BlooTrue is operated by BlooLab Technologies Inc., a federally incorporated corporation in Canada ("BlooTrue," "we," "us," or "our"). We operate the BlooTrue platform at blootrue.com and app.blootrue.com (the "Service").

This Privacy Policy explains how we collect, use, disclose, and protect information when you use the Service.

By using BlooTrue, you agree to the collection and use of information in accordance with this Privacy Policy.

Information We Collect

1.1 Information You Provide

Account Information: Email address, business name, password, and login credentials.
Third-Party Login Data: If you sign in using Google, we receive your name, email address, and profile picture via OAuth authentication.
Business Information: Business name, logo, brand assets, business profile data, and connected platform links.
Contact Information You Upload: Email addresses and phone numbers stored in your account from features you have used. BlooTrue no longer sends review request campaigns.
Payment Information: Payment processing is handled securely by Stripe. We do not store full credit card numbers.
Communications: Messages, support inquiries, or feedback sent to us.

1.2 Information Collected Automatically

Usage data (pages visited, features used, timestamps)
Device information (IP address, browser type, operating system)
Approximate location derived from your IP address or your browser's timezone and language settings, used only to localize business search results and never stored as a location history
Log data and system diagnostics
Cookies and similar technologies used for authentication, session management, and (with your consent) analytics

We do not use advertising cookies, retargeting pixels, or data broker services, and we do not sell or share your data with advertising networks. The analytics tools we do use are described in detail below.

1.3 Information from Connected Platforms

When you connect Google, Yelp, or similar platforms, we may access:

Public review content
Ratings and review timestamps
Reviewer names (as publicly displayed)
Business profile information
OAuth tokens necessary for integration

We do not access private messages, personal social posts, or unrelated account data.

We retrieve publicly available review content through specialized data providers acting on our behalf, listed in the "How We Share Information" section below. The information sent to them is limited to what is needed to locate the business (such as its name, location, or public profile link).

1.4 Information Collected Through Widgets on Our Customers' Websites

BlooTrue widgets are embedded on websites operated by our customers. For this data, the business that installed the widget is the data controller and BlooTrue acts as its service provider (processor):

Widget delivery data: When a widget loads, our servers receive standard technical request data (IP address, browser type, page URL). We use it to deliver the widget, protect against abuse, and produce aggregate view counts for the business. We do not use it to build profiles of website visitors.
Lead submissions: Some widgets let a visitor send an inquiry to the business, for example a photo of a job together with a note, an email address, and optionally a phone number. We store this only so the business can receive and answer the inquiry.

If you submitted information through a widget on a business's website and want it corrected or deleted, contact that business; we act on its instructions. You can also reach us directly using the contact details at the end of this policy.

Cookies, Analytics, and Session Recording

This section explains exactly what runs on our website, what it collects, and what changes depending on the choice you make in our cookie banner.

2.1 Strictly Necessary Cookies

These keep the Service working: signing you in, maintaining your session, protecting against abuse, and remembering the cookie choice you made so we do not ask again. They cannot be switched off and do not require consent.

2.2 Analytics Cookies (Consent Required)

If you select "Accept all" in our cookie banner, we load the following analytics tools. Each one sets cookies or stores data on your device, so none of them run before you accept:

Google Analytics 4 (Google LLC): aggregate traffic, referral sources, and page performance.
Ahrefs Web Analytics (Ahrefs Pte. Ltd.): search and referral performance.
PostHog (PostHog, Inc., United States): product analytics, sign-up funnel measurement, and session recording as described in 2.4.

With your consent, PostHog stores an identifier on the blootrue.com domain so that activity on our marketing website can be connected to your account if you later sign up. None of these providers are advertising networks and none of this data is used for advertising.

2.3 Measurement Without Cookies

If you select "Reject non-essential," or if you simply never answer the banner, we still count anonymous page visits using PostHog in cookieless mode. In this mode nothing is written to or read from your device: no cookies, no local storage. The identifier used to group events into a visit is derived from a value that rotates every 24 hours, so you cannot be recognised across days, cannot be linked to an account, and cannot be linked to any other website.

We collect only aggregate usage signals this way: pages viewed, referring source, approximate navigation path, and interactions with page elements such as buttons and links.

Because no information is stored on or accessed from your device, this measurement falls outside the consent requirement in Article 5(3) of the ePrivacy Directive. We rely instead on our legitimate interest under Article 6(1)(f) GDPR in understanding how our website is used so we can improve it. You have the right to object to this processing at any time by contacting info@bloolab.com.

2.4 Session Recording

For visitors who have accepted analytics cookies, PostHog may record a playback of the visit: pages viewed, mouse movement, clicks, scrolling, and text typed into non-sensitive fields such as the business search box in our widget builder. We use these recordings only to find where our product is confusing or broken.

Fields that carry sensitive information are masked inside your browser before any recording data is transmitted, so neither we nor PostHog receive their contents. This includes passwords, email addresses, telephone numbers, payment card fields, authentication tokens, and the free-text fields of our contact form.

Session recording is disabled entirely for visitors who have not accepted analytics cookies. If you have accepted and want a recording of your visit deleted, contact us and we will remove it.

2.5 How Analytics Data Is Routed

PostHog requests are sent through a path on our own domain (blootrue.com/bt-relay) before reaching PostHog. This is a technical measure so that measurement keeps working when browser extensions block analytics hostnames. It does not change who receives the data or what is collected: the recipient is PostHog, Inc., and the data is processed in the United States. Google and Ahrefs receive data directly and process it under their own privacy policies.

2.6 Changing or Withdrawing Your Choice

You can change or withdraw your cookie choice at any time using the "Cookie preferences" link in our website footer. Withdrawing consent stops cookie-based analytics and session recording going forward, and switches PostHog to the cookieless mode described in 2.3. It does not retroactively delete data already collected, which you may request separately using the contact details below.

Rejecting analytics has no effect on your ability to use the website or the Service.

Legal Basis for Processing (GDPR & International Users)

If you are located in the European Economic Area (EEA), United Kingdom, or similar jurisdictions, we process personal data under the following legal bases:

Performance of a contract (to provide the Service)
Legitimate interests (improving and securing the Service, and cookieless website measurement as described in 2.3)
Consent (for marketing communications, and for analytics cookies and session recording as described in 2.2 and 2.4)
Legal obligations

How We Use Information

We use collected information to:

Provide and maintain the Service
Aggregate and display business reviews
Process payments and manage subscriptions
Provide analytics and reporting
Detect fraud, abuse, and security risks
Comply with legal obligations

AI Processing Disclosure

BlooTrue publishes free tools on its website that use artificial intelligence to generate suggested text. Text you submit to those tools is processed by third-party AI providers strictly to return a result. BlooTrue does not generate or publish replies to your reviews on your behalf.

We do not use customer data to train public AI models.

How We Share Information

We do not sell personal data.

We may share information with:

Cloud hosting providers
Email delivery providers
Payment processors (Stripe)
Review data retrieval providers that fetch publicly available review content on our behalf (currently OpenWeb Ninja, Wextractor, and Outscraper)
Analytics providers (Google, Ahrefs, PostHog), as described in the Cookies, Analytics, and Session Recording section
AI processing providers
Professional advisors (legal, accounting)
Government authorities when legally required
Successors in a merger, acquisition, or asset sale

All service providers process data under contractual confidentiality and security obligations.

Data Retention

Account data is retained while your account remains active.
Upon account deletion, personal data will be deleted within 30 days unless required for legal compliance.
Imported review data is retained only while integrations remain active.

International Data Transfers

Because BlooTrue operates globally, personal data may be processed in countries outside your residence. We implement appropriate safeguards consistent with applicable data protection laws.

Your Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict or object to processing, request portability, or withdraw consent.

To exercise rights, contact: info@bloolab.com

We may require identity verification before processing requests.

Data Processing Agreement (DPA)

Business customers subject to GDPR or similar regulations may request a Data Processing Agreement (DPA) by contacting info@bloolab.com.

Security

We implement TLS/SSL encryption, secure password hashing (bcrypt), token-based authentication, and role-based access controls. No system is completely secure, and we cannot guarantee absolute security.

Children's Privacy

The Service is not intended for individuals under 16 years of age.

Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email or through the Service.

Contact Information

BlooTrue
Operated by BlooLab Technologies Inc. (Canada)
Email: info@bloolab.com
Website: blootrue.com