BlooTrue is operated by BlooLab Technologies Inc., a federally incorporated corporation in Canada ("BlooTrue," "we," "us," or "our"). We operate the BlooTrue platform at blootrue.com and app.blootrue.com (the "Service").

This Privacy Policy explains how we collect, use, disclose, and protect information when you use the Service.

By using BlooTrue, you agree to the collection and use of information in accordance with this Privacy Policy.

Information We Collect

1.1 Information You Provide

Account Information: Email address, business name, password, and login credentials.
Third-Party Login Data: If you sign in using Google, we receive your name, email address, and profile picture via OAuth authentication.
Business Information: Business name, logo, brand assets, business profile data, and connected platform links.
Customer Contact Information: Email addresses and phone numbers you upload or input for review request campaigns.
Payment Information: Payment processing is handled securely by Stripe. We do not store full credit card numbers.
Communications: Messages, support inquiries, or feedback sent to us.

1.2 Information Collected Automatically

Usage data (pages visited, features used, timestamps)
Device information (IP address, browser type, operating system)
Log data and system diagnostics
Cookies and similar technologies used for authentication, session management, and (with your consent) analytics

We do not use advertising cookies, retargeting pixels, or data broker services, and we do not sell or share your data with advertising networks. The analytics tools we do use are described in detail below.

1.3 Information from Connected Platforms

When you connect Google, Yelp, or similar platforms, we may access:

Public review content
Ratings and review timestamps
Reviewer names (as publicly displayed)
Business profile information
OAuth tokens necessary for integration

We do not access private messages, personal social posts, or unrelated account data.

Cookies, Analytics, and Session Recording

This section explains exactly what runs on our website, what it collects, and what changes depending on the choice you make in our cookie banner.

2.1 Strictly Necessary Cookies

These keep the Service working: signing you in, maintaining your session, protecting against abuse, and remembering the cookie choice you made so we do not ask again. They cannot be switched off and do not require consent.

2.2 Analytics Cookies (Consent Required)

If you select "Accept all" in our cookie banner, we load the following analytics tools. Each one sets cookies or stores data on your device, so none of them run before you accept:

Google Analytics 4 (Google LLC): aggregate traffic, referral sources, and page performance.
Ahrefs Web Analytics (Ahrefs Pte. Ltd.): search and referral performance.
PostHog (PostHog, Inc., United States): product analytics, sign-up funnel measurement, and session recording as described in 2.4.

With your consent, PostHog stores an identifier on the blootrue.com domain so that activity on our marketing website can be connected to your account if you later sign up. None of these providers are advertising networks and none of this data is used for advertising.

2.3 Measurement Without Cookies

If you select "Reject non-essential," or if you simply never answer the banner, we still count anonymous page visits using PostHog in cookieless mode. In this mode nothing is written to or read from your device: no cookies, no local storage. The identifier used to group events into a visit is derived from a value that rotates every 24 hours, so you cannot be recognised across days, cannot be linked to an account, and cannot be linked to any other website.

We collect only aggregate usage signals this way: pages viewed, referring source, approximate navigation path, and interactions with page elements such as buttons and links.

Because no information is stored on or accessed from your device, this measurement falls outside the consent requirement in Article 5(3) of the ePrivacy Directive. We rely instead on our legitimate interest under Article 6(1)(f) GDPR in understanding how our website is used so we can improve it. You have the right to object to this processing at any time by contacting info@bloolab.com.

2.4 Session Recording

For visitors who have accepted analytics cookies, PostHog may record a playback of the visit: pages viewed, mouse movement, clicks, scrolling, and text typed into non-sensitive fields such as the business search box in our widget builder. We use these recordings only to find where our product is confusing or broken.

Fields that carry sensitive information are masked inside your browser before any recording data is transmitted, so neither we nor PostHog receive their contents. This includes passwords, email addresses, telephone numbers, payment card fields, authentication tokens, and the free-text fields of our contact form.

Session recording is disabled entirely for visitors who have not accepted analytics cookies. If you have accepted and want a recording of your visit deleted, contact us and we will remove it.

2.5 How Analytics Data Is Routed

PostHog requests are sent through a path on our own domain (blootrue.com/ingest) before reaching PostHog. This is a technical measure so that measurement keeps working when browser extensions block analytics hostnames. It does not change who receives the data or what is collected: the recipient is PostHog, Inc., and the data is processed in the United States. Google and Ahrefs receive data directly and process it under their own privacy policies.

2.6 Changing or Withdrawing Your Choice

You can change or withdraw your cookie choice at any time using the "Cookie preferences" link in our website footer. Withdrawing consent stops cookie-based analytics and session recording going forward, and switches PostHog to the cookieless mode described in 2.3. It does not retroactively delete data already collected, which you may request separately using the contact details below.

Rejecting analytics has no effect on your ability to use the website or the Service.

Legal Basis for Processing (GDPR & International Users)

If you are located in the European Economic Area (EEA), United Kingdom, or similar jurisdictions, we process personal data under the following legal bases:

Performance of a contract (to provide the Service)
Legitimate interests (improving and securing the Service, and cookieless website measurement as described in 2.3)
Consent (for marketing communications, and for analytics cookies and session recording as described in 2.2 and 2.4)
Legal obligations

How We Use Information

We use collected information to:

Provide and maintain the Service
Aggregate and display business reviews
Generate AI-powered review response suggestions
Send review request emails and SMS messages on your behalf
Process payments and manage subscriptions
Provide analytics and reporting
Detect fraud, abuse, and security risks
Comply with legal obligations

SMS & Communication Compliance

If you use BlooTrue to send SMS review requests:

You represent and warrant that you have obtained all required consent under applicable laws, including the TCPA (United States), CASL (Canada), and other applicable regulations.
You are responsible for maintaining lawful opt-in records.
You must include clear opt-out instructions (e.g., "Reply STOP to unsubscribe").
BlooTrue is not responsible for unlawful or improper messaging practices conducted by users.

AI Processing Disclosure

BlooTrue uses artificial intelligence technologies to generate review responses and related content. Review content and related data may be temporarily processed by third-party AI service providers strictly to deliver the Service.

We do not use customer data to train public AI models.

AI-generated responses are suggestions and may require user review before publication.

How We Share Information

We do not sell personal data.

We may share information with:

Cloud hosting providers
Email and SMS delivery providers
Payment processors (Stripe)
Analytics providers (Google, Ahrefs, PostHog), as described in the Cookies, Analytics, and Session Recording section
AI processing providers
Professional advisors (legal, accounting)
Government authorities when legally required
Successors in a merger, acquisition, or asset sale

All service providers process data under contractual confidentiality and security obligations.

Data Retention

Account data is retained while your account remains active.
Upon account deletion, personal data will be deleted within 30 days unless required for legal compliance.
Imported review data is retained only while integrations remain active.

International Data Transfers

Because BlooTrue operates globally, personal data may be processed in countries outside your residence. We implement appropriate safeguards consistent with applicable data protection laws.

Your Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict or object to processing, request portability, or withdraw consent.

To exercise rights, contact: info@bloolab.com

We may require identity verification before processing requests.

Data Processing Agreement (DPA)

Business customers subject to GDPR or similar regulations may request a Data Processing Agreement (DPA) by contacting info@bloolab.com.

Security

We implement TLS/SSL encryption, secure password hashing (bcrypt), token-based authentication, and role-based access controls. No system is completely secure, and we cannot guarantee absolute security.

Children's Privacy

The Service is not intended for individuals under 16 years of age.

Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email or through the Service.

Contact Information

BlooTrue
Operated by BlooLab Technologies Inc. (Canada)
Email: info@bloolab.com
Website: blootrue.com