Privacy Policy
Last updated: December 12, 2025
Introduction
blueberry. ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your personal information when you use our website and services.
We are based in Portugal and comply with the General Data Protection Regulation (GDPR) and other applicable data protection laws.
Data Controller
The data controller responsible for your personal data is:
What Data We Collect
Information you provide directly:
- Contact forms: Name, email address, company name, industry, business needs, data sources, company size, timeline, and budget preferences
- Account registration: Email address and password (passwords are securely hashed)
- Client data: Files and data you upload to our platform for analysis
- Payment information: Processed securely through Stripe (we do not store your full payment details)
Information collected automatically:
- Essential cookies: Session cookies required for the website to function properly
- Log data: Basic server logs for security and performance purposes
We do not use tracking cookies or analytics services that monitor your browsing behavior.
How We Use Your Data
We use your personal data for the following purposes:
- To respond to your inquiries and contact requests
- To create and manage your account
- To provide our data analytics services
- To process payments for our services
- To communicate with you about your account or our services
- To ensure the security and proper functioning of our website
We do not use your data for marketing purposes unless you explicitly opt in to receive marketing communications.
Legal Basis for Processing
Under GDPR, we process your data based on the following legal grounds:
- Consent: When you submit a contact form or create an account
- Contract: To provide services you have requested or purchased
- Legitimate interests: For security, fraud prevention, and improving our services
Data Sharing and Third Parties
We share your data only with trusted service providers necessary to operate our business:
Supabase (EU region)
Database hosting and authentication services
Stripe
Secure payment processing
Vercel
Website hosting
Microsoft Outlook
Email communications
We do not sell, rent, or trade your personal data to third parties.
Data Retention
We retain your personal data for as long as necessary to:
- Provide our services to you
- Comply with legal obligations
- Resolve disputes and enforce our agreements
You may request deletion of your data at any time by contacting us.
Your Rights
Under GDPR, you have the following rights regarding your personal data:
- Right to access: Request a copy of the data we hold about you
- Right to rectification: Request correction of inaccurate data
- Right to erasure: Request deletion of your data ("right to be forgotten")
- Right to restrict processing: Request limitation of how we use your data
- Right to data portability: Receive your data in a portable format
- Right to object: Object to certain types of processing
- Right to withdraw consent: Withdraw consent at any time where processing is based on consent
To exercise any of these rights, please contact us at blueberry-analytics@outlook.pt.
Data Security
We implement appropriate technical and organizational measures to protect your personal data, including:
- Encrypted data transmission (HTTPS/TLS)
- Secure password hashing
- EU-based data storage
- Regular security reviews
Cookies
Our website uses only essential cookies required for the website to function properly (such as session management and authentication). We do not use tracking cookies or third-party analytics cookies.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy on this page and updating the "Last updated" date.
Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us:
You also have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD) or another supervisory authority if you believe your data protection rights have been violated.