Privacy policy

1. What data we collect

• Account data: your name, your email and your phone number if you add it. If you sign in with Apple or Google, we receive the identifier and email that account shares.
• What you record: transactions, budgets, goals, assets, debts, subscriptions, notes and your Spaces with their members.
• What you write or say to the assistant and the documents you upload: statements, receipts, spreadsheets and photos, such as your profile picture or a Space cover.
• Purchases: your plan, the subscription status and the receipt issued by the App Store, Google Play or the web payment processor. We never see your card details.
• Technical data: the token used to send you notifications, the model and name of your devices so we can show you your sessions, and error and performance reports. Those reports carry your account's internal identifier, not your name or email.

We don't collect your location, your phone's contacts or advertising identifiers. Bluu doesn't connect to your bank and never asks for your bank password.

2. How we use them

To provide the service: store and show your information, add up your net worth, sync your Spaces and notify you about what you turned on. We also use them to charge for your plan, protect your account and fix errors in the app.

We don't sell your data, we don't share it with advertisers and we don't track you across apps or websites. We only send you marketing messages if you agree to them.

3. Artificial intelligence

The chat, voice notes, voice conversation and the reading of statements and receipts use third-party artificial intelligence models. They only work if you authorize them in the app, and you can withdraw that authorization at any time in Settings › Bluu AI. Without it, you can keep recording everything by hand.

When you use them, we process what you write, say or upload, together with the part of your account the assistant needs to answer, such as your transactions and categories. What you write and your documents are processed on Amazon Web Services (Amazon Bedrock and Amazon Textract). Audio is processed with ElevenLabs, Fish Audio and LiveKit. We don't use your data to train AI models.

When you change a category, Bluu learns from your choice to suggest better next time. It never corrects what you decided.

4. Who we share your data with

Only with the providers we need to run the service, and only for that purpose:

• Amazon Web Services: hosts the app, the database and your files, reads the text of your documents and runs the AI models.
• Supabase: handles sign-in.
• ElevenLabs, Fish Audio and LiveKit: process audio if you use the voice features.
• Sentry: receives error and performance reports.
• Expo: delivers notifications to your phone.
• Apple and Google: if you sign in with their account or pay through the App Store or Google Play.
• Wompi: processes the payments you make on the web.

Members of a Space see what you record in that Space. If you connect an external assistant through Bluu's MCP server, that assistant accesses your account with the permissions you authorize, and every write requires your confirmation inside Bluu before it's saved. We may also hand data to an authority when the law requires it.

5. How long we keep them

We keep your data while your account exists. The documents you upload (statements, receipts and voice notes) are deleted 90 days after upload, and the files you export after a week. The transactions you confirmed from a document stay in your records.

If you delete your account, we erase your personal data and your financial information within 2 business days, except what the law requires us to keep. What you recorded in shared Spaces stays for the other members, without your name. The details are on Delete your account.

6. Your rights

You can view and correct your data in the app, export your transactions as CSV, withdraw the AI authorization, turn off notifications and delete your account from Profile → Delete account. To ask for a copy of your data or exercise any other right, write to legal@bluulabs.com.

7. Security

Your data travels encrypted between the app and our servers, and every request is checked against your session and the Spaces you belong to. On your phone you can lock the app with Face ID or your fingerprint.

8. Minors

Bluu is for people 18 and older. If you believe a minor created an account, write to us and we'll delete it.

9. Changes to this policy

If we change this policy in a meaningful way, we'll let you know in the app and, where needed, ask you to accept it again. The date at the top shows the current version.