PRIVACY POLICY
Last Updated: 11/29/2025
1. WHO WE ARE
Bluflo Solutions Ltd (“we”, “us”, or “our”) acts as the Data Controller for personal data collected through our website [www.bluflo.io] (the “Site”) and for the account information of our direct clients (“Brokers”).
Company Number: [Insert Company Number]
Registered Address: [Insert Registered Address]
Email: support@bluflo.io
2. THE DATA WE COLLECT
We collect data in two capacities:
A. Data You Provide (As a Broker)
- Identity Data: Name, job title, company name.
- Contact Data: Email address, phone number.
- Financial Data: Payment card details (processed securely by our third-party payment provider; we do not store full card numbers).
- Input Data: Text, emails, or messages you manually input or forward to our AI for processing.
B. Automated Data (Site Visitors)
- Usage Data: Session duration, page clicks, scroll depth, and interaction with AI demos.
- Technical Data: IP address, browser type, device information.
- Cookies: We use strictly necessary cookies and analytics cookies (PostHog).
3. HOW WE USE YOUR DATA
We process your data under the following lawful bases:
| Purpose | Type of Data | Lawful Basis |
|---|---|---|
| To provide the Service (Generate quotes, filter leads) | Identity, Contact, Input Data | Performance of Contract |
| To improve our AI Models | Anonymized & Aggregated Input Data | Legitimate Interest |
| To analyze Site performance | Usage Data (via PostHog) | Consent (Cookie Banner) |
| To manage payments | Financial Data | Performance of Contract |
| Marketing (Newsletter/Updates) | Contact Data | Consent or Legitimate Interest (B2B) |
4. AI PROCESSING & INPUT DATA
4.1 Your Role: When you input data regarding your clients (e.g., passenger names, flight routes) into BluFlo, you act as the Data Controller and we act as the Data Processor. You warrant that you have the legal right to share this data with us.
4.2 AI Providers: We utilize third-party Large Language Models (LLMs) to process your Input Data. We have Data Processing Agreements (DPAs) in place with these providers to ensure they do not train their public models on your confidential inputs without permission.
5. THIRD-PARTY SHARING
We do not sell your data. We share data only with the following categories of third-party service providers (“Sub-processors”) necessary to run our business:
- Analytics: PostHog (Usage tracking and session replay).
- AI/LLM Providers: (e.g., OpenAI, Anthropic) (For text generation).
- Hosting: [e.g., AWS, Vercel] (Secure cloud infrastructure).
- Payments: [e.g., Stripe] (Payment processing).
- CRM: [e.g., HubSpot] (Customer management).
6. INTERNATIONAL TRANSFERS
Many of our external third parties (including PostHog and AI providers) are based outside the UK. Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
- UK Data Bridge: Transfers to US organizations participating in the UK Extension to the EU-US Data Privacy Framework.
- Standard Contractual Clauses (SCCs): We use specific contracts approved for use in the UK which give personal data the same protection it has in the UK.
7. DATA RETENTION
- Account Data: Retained for the duration of your subscription plus 6 years for tax/legal purposes.
- Input Data (AI Logs): Retained for [e.g., 30 days] to allow for feature debugging, after which it is [anonymized/deleted].
- Analytics Data: Retained in accordance with PostHog's retention policies (typically 12-24 months).
8. YOUR LEGAL RIGHTS
Under the UK GDPR, you have rights including:
- Right of Access: Request a copy of your personal data.
- Right to Rectification: Correct inaccurate data.
- Right to Erasure: Request we delete your data (subject to legal retention requirements).
- Right to Object: Object to processing for direct marketing.
To exercise these rights, email: support@bluflo.io.
9. COOKIES
Our Site uses cookies to distinguish you from other users. When you first visit our Site, you will see a Cookie Banner. You can choose to accept or reject non-essential cookies (like PostHog analytics). You can block cookies via your browser settings, though some parts of the Site may not function properly.
10. CHANGES TO THIS POLICY
We may update this policy from time to time. The latest version will always be posted on this page.