Privacy Policy
Last updated: April 2026
What we collect
We collect information you provide directly: your name, email address, and payment information when you create an account or subscribe to a plan. We also collect data generated through your use of the Service: campaigns you create, leads and audit results your campaigns produce, outreach drafts you generate, and usage activity within the platform.
How we use your data
We use your data to: provide and operate the Service; process payments; send transactional emails (account activity, billing receipts); improve the Service through aggregated, anonymised usage analysis; and respond to support requests. We do not sell your personal data to third parties.
Legal basis for processing (GDPR)
For users in the European Economic Area, we process your personal data under the following legal bases: (a) Contract — processing necessary to provide the Service you have subscribed to; (b) Legitimate interests — security monitoring, fraud prevention, and service improvement using anonymised data; (c) Consent — where you have explicitly opted in to specific communications.
Third-party processors
We share data with the following service providers who process it on our behalf: Supabase (database and file storage, hosted in the EU/US); Clerk (user authentication and session management); Stripe (payment processing — Stripe handles card data directly and we do not store card numbers); Google (Maps API for business discovery, PageSpeed Insights for audits). Each provider maintains their own privacy and security programmes.
Cookies
We use essential cookies required for authentication and session management (set by Clerk). We do not use third-party advertising cookies. Analytics, if implemented, use anonymised, aggregated data only. You can control cookie preferences through your browser settings, though disabling essential cookies will prevent you from signing in.
Data retention
We retain your account data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law or for legitimate business purposes such as fraud prevention. Audit and lead data is retained for the duration of your subscription.
Your rights
Depending on your location, you may have the right to: access the personal data we hold about you; request correction of inaccurate data; request deletion of your data ("right to be forgotten"); export your data in a portable format; object to or restrict certain processing. To exercise any of these rights, email us at gaurav@blumify.io. We will respond within 30 days.
Security
We implement industry-standard security measures including encrypted data transmission (TLS), encrypted storage, and access controls. However, no method of transmission or storage is 100% secure. We encourage you to use a strong, unique password for your account.
Children
The Service is not directed to individuals under 16. We do not knowingly collect personal data from children. If we become aware that a child has provided personal data, we will delete it promptly.
Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. The date of the most recent update is shown at the top of this page.
Contact
If you have questions about this Privacy Policy or how we handle your data, contact us at gaurav@blumify.io.