Privacy Policy
We believe in full transparency when it comes to your data. Last updated on April 13, 2026.
At Blueberries, we are committed to protecting your privacy and securing your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our FP&A SaaS application (the "Service").
We strictly adhere to the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable data protection laws. By accessing or using our Service, you acknowledge that you have read and understood this Privacy Policy.
1. Data Controller Information
For the purposes of the GDPR, Blueberries acts as the Data Controller for the personal data covered by this policy.
2. What Data We Collect
We collect the following types of data:
- Personal Identification Information: Name, email address, job title, and company name when you register.
- Financial & Integration Data: Data securely imported from third-party tools (e.g., ERP, CRM, accounting software) authorized by you strictly for the purpose of FP&A operations and cost allocation services.
- Usage Data: Information on how you navigate and interact with the Service, including IP addresses, browser types, and access times, primarily for internal analytics and security.
3. How We Use Your Data
We use the collected data exclusively to:
- Provide, operate, and maintain our FP&A platform securely.
- Execute financial analysis, cost allocation, and planning computations.
- Communicate with you regarding updates, support, and administrative messages.
- Detect, prevent, and address technical or security issues.
- Comply with our legal and regulatory obligations.
4. Legal Basis for Processing
Under the GDPR, our core legal bases for processing your data are:
- Performance of a Contract: To deliver the Blueberries SaaS functionality as agreed in our Terms of Service.
- Legitimate Interests: To improve the Service, ensure security, and prevent fraud.
- Consent: When you actively provide consent for specific purposes (e.g., marketing).
5. Data Sharing and Third Parties
We do not sell or rent your personal data to third parties. We may share your information only with trusted third-party service providers (sub-processors) who assist us in operating our Service, conducting our business, or serving our users, so long as those parties agree to keep this information strictly confidential and comply with GDPR standards.
Our sub-processors fall into the following categories:
- Cloud Infrastructure & Hosting: AWS (Amazon Web Services) for compute, storage, and networking.
- Database Services: Supabase for PostgreSQL database hosting and management.
- Version Control & CI/CD: GitHub for source code management and deployment pipelines.
- HR & Payroll: Deel for contractor and employee management.
- Compliance Monitoring: Vanta for SOC 2 compliance automation and monitoring.
A full and up-to-date list of sub-processors is available upon request at privacy@blueberries.app.
6. Data Retention, Security & International Transfers
We implement industry-standard technical and organizational measures to protect your personal data from unauthorized access, alteration, disclosure, or destruction. Data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
We retain your personal data only for as long as is necessary for the purposes set out in this Privacy Policy. Afterward, data is securely deleted or anonymized.
International Data Transfers: Your data may be processed and stored in the following countries and regions:
- United States (primary): AWS us-east-1 (N. Virginia), our primary hosting region.
- European Union: Data of EU/EEA residents may be processed by sub-processors operating in EU regions.
- Israel: Certain personnel and operations are based in Israel.
Where data is transferred outside the EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) or adequacy decisions as required by GDPR Article 46.
7. Your Data Protection Rights
If you are a resident of the European Economic Area (EEA) or California (under the CCPA), you have the following data protection rights:
- The right to access, update or delete the information we have on you.
- The right of rectification: You have the right to have your information rectified if it is inaccurate or incomplete.
- The right to object to our processing of your Personal Data.
- The right of restriction: You have the right to request that we restrict the processing of your personal information.
- The right to data portability: You have the right to be provided with a copy of your Personal Data in a structured, machine-readable format.
- The right to withdraw consent at any time where we relied on your consent to process your personal information.
Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights. This means we will not deny you goods or services, charge you different prices or rates, or provide you with a different level or quality of service as a result of you exercising your privacy rights under applicable law.
No Account Required: You are not required to create an account or be a registered user of our Service in order to exercise your privacy rights. Any individual whose personal data we process may submit a request regardless of whether they hold an active account with Blueberries.
Rights on Behalf of a Child: If you are a parent or legal guardian of a minor (under 16 years of age), you may exercise privacy rights on behalf of your child. Please contact us at privacy@blueberries.app with appropriate documentation confirming your relationship to the child.
Exercising Your Rights (DSAR)
We take your privacy rights seriously. All Data Subject Access Requests (DSARs), as well as requests to exercise any of your statutory rights, must be sent directly to our dedicated privacy contact:
privacy@blueberries.appNote: We will acknowledge your request within 3 business days and respond fully within 30 days. We may ask you to verify your identity before responding to such requests to ensure the security of your data.
Appeals Process
If we refuse to act on your privacy rights request, we will inform you of the reason for refusal in writing within the applicable response period. You may appeal our decision by submitting a written appeal to privacy@blueberries.app with the subject line "Privacy Rights Appeal." We will review your appeal and respond within 30 days. If you remain unsatisfied following our appeal determination, you have the right to lodge a complaint with your local data protection authority (e.g., the relevant EU supervisory authority under GDPR, or the California Attorney General under the CCPA).
8. Changes to this Policy
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date at the top of this document. You are advised to review this Privacy Policy periodically for any changes.
9. Contact Us
If you have any general questions about this Privacy Policy, please contact us via our Contact Form on blueberries.app. For data rights requests, please use the email address provided in Section 7.