Privacy Policy

§ 01

Information you provide

Contact inquiries may include your name, work email, company, and message. Onboarding may include contact details, company and role information, website and LinkedIn profile URLs, account context, target-audience and campaign preferences, authorization, typed signature, and submission date. BlueTier does not ask for a LinkedIn or email password through the onboarding form.

§ 02

Information collected to operate the site

Hosting and security systems may process request data such as IP address, browser type, device information, timestamps, route requested, and security events. The dashboard uses signed, expiring authentication session cookies after sign-in. Error monitoring receives error reports and technical diagnostics when something goes wrong. We do not currently use advertising cookies or cross-site behavioral advertising on this application.

§ 03

Why we use information

Each purpose below is paired with its legal basis under the GDPR and comparable privacy laws.

• Respond to inquiries and onboarding submissions — contract performance and steps taken at your request before a contract
• Evaluate, deliver, support, and improve the membership and any contracted services — contract performance
• Operate authentication, security, abuse prevention, and troubleshooting — legitimate interest in keeping the service secure and reliable
• Send service and workflow notifications where they are offered — contract performance
• Maintain records, enforce agreements, and meet applicable legal obligations — legal obligation and legitimate interest
• Analyze service performance using member and campaign records where authorized — legitimate interest; consent where required
• Optional marketing or product communications where offered — consent, which you can withdraw at any time

§ 04

Responsible AI and automated processing

BlueTier uses AI-assisted features for tasks such as onboarding assistance, ICP and audience discovery, profile analysis, campaign and message development, response and follow-up drafting, conversation summaries and classification, identifying conversations requiring attention, scheduling assistance, and reporting recommendations. AI prompts may include the profile, ICP, and messaging context that you provide or authorize for your own campaigns. Member data is used only to provide that member’s own service; it is not used to train shared models unless separately disclosed. You approve the audience, campaign strategy, messaging, sequence, and operating parameters before a campaign begins. You can monitor performance and pause or adjust activity through your dashboard. AI outputs are logged for troubleshooting and dispute resolution.

• Data entering AI prompts: profile, ICP, and messaging context you provide or authorize.
• Data use: only to provide your own service — no training on member data unless separately disclosed.
• Human control: you approve the audience, campaign strategy, messaging, sequence, and operating parameters before a campaign begins, and can pause or adjust activity through your dashboard.
• Logging: AI outputs are logged to support troubleshooting and dispute resolution.

§ 05

Audience targeting and sensitive categories

Onboarding includes optional fields that can touch protected or sensitive categories, such as ethnic or religious community affiliations. These fields are optional and entirely member-directed: they are used solely to configure targeting for your own campaign and for no other purpose. Where AI-assisted features infer or suggest targeting criteria, those suggestions are presented to you for review before they are used — AI-inferred targeting is never applied without member review.

§ 06

Introduction Service data flows

The BlueTier Introduction Service (Premium, Pilot) is opt-in and is never enabled by default. Where available, BlueTier’s team identifies potential introduction paths through participating professional networks using the industry, ICP, geography, and introduction categories you state. When an introduction is approved, the connecting party sees only your name, headline and profile fields, and the introduction context. Contact details and campaign data are never shared across members.

• Used to identify introduction paths: industry, ICP, geography, and stated introduction categories.
• Shown to the connecting party: name, headline/profile fields, and the introduction context — only when an introduction is approved.
• Never exposed cross-member: contact details and campaign data.

§ 07

Service providers and disclosures

Information may be processed by providers used for hosting, database and authentication, background processing, AI inference, operational records, error monitoring, payment processing, scheduling, and connected-account connectivity. The current production architecture is Vercel (web hosting and serverless functions), Supabase (Postgres database and authentication; the content-management system uses the same database), Railway (always-on background worker), an approved third-party connectivity provider (LinkedIn, WhatsApp, Instagram, Telegram, and Gmail/Outlook/IMAP email account connectivity, plus an experimental Messenger or X connection if a member starts one, and access to the Google Calendar or Outlook calendar of a connected Gmail or Outlook mailbox when a member chooses it for scheduling), Stripe (payment processing), Calendly (meeting scheduling, where a member connects their own account), Cal.com (meeting scheduling, where a member connects their own account), OpenRouter (AI inference for drafts, summaries, and classification; Groq is retained as a fallback provider), Resend (transactional email: password resets, invitations, account notices, and booking confirmations), Google Sheets (operational lead-tracker mirror), and Sentry (error monitoring; receives error reports and technical diagnostics). The current list is published on the subprocessors page. Providers process information for their service role and are subject to their own terms and privacy practices. We may also disclose information when required by law, to protect rights or security, or as part of a legitimate corporate transaction.

• BlueTier does not sell personal information.
• BlueTier does not use personal information for cross-context behavioral advertising in this application.
• BlueTier does not publish member onboarding records.

§ 08

SMS / text messaging

Where you opt in on the SMS consent form, BlueTier’s text message program (“BlueTier text alerts”), whose messages come from the toll-free number (855) 825-7822, may send account and security alerts, campaign and inbox notifications, and replies to your support requests. Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time; reply HELP for help or email support@bluetier.ai.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. Information sharing with subcontractors that support our services, such as customer service, is permitted.

The single-page sign-up form at bluetier.ai/sms-consent stores the phone number you provide, your IP address, and your browser (user agent) details, together with the exact consent text and version you were shown and the time of your submission — this is the evidence that you opted in. Consent records are kept as evidence of consent against claims under the Telephone Consumer Protection Act and similar laws, which is a legal-obligation exception to the deletion rights described in “Your choices and rights” below. When you opt out, your record will be marked as opted out rather than edited, and it will be kept for 5 years after the opt-out.

§ 09

Retention

Contact inquiries are retained while the inquiry is open and for a limited period afterward, unless a longer period is required for an ongoing matter or legal obligation. Onboarding, authorization, service, and campaign records are retained for the life of the membership and afterward only as long as needed for disputes, accounting, and legal requirements. When a workspace is deactivated or deletion is requested, its data is retained for a limited grace period under the account lifecycle policy and then purged. Security and audit logs are retained under the same lifecycle policy. Records are deleted or de-identified when the applicable period ends, subject to required recordkeeping. Backups cycle out on a defined schedule, so deleted records expire from backups as the rotation completes.

§ 10

International processing

Providers and authorized team members may process information in countries other than your own. Where required, BlueTier uses appropriate contractual or legal mechanisms and limits access to the service purpose.

§ 11

Your choices and rights

Depending on your location and applicable law, you may request access, correction, deletion, restriction, portability, or information about processing. You may also object to or withdraw consent for processing that relies on consent. Some requests may be limited by identity verification, contractual needs, security, or legal recordkeeping. As an interim self-serve process, you can request an export or deletion of your data by email; requests are completed within 10 business days.

• Email info@bluetier.ai with “Privacy request” in the subject line.
• State whether you are requesting an export, a deletion, or another right.
• Describe the account or submission involved without sending passwords or sensitive credentials.
• We may ask for information necessary to verify identity and authority.

§ 12

Children

The website and service are intended for business users and are not directed to children. Do not submit information about a child through the contact or onboarding forms.

§ 13

Changes and contact

We will update the date on this page when the policy materially changes. Questions, complaints, and rights requests can be sent to info@bluetier.ai.