Privacy Policy

Bluebry Oy
Business ID / VAT: FI35558434
Registered in Finland
Website: www.bluebry.com
Contact: hello@bluebry.com

For any privacy questions, requests, or complaints, please email hello@bluebry.com.

The GDPR distinguishes between a "controller" (who decides why and how personal data is processed) and a "processor" (who processes data on a controller's behalf and on their instructions). We act in both roles, depending on the data:

• As your processor — for the contents of your mailbox and the lead records derived from them. You decide to run an audit on your own mailbox for your own purpose, so you are the controller of that data (including the personal data of people who have emailed you), and we process it only on your documented instructions to deliver the Service to you. This processing is governed by our Data Processing Agreement (DPA). We do not decide the purposes of that processing, and we do not use that data for any purpose of our own.
• As the controller — for the limited data we need to operate the Service as a business: your checkout email and payment confirmation, the salted hash of your IP address, the essential session cookie, any correspondence you send us, and aggregated, anonymized usage statistics. We decide the purposes and means for this data and it is described below.

Where this policy describes purposes, legal bases, and your rights, those statements relate to the data for which we are the controller. For mailbox contents and lead records, the controller is you, and the corresponding terms are in the DPA.

When you run an audit (free or as part of a subscription), the following data is processed:

• Mailbox metadata (as your processor), retrieved via our email connector Unipile after you authorize a read-only connection: sender name and email address, recipient address(es), subject line, message date, and a short snippet of each message (up to the most recent two years, capped at approximately 5,000 messages per scan).
• Extracted lead records (as your processor): for messages identified as warm sales leads, we retain the sender's name and email address, the date of the last relevant message, a short rationale, a draft reply, and a call script.
• Connection identifiers: the mailbox account ID assigned by Unipile, used solely to fetch your messages during the scan and to disconnect the mailbox afterwards.
• Technical data (as controller): a salted, hashed form of your IP address (used only to limit abuse and rate of scan creation), and essential httpOnly cookies (inboxella_subscriber_id and inboxella_audit_id) that tie your browser to your audit and, once you subscribe, to your subscription.
• Subscription data (as controller): the email address you provide at checkout, your Stripe customer and subscription identifiers, your plan (monthly or annual), and your subscription status and renewal date. We use these to give you access, manage renewals and cancellation, and send your magic link. We never see or store your card details.
• Communications (as controller): if you contact us by email, we keep that correspondence to respond and improve the Service.

We do not store full message bodies. Snippets are discarded as soon as a message has been classified, and lead records contain only the small set of fields above.

As controller, we process your data for the following purposes:

• Providing the Service: connecting to your mailbox, scanning your messages, classifying them, surfacing warm leads, showing you the resulting report, managing your subscription and renewals, and emailing you a magic link back to your account.
• Service security and abuse prevention: using hashed IP addresses and per-account caps to prevent automated abuse, fraud, and runaway costs.
• Service improvement: aggregate, anonymized usage metrics (number of audits, success rates) to improve quality. We do not use the contents of your mailbox for this.
• Legal compliance: meeting our obligations under Finnish and EU law.

For the data for which we are the controller, we rely on the following legal bases (GDPR Article 6):

• Performance of a contract (Art. 6(1)(b)): running the audit you requested, taking payment, and delivering your report.
• Legitimate interests (Art. 6(1)(f)): securing the Service, preventing abuse, and improving quality. Our legitimate interests are balanced against your rights and freedoms.
• Consent (Art. 6(1)(a)): where applicable, such as for any future optional marketing communications. You can withdraw consent at any time.

For the personal data inside your mailbox — including the personal data of third parties who have emailed you — we act as your processor, not the controller. You, as the controller, are responsible for having a valid legal basis for that processing and for providing any notices required under Articles 13 and 14. We minimize this data aggressively on your behalf: only metadata is read, bodies are discarded, and third-party personal data that does not form a lead is not retained.

We share data only with the following sub-processors, each under a written data processing agreement:

• Unipile SAS (France) — provides the authenticated, read-only connection to your Gmail, Outlook, or IMAP mailbox. Unipile is SOC 2 Type II certified.
• OpenAI, OpenCo LLC (United States) — receives short message metadata (sender, subject, snippet) to classify warm leads. OpenAI processes API data under its data processing addendum, does not use API inputs to train its models by default, and retains API inputs for at most 30 days for abuse monitoring before deletion.
• Stripe Payments Europe, Ltd. (Ireland) — processes your recurring subscription payments and renewals, and receives the email address you provide at checkout to issue your receipts. We never see or store your card details.
• Resend (Plus Five Five, Inc.) (United States) — sends transactional emails such as your welcome / magic-link email, receiving the recipient email address. Used only to deliver those emails.
• Hosting providers we use to operate the Service: our application and the daily maintenance jobs run on Vercel Inc. (United States), and our database is hosted within the European Union.

We do not sell or rent your data, and we do not share it for advertising purposes. A current list of sub-processors is also published on our Trust & Security page.

Some sub-processors, including OpenAI, Resend, and Vercel, are based in the United States. Where data is transferred outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses (SCCs) and supplementary measures as required under GDPR Chapter V.

Retention is enforced automatically by a daily maintenance job — not just promised here:

• Message snippets and bodies: discarded as soon as classification of that message is complete.
• Mailbox connection: automatically disconnected once each scan's report is ready. We instruct Unipile to delete the connection after every scan.
• Lead records and the audit itself: kept until you delete them from the report screen, or for up to 90 days of inactivity, after which they are deleted automatically.
• Hashed IP address: kept for up to 30 days for abuse prevention, then deleted.
• Subscription and payment records: payment confirmations, the checkout email, and subscription records are kept as required for accounting and tax purposes under Finnish law.
• Aggregate, anonymized metrics: retained indefinitely, as they do not identify any person.

You can delete everything at any time from the report screen, or by emailing hello@bluebry.com.

Under the GDPR you have the right to access, correct, erase, restrict, object to, and port your personal data, and to withdraw consent where processing is based on consent.

For data we hold as controller, contact us directly and we will act on your request. For personal data inside a mailbox, where we act as a processor, the controller (the account holder who connected that mailbox) is the right point of contact; if you reach us instead, we will refer your request to them and assist them in responding, as described in our DPA.

You may also lodge a complaint with a supervisory authority. In Finland, this is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, tietosuoja.fi/en).

To exercise any of these rights, email hello@bluebry.com. We will respond within one month.

We use a large language model to classify whether a message represents a warm sales lead. This classification produces a ranked list of suggestions only — it does not produce any legal or similarly significant decision about any person. You remain in control: every reply and outreach action is yours to send, edit, or ignore.

We use only essential httpOnly, SameSite=Lax cookies: inboxella_subscriber_id (ties your browser to your subscription), inboxella_audit_id (ties your browser to a scan), and, if you use a sales demo, inboxella_demo. No analytics, advertising, or third-party tracking cookies are set by us.

We apply industry-standard technical and organizational measures to protect your data, including transport encryption (TLS), at- rest encryption for our database, hashed IP addresses, scoped API credentials, and strict access controls. No system is perfectly secure; if a breach affects your personal data, we will notify you and the supervisory authority as required by law.

The Service is intended for business users and is not directed to children under 16. We do not knowingly process personal data of children.

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent revision. Material changes will be highlighted on this page.

Questions, requests, or complaints?
Email: hello@bluebry.com
Postal: Bluebry Oy, Finland (postal address available on request).