Privacy Policy

Last Updated: October 29, 2026

BlueOx ("we," "us," "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our business management platform.

1. INFORMATION WE COLLECT

1.1 Information You Provide

Account Registration:

• Full name (first and last)
• Email address
• Password (encrypted)
• Phone number
• Company name
• Business address
• Tax identification numbers

Company Information:

• Legal business name
• Registration numbers
• Business type/industry
• Number of employees
• Contact details
• Logo and branding
• Banking details (for billing)

Business Data:

• Customer records (names, contacts, addresses)
• Vendor information
• Employee data (names, salaries, tax info)
• Financial transactions
• Invoices and receipts
• Tour packages and bookings
• Inventory data
• Reports and analytics

Communications:

• Support tickets and emails
• Chat messages
• Phone call records
• Feedback and survey responses

1.2 Automatically Collected Information

Usage Data:

• IP addresses
• Browser type and version
• Device information
• Operating system
• Pages visited
• Features used
• Time spent on platform
• Click patterns
• Error logs

Cookies and Tracking:

• Session cookies (authentication)
• Preference cookies (settings)
• Analytics cookies (usage patterns)
• Security cookies (fraud prevention)

1.3 Third-Party Data

Payment Information:

• Payment method details (via Stripe)
• Transaction history
• Billing addresses

Integration Data:

• Data from connected third-party services
• API usage logs

2. HOW WE USE YOUR INFORMATION

2.1 Service Provision

• Create and manage your account
• Process transactions and payments
• Generate invoices, receipts, and reports
• Provide customer support
• Enable multi-user access and collaboration
• Backup and restore your data
• Maintain and improve the platform

2.2 Communication

• Send service notifications and updates
• Respond to inquiries and support requests
• Send billing and payment reminders
• Share important security alerts
• Request feedback on service quality
• Announce new features (if opted in)

2.3 Analytics and Improvement

• Analyze usage patterns and trends
• Identify and fix bugs
• Optimize performance
• Develop new features
• Enhance user experience
• Conduct internal research

2.4 Security and Fraud Prevention

• Detect and prevent unauthorized access
• Monitor for suspicious activity
• Enforce our Terms of Service
• Comply with legal obligations
• Protect against fraud and abuse

2.5 Marketing (Optional)

• Send promotional emails (if you opt in)
• Display relevant in-app messages
• Conduct surveys and studies

You can opt out anytime via account settings.

3. DATA SHARING AND DISCLOSURE

3.1 We DO NOT Sell Your Data

We never sell, rent, or trade your personal information to third parties for marketing purposes.

3.2 Service Providers

We share data with trusted service providers who help us operate:

Infrastructure:

• Supabase (database hosting - AWS/Digital Ocean)
• Cloud hosting providers
• CDN services

Payment Processing:

• Stripe (payment gateway)
• Banking partners

Communication:

• Email service providers (Resend, SendGrid, or similar)
• SMS providers (for notifications)
• Support ticketing systems

Analytics:

• Usage analytics (anonymized)
• Performance monitoring

All service providers are bound by confidentiality obligations and may only use your data to perform services on our behalf.

3.3 Legal Requirements

We may disclose information if required by:

• Court orders or subpoenas
• Government requests
• Law enforcement investigations
• Legal compliance obligations
• Protect our rights and safety
• Prevent fraud or abuse

3.4 Business Transfers

If we merge, are acquired, or sell assets, your information may be transferred to the acquiring entity with notice to you.

3.5 With Your Consent

We may share information for other purposes with your explicit consent.

3.6 Multi-Tenant Isolation

Your data is NEVER shared with other companies on our platform. We implement strict data isolation:

• Row-level security policies
• Company-specific data filtering
• Encrypted data separation
• Access control lists

4. DATA SECURITY

4.1 Security Measures

Encryption:

• All data transmitted via SSL/TLS encryption
• Data at rest encrypted in database
• Password hashing with bcrypt
• Secure API authentication tokens

Access Controls:

• Role-based access control (RBAC)
• Multi-factor authentication (optional)
• Session management and timeouts
• IP whitelisting (Enterprise)

Infrastructure Security:

• Regular security audits
• Penetration testing
• Vulnerability scanning
• DDoS protection
• Firewall and intrusion detection

Data Backups:

• Daily automated backups
• Geographic redundancy
• Point-in-time recovery
• Disaster recovery plan

4.2 Your Responsibilities

• Use strong, unique passwords
• Enable two-factor authentication
• Keep login credentials confidential
• Report suspicious activity immediately
• Regularly review user access

4.3 Data Breach Protocol

In the event of a data breach:

• We will notify you within 72 hours
• Describe the nature and extent of the breach
• Outline steps being taken
• Advise on protective measures
• Comply with applicable breach notification laws

5. DATA RETENTION

5.1 Active Accounts

We retain your data while your account is active and as needed to provide services.

5.2 After Account Closure

Grace Period (0-30 days):

• Full data access for export
• Account can be reactivated

Soft Deletion (31-60 days):

• Data archived but not accessible
• Can restore upon request

Permanent Deletion (After 60 days):

• All data permanently deleted
• Cannot be recovered
• Backup copies purged within 90 days

5.3 Legal Retention

We may retain certain data longer if required by:

• Tax regulations (typically 7 years)
• Accounting standards
• Legal obligations
• Dispute resolution needs

5.4 Anonymized Data

We may retain anonymized, aggregated data indefinitely for analytics and research.

6. YOUR PRIVACY RIGHTS

6.1 Access and Portability

You have the right to:

• Access all your personal data
• Export data in machine-readable format (CSV, JSON)
• Download copies of invoices and reports

How: Via account settings or by emailing support@blueoxgroup.eu

6.2 Correction and Update

You can:

• Update account information anytime
• Correct inaccurate data
• Request assistance for bulk updates

How: Account settings or support request

6.3 Deletion

You can request:

• Deletion of specific data items
• Full account deletion
• Removal from marketing lists

How: Account settings > Delete Account, or contact support

Note: Some data may be retained as required by law.

6.4 Restriction and Objection

You can:

• Restrict processing of your data
• Object to certain uses
• Opt out of marketing communications
• Disable cookies (may affect functionality)

6.5 Data Portability

Export your data to use elsewhere:

• Customer lists
• Financial records
• Transaction history
• Generated reports

6.6 Withdraw Consent

If processing based on consent, you may withdraw anytime without affecting prior processing.

6.7 Lodge a Complaint

If you believe we've violated your privacy rights, you can:

• Contact us: support@blueoxgroup.eu
• File a complaint with your local data protection authority

7. INTERNATIONAL DATA TRANSFERS

7.1 Data Location

Your data may be stored and processed in:

• United States (AWS/Supabase servers)
• European Union (EU data centers)
• Singapore (regional hosting)

7.2 Transfer Safeguards

We ensure adequate protection through:

• Standard Contractual Clauses (SCCs)
• Data Processing Agreements
• Compliance with GDPR (where applicable)
• Supabase/AWS compliance certifications

7.3 Your Location

If you are in the EU/EEA, UK, or other regions with strict data protection laws, we provide additional safeguards as required.

8. CHILDREN'S PRIVACY

Our Service is not intended for individuals under 18 years old. We do not knowingly collect data from children. If we discover we've collected data from a child, we will delete it immediately.

9. COOKIES POLICY

9.1 What Are Cookies

Cookies are small text files stored on your device that help us provide and improve our Service.

9.2 Types of Cookies We Use

Essential Cookies (Required):

• Authentication and session management
• Security and fraud prevention
• Load balancing
• CSRF protection

Functional Cookies (Optional):

• Remember your preferences
• Language selection
• Theme settings
• Dashboard customization

Analytics Cookies (Optional):

• Usage statistics
• Feature adoption
• Performance metrics
• Error tracking

Marketing Cookies (Optional, if enabled):

• Track campaign effectiveness
• Personalize content

9.3 Cookie Control

You can control cookies through:

• Browser settings (block all cookies)
• Our cookie consent banner
• Account preferences

Note: Blocking essential cookies may prevent Service functionality.

9.4 Third-Party Cookies

Service providers may set their own cookies (e.g., Stripe for payment processing).

10. DO NOT TRACK

We currently do not respond to Do Not Track (DNT) signals. We track usage to provide and improve the Service, not for behavioral advertising.

11. CALIFORNIA PRIVACY RIGHTS (CCPA)

If you are a California resident, you have additional rights:

11.1 Right to Know

Request information about personal data collected in the past 12 months:

• Categories of data
• Sources of data
• Business purposes
• Third parties shared with

11.2 Right to Delete

Request deletion of personal data, subject to exceptions.

11.3 Right to Opt-Out

Opt out of sale of personal data. Note: We do not sell personal data.

11.4 Non-Discrimination

We will not discriminate against you for exercising your CCPA rights.

11.5 How to Exercise Rights

Email: support@blueoxgroup.eu

We will respond within 45 days.

12. GDPR COMPLIANCE (EU/EEA)

If you are in the EU/EEA, you have rights under the General Data Protection Regulation (GDPR):

12.1 Legal Basis for Processing

We process your data based on:

• Contract: To provide the Service
• Consent: For marketing communications
• Legitimate Interest: For analytics and improvements
• Legal Obligation: For tax and compliance

12.2 GDPR Rights

• Right of access
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object
• Rights related to automated decision-making

12.3 Privacy Contact

Contact: support@blueoxgroup.eu

12.4 Supervisory Authority

You can lodge a complaint with your local data protection authority.

13. CHANGES TO THIS PRIVACY POLICY

13.1 Updates

We may update this Privacy Policy to reflect:

• Changes in our practices
• Legal or regulatory requirements
• New features or services

13.2 Notification

We will notify you of material changes via:

• Email to your registered address
• In-app notification
• Update date at top of policy

13.3 Continued Use

Your continued use after changes constitutes acceptance of the updated policy.

14. CONTACT US

14.1 General Inquiries and Support

Email: support@blueoxgroup.eu

Business Hours: Monday-Friday, 8am-6pm EAT

15. DEFINITIONS

• Personal Data: Information that identifies you individually
• Processing: Any operation on personal data (collection, storage, use, etc.)
• Controller: Entity that determines purposes and means of processing (us)
• Processor: Entity that processes data on behalf of controller (our service providers)
• Data Subject: The individual to whom personal data relates (you)

Your privacy is important to us. We are committed to protecting your personal data and handling it responsibly in accordance with applicable privacy laws.

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at support@blueoxgroup.eu.