Privacy Policy

Bluaah operates a digital services agency and client project management platform.

Our services may include website development, web application development, e-commerce development, Shopify and WordPress services, software development, maintenance, technical support, and other digital services.

For privacy-related questions, you can contact us at:

Email: support@bluaah.com

Website: https://bluaah.com

Depending on how you use our website and services, we may collect different categories of information.

Our client portal may provide messaging or communication functionality between clients and our team.

Depending on the features you use, we may process:

• Messages
• Message timestamps
• Sender and recipient information
• Conversation identifiers
• Attachments
• Message status
• Communication history

Project-related communications may be retained as part of the project's records and may be used to provide services, resolve disputes, maintain business records, and improve our services.

Please do not send passwords, private authentication tokens, payment card numbers, or other highly sensitive information through ordinary project messages unless specifically requested through an appropriate secure process.

Clients may upload files related to their projects.

These may include:

• Images
• Documents
• PDFs
• Design files
• Videos
• Project assets
• Technical files
• Other project-related materials

You are responsible for ensuring that you have the legal right to upload and share such materials with us.

We may store uploaded files using our own infrastructure or third-party cloud storage providers.

When you access our website or client portal, certain technical information may be collected automatically.

This may include:

• IP address
• Browser type
• Device type
• Operating system
• Approximate location derived from IP address
• Referring website
• Pages visited
• Date and time of access
• Session information
• Error logs
• Security logs
• Device and browser identifiers
• Website performance information

We may use this information for security, troubleshooting, analytics, performance monitoring, and improving our services.

We may use cookies, local storage, session storage, and similar technologies.

These technologies may be used for:

• Authentication
• Maintaining login sessions
• Security
• Remembering preferences
• Website functionality
• Performance monitoring
• Analytics

For example, our client portal may use a secure authentication cookie to maintain your logged-in session.

You may be able to control cookies through your browser settings. However, disabling certain cookies may prevent parts of the client portal from functioning correctly.

Where applicable, non-essential cookies will be handled in accordance with applicable law and our consent mechanisms.

To protect client accounts and the platform, we may process information related to authentication and security.

This may include:

• Authentication tokens
• IP addresses

Authentication credentials are intended to be protected using appropriate technical and organizational safeguards.

We may use this information to detect unauthorized access, prevent abuse, secure accounts, and investigate security incidents.

We may process personal information for the following purposes:

We process personal data only for lawful purposes permitted under applicable law.

Depending on the circumstances, processing may be based on:

• Your consent;
• Your request for services;
• Performance of an agreement or steps requested before entering into an agreement;
• Legitimate or otherwise permitted business purposes where applicable;
• Compliance with legal obligations; or
• Other lawful grounds permitted under applicable law.

Where consent is required, we will request consent through an appropriate mechanism.

The Digital Personal Data Protection Act, 2023 provides for processing based on consent or specified legitimate uses and requires notice describing the personal data and purposes of processing.

Where we rely on consent, consent should be freely given, specific, informed, and capable of being withdrawn in accordance with applicable law.

You may withdraw consent where applicable.

Withdrawal of consent may affect our ability to provide certain services or features where the processing is necessary for those services.

Withdrawal of consent will not affect processing that we are otherwise permitted or required to perform under applicable law.

Clients may provide information belonging to their customers, employees, contractors, users, or other individuals as part of a project.

For example, a client may provide customer information while asking us to build or maintain a website or application.

Where a client provides personal information belonging to another individual:

• The client is responsible for ensuring that the information is collected and shared with us lawfully.
• The client should have the necessary authority or legal basis to provide such information.
• We may process such information only for purposes related to providing the agreed services.

Where applicable, the parties may enter into additional contractual terms addressing data processing responsibilities.

We do not sell your personal information as a product.

We may share information with third parties when reasonably necessary to provide our services, operate our platform, protect our systems, or comply with law.

These parties may include:

Our services may rely on third-party infrastructure and software providers.

Depending on our technology stack, these may include providers for:

• Cloud hosting
• Cloud storage
• Databases
• Content delivery
• Authentication
• Email delivery
• Analytics
• Error monitoring
• Payment processing
• Customer communication

Third-party providers may process information according to their own privacy policies and contractual obligations.

We take reasonable steps to select service providers that provide appropriate security and privacy protections.

If payments are processed through our website or a third-party payment provider, payment information may be processed by the relevant payment provider.

Unless explicitly stated otherwise, we do not intend to store complete payment card numbers or card security codes on our own systems.

Payment providers may collect and process payment information according to their own privacy policies and applicable laws.

Personal information may be stored on servers operated by us or by third-party service providers.

Depending on our infrastructure, data may be stored in India or in other countries where our service providers operate.

Where data is transferred or processed outside India, we will take appropriate measures required by applicable law.

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Retention periods may depend on:

• The type of information;
• The purpose for which it was collected;
• The duration of the client relationship;
• Legal requirements;
• Accounting and tax requirements;
• Security requirements;
• Dispute resolution;
• Contractual obligations.

Project information may be retained after completion of a project where reasonably necessary for business records, support, contractual purposes, security, backups, or legal compliance.

When information is no longer required, we may delete, anonymize, or securely dispose of it in accordance with applicable law and our internal retention practices.

For reliability and disaster recovery, certain information may be included in backups.

Deleting information from our active systems may not immediately remove every copy from backup systems.

Backup copies may be securely retained for a limited period and deleted or overwritten according to our backup and retention procedures.

We take reasonable technical and organizational measures designed to protect personal information against:

• Unauthorized access;
• Unauthorized disclosure;
• Loss;
• Misuse;
• Alteration;
• Destruction;
• Security attacks.

Security measures may include:

• Access controls;
• Authentication mechanisms;
• Encryption where appropriate;
• Secure communication protocols;
• Password hashing;
• Logging and monitoring;
• Infrastructure security controls;
• Regular software updates;
• Backup mechanisms;
• Role-based access controls.

However, no internet-based system can guarantee absolute security.

If we become aware of a personal data breach affecting information under our responsibility, we will take reasonable steps to:

1. Investigate the incident;
2. Contain and mitigate the incident;
3. Assess the potential impact;
4. Take appropriate corrective measures; and
5. Provide notifications where required by applicable law.

Where the law requires notification to affected individuals or regulatory authorities, we will follow the applicable notification requirements.

Subject to applicable law, you may have rights relating to your personal data, which may include:

• Requesting information about personal data we process;
• Requesting correction of inaccurate information;
• Requesting deletion of personal information where applicable;
• Withdrawing consent where consent is the basis for processing;
• Requesting information about how your personal data is processed;
• Raising a complaint regarding our handling of personal data.

The specific availability and scope of these rights may depend on applicable law and the circumstances of the processing.

The DPDP Act provides rights including access to information about personal data, correction/erasure in specified circumstances, grievance redressal, and nomination.

To exercise an applicable privacy right or submit a privacy request, contact:

Privacy Email: support@bluaah.com

Please include:

• Your name;
• Email address associated with your account;
• Description of your request; and
• Any information reasonably necessary to verify your identity.

We may request reasonable verification information before processing certain requests to prevent unauthorized access to personal information.

If you have a concern regarding our processing of your personal information, you may first contact us at:

Grievance Email: support@bluaah.com

We will review and respond to complaints in accordance with applicable law.

Where applicable law provides a right to escalate a complaint to the relevant data protection authority or Data Protection Board, you may exercise that right in accordance with the applicable procedure.

The DPDP framework provides for grievance redressal and establishes the Data Protection Board of India.

Our services are intended for individuals who are legally permitted to use them.

We do not knowingly request or intentionally collect personal information from children in violation of applicable law.

If you believe that a child has provided personal information to us in circumstances where such collection is not permitted, please contact us so that we can take appropriate action.

We may send service-related communications such as:

• Account notifications;
• Security alerts;
• Project updates;
• Important service announcements;
• Transactional communications.

Where applicable, we may separately request consent for promotional or marketing communications.

You may opt out of non-essential marketing communications through the unsubscribe mechanism provided in the communication or by contacting us.

Opting out of marketing communications will not prevent us from sending essential service, security, transactional, or account-related communications.

We may use analytics and monitoring tools to understand how users interact with our website and to improve performance.

Depending on the tools used, these services may collect information such as:

• Device information;
• Browser information;
• IP address;
• Pages visited;
• Session information;
• Approximate geographic information;
• Usage events.

We will configure analytics tools and consent mechanisms in accordance with applicable law.

Our website may contain links to websites or services operated by third parties.

We are not responsible for the privacy practices, security, or content of third-party websites.

We recommend reviewing the privacy policies of third-party services before providing them with personal information.

Our services may be accessed by clients located outside India.

If you use our services from another country, your information may be processed in India or other jurisdictions where we or our service providers operate.

Additional privacy rights may apply to you depending on the country or jurisdiction in which you reside.

Where legally required, we will take appropriate steps to comply with applicable data protection requirements.

Information that you voluntarily make publicly available through our website or other public channels may be visible to other users or the public.

You should not publish confidential information, passwords, private keys, payment information, or other sensitive information in publicly accessible areas.

We may update this Privacy Policy from time to time.

When changes are made, we will update the “Last Updated” date at the top of this Privacy Policy.

Where required by law, we may provide additional notice or obtain consent for material changes.

Your continued use of our services after an updated Privacy Policy becomes effective means that you acknowledge the updated policy to the extent permitted by applicable law.

If you have questions, concerns, or requests relating to this Privacy Policy or your personal information, contact us:

Bluaah

General Contact: bluaah.co@gmail.com

Website: https://bluaah.com

By using our website, creating an account, using our client portal, communicating with us, or otherwise using our services, you acknowledge that you have read and understood this Privacy Policy.

Where consent is legally required for a particular processing activity, we will obtain such consent through an appropriate mechanism.

Last Updated: September 22, 2026