Privacy Policy

This policy explains what personal data Bluprent ("Bluprent", "we", "us") collects through the Bluprent CRM and website-management platform (the "Service"), why we collect it, and how you can have it deleted. It's written in plain language on purpose — if anything is unclear, email us at support@bluprent.io.

1. Information We Collect

Account information

When you create a workspace, we collect your name, email address, and a securely hashed password. If you invite teammates, we collect the same for each of them.

Access applications

Bluprent is invite-only. If you apply for access, we store your name, email address, agency website, approximate number of client sites, and current stack. We use this only to review your application and, if approved, to send your invite — we don't add you to unrelated marketing lists. If your application isn't approved, we keep a record of the decision but don't email you about it further.

CRM data you store about your clients

The core of the Service is a CRM: you control what you put into it. That typically includes your clients' company names and websites, contact names, emails, phone numbers, deal and invoice details, and any notes or custom fields you add. This is your data about your clients — we process it on your behalf to run the Service and don't use it for our own purposes.

Client portal accounts

If you invite one of your clients to your white-labeled client portal, we store their email address and a securely hashed password so they can log in, plus their activity within the portal (e.g. requests they submit to you). This is also your clients' data, held on your behalf.

Website credentials

For websites you connect for monitoring and maintenance, we store connection details such as the hostname, SSH username, and WordPress site URL/username. The credential secrets themselves — the SSH login secret and WordPress application password — are encrypted at rest with AES-256-GCM using a unique encryption key and authentication tag per credential, before they ever touch our database. Only your workspace can decrypt them, and only to perform the monitoring/maintenance actions you configure.

Website logins

Separately, you may also store general sign-in credentials for a website (e.g. its WordPress admin panel or hosting control panel) so your team — or a client you explicitly grant access to — can look them up. These passwords are encrypted at rest the same way as the credentials above, are never included in any list or detail view, and are only decrypted when someone confirms their own account password and explicitly reveals it. Every reveal is logged to the workspace's activity timeline.

Usage & log data

Like most web services, we automatically log things like IP address, browser/device information, and timestamps of requests, for security, troubleshooting, and abuse prevention.

2. How We Use Information

We use the information above to: provide and operate the Service (including the monitoring, SEO, and portal features you configure); authenticate you and your team; send account, security, and service-related emails; provide support when you contact us; bill your subscription; detect and prevent abuse; and improve the Service. We do not sell your personal information, and we don't use your clients' CRM data or credentials to market to you or anyone else.

3. Cookies

The Service uses two cookies to keep you signed in — no third-party advertising or tracking cookies. Both are essential to the Service functioning and are set to httpOnly, secure in production, and expire after 7 days of inactivity.

• bluprent.sid — keeps you signed in to your Bluprent workspace.
• bluprent.portal.sid — keeps your clients signed in to their client portal.

The cookie names above currently carry an internal codename from before the Bluprent product name was finalized; the underlying session mechanism and security settings are as described.

4. Who We Share Data With

We use a small number of service providers to run Bluprent, each with access limited to what they need to do their job:

• Stripe — once billing goes live, will process subscription payments. We won't store your full card number ourselves.
• Resend — delivers transactional email, such as invitations, password resets, and notifications you've configured.
• DigitalOcean — hosts our application servers and database.

We don't sell personal data, and we only share it beyond these providers if required by law or with your direction.

5. Data Retention

We keep your data for as long as your workspace is active. If your workspace is canceled or your trial lapses without converting, your data is kept but marked read-only in case you come back — we don't delete it automatically. If you'd like your data deleted sooner, see the next section.

6. Deletion on Request

You can request deletion of your workspace — including your account, your CRM data, your client portal accounts, and any stored credentials — at any time by emailing support@bluprent.io from your account's email address. We'll confirm the request and delete your data from active systems; a limited copy may remain in encrypted backups for a short period afterward before it's purged on our normal backup rotation.

7. Security

Passwords are stored hashed, never in plain text. Website credential secrets (SSH and WordPress) are encrypted at rest with AES-256-GCM. Access to production data is limited to the people who need it to operate and support the Service. No method of storage or transmission is 100% secure, but we design and operate the Service to make a breach as unlikely and as low-impact as we reasonably can.

8. Children's Privacy

The Service is intended for business use and isn't directed at children. We don't knowingly collect personal information from children under 16.

9. Changes to This Policy

If we make material changes to this policy, we'll notify active subscribers by email or an in-app notice before the change takes effect.

10. Contact

Questions about this policy, or want to exercise a data right? Email support@bluprent.io.