Privacy Policy
Draft pending legal review
DRAFT PENDING LEGAL REVIEW. Not legal advice. Not final. Items in [TO CONFIRM] brackets are facts the company must supply or confirm; nothing in brackets has been verified. Based on docs/persona/BluOrbit_Privacy_Policy_v1_0_DRAFT.md.
Last updated: [TO CONFIRM: date of publication]
1. Who we are
BluOrbit (bluorbit.ca) is operated by [TO CONFIRM: legal entity name, believed to be Implexus], [TO CONFIRM: registered address]. Privacy contact: [TO CONFIRM: name or title of the person responsible for privacy] at [TO CONFIRM: privacy email; hello@bluorbit.ca until set]. This policy follows Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), applicable provincial law, and Canada's Anti-Spam Legislation (CASL).
2. What we collect, and why
We collect the following. Each item has the purposes listed next to it. If we want to use something for a new purpose, we update this policy first.
| Information | Purposes |
|---|---|
| Email address, name, company name | Create and run your account; sign you in; send service messages; send marketing only with your consent |
| Profile answers you give Blu (entity type, province, industry, size, funding goals, grant history, revenue and headcount if you choose to share them) | Match you to grants; draft applications using only facts you gave us; show your dashboard |
| Eligibility and demographic details you choose to share | Match you to grants reserved for a group; stored only with your consent |
| Documents you upload | Draft and fill applications for you |
| Conversation content with Blu | Answer you; remember the conversation; improve the service; investigate abuse and errors |
| Searches run, grants viewed and saved, pages visited, clicks and time on page ("behaviour") | Operate the service; understand what is useful; improve matching and the product; plan features; measure marketing |
| IP address | Security and abuse prevention; rate limiting; estimate your approximate location; fraud checks |
| Approximate location (derived from IP address) | Show relevant provincial and national grants; analytics |
| Device and browser type, operating system, screen size, language | Make the site work on your device; troubleshoot; analytics |
| Referrer (the page that sent you) and campaign tags in links | Learn which sources bring visitors; measure marketing |
| Cookies and session identifiers | Keep you signed in; keep your conversation and free allowance; prevent abuse |
| Payment details | Handled by Stripe. We receive your plan, payment status and the last digits of the card, not the full card number |
| Support messages and email delivery events (delivered, bounced, unsubscribed) | Respond to you; keep our mailing list correct; meet CASL record-keeping |
| IP address and browser (user agent) at the moment you give or withdraw email consent | Kept as proof of consent under CASL |
| IP address of anonymous visitors | Limit how many free anonymous sessions one network can start per day (abuse prevention). [TO CONFIRM: retention period. Today the address is stored with the anonymous session record and is not deleted on a schedule.] |
We collect all of the above that we are lawfully able to for these purposes, including for future platform uses that fit them. [TO CONFIRM WITH COUNSEL: whether broad "future uses" is acceptable under PIPEDA's purpose-limitation rule, and whether a cookie notice is needed.]
3. Consent
We ask for your consent in the chat before we analyse your conversation, and when you give your email. You can withdraw consent at any time; withdrawing does not undo processing already done. Declining some collection may limit features.
4. Who we share it with
We do not sell your personal information. We use these service providers (subprocessors) to run BluOrbit:
- Stripe: payments.
- Clerk: sign-in and accounts.
- Anthropic: the AI model behind Blu; conversation content is sent to it to produce answers. [TO CONFIRM: Anthropic data-retention terms that apply.]
- Resend: sending email.
- Railway: hosting of the backend.
- Vercel: hosting of the website.
- Neon: the database that stores your information.
- [TO CONFIRM: analytics provider, if any, such as PostHog.]
We also share when the law requires it, to protect rights and security, or in a business sale (subject to this policy). [TO CONFIRM: where each provider stores data; whether any data is outside Canada, and the PIPEDA transfer wording.]
5. Security and retention
We use encryption in transit, access controls and audit logging. Portal credentials are encrypted. No system is perfectly secure. We keep information only as long as needed for the purposes above or as the law requires; CASL consent records are generally kept three years. [TO CONFIRM: retention period for each item, including anonymous conversations and logs.]
6. Email (CASL)
We send marketing email only with your consent, and every such email has a working unsubscribe link and our identification and contact details. Service messages, such as receipts and trial-ending notices, are sent as part of the service. [TO CONFIRM: sender mailing address.]
7. Your rights
You may ask to see, correct or delete the personal information we hold about you, withdraw consent, and ask for an export. Write to the privacy contact above. You may also complain to the Office of the Privacy Commissioner of Canada. [TO CONFIRM: response time.]
8. Children
BluOrbit is not directed at children, and we do not knowingly collect their information. [TO CONFIRM: age.]
9. Changes
We will update this policy when our collection or purposes change, and tell you about material changes through the service or by email.