect your information, no system is 100% secure. We encourage you to use strong passwords and protect your account credentials.

13. Children’s Privacy

Our Service is not directed to individuals under 18. We do not knowingly collect Personal Data from individuals under 18. If you believe we have collected data from such an individual, please contact us immediately.

14. Marketing Communications

We may send you marketing communications if you have:

  • Opted in to receive them
  • Not opted out after receiving them
  • An existing business relationship with us

You can opt out anytime by:

  • Clicking “unsubscribe” in any marketing email
  • Updating your communication preferences in account settings
  • Contacting [email protected]

Our Service may contain links to third-party websites. We are not responsible for their privacy practices. We encourage you to read their privacy policies.

16. Changes to This Policy

Changes to this Privacy Policy are governed by Section 19 of our Terms of Service.

Your continued use after changes constitutes acceptance of the updated policy.

17. Data Protection Officer

While not formally required to have a Data Protection Officer, privacy inquiries can be directed to:

Emanuele Faja, CEOEmail: [email protected]

For privacy-related questions or to exercise your rights:

Email: [email protected]Subject Line: Privacy Request

We aim to respond to all privacy requests within one month.