Privacy Policy

BlueHill (“BlueHill,” “we,” “us,” or “our”) provides a customer operations platform for ticketing, onboarding, project management, scheduling, and client portals. This policy applies to usebluehill.com, the BlueHill application at app.usebluehill.com, and related services that link to it.

If you have any questions, contact us at privacy@usebluehill.com.

We collect the following categories of information:

• Account information — name, email address, password (hashed), organization name, and profile details you provide when you sign up or invite teammates.
• Customer data you store in BlueHill — the records, tickets, tasks, messages, files, contacts, and other content you and your team create or upload to operate your business. You control this data; we process it on your behalf.
• Usage and device data — log data such as IP address, browser type, pages viewed, and actions taken in the product, used to operate, secure, and improve the Services.
• Integration data — when you connect a third-party service (for example, Zoom or Google), we store the credentials and the specific data needed to provide that integration. See Third-party integrations below.
• Cookies — we use cookies and similar technologies for authentication, preferences, and basic analytics. You can control cookies through your browser settings.

We use the information we collect to:

• Provide, maintain, and improve the Services;
• Authenticate users and secure accounts;
• Create and manage meetings, schedules, tickets, and other features you use;
• Send transactional messages such as confirmations, invites, and service notices;
• Respond to support requests and communicate with you about your account;
• Detect, prevent, and address fraud, abuse, and security issues; and
• Comply with legal obligations and enforce our agreements.

We do not sell your personal information, and we do not use the customer data you store in BlueHill to train third-party advertising or marketing models.

We share information only in these limited circumstances:

• Service providers — vendors who process data on our behalf under contract, such as cloud hosting (Amazon Web Services), email delivery (Resend), and analytics. They may only use the data to provide services to us.
• Integrations you enable — when you connect a third-party service, data flows to that service as needed to make the integration work (for example, creating a Zoom meeting on your account).
• Within your organization — content you create in BlueHill is visible to other members of your organization according to the roles and permissions you configure.
• Legal and safety — when required by law, legal process, or to protect the rights, property, or safety of BlueHill, our users, or the public.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this policy.

BlueHill integrates with services you choose to connect. For each integration we request only the minimum access needed and store credentials in encrypted form.

• Zoom — if you connect Zoom, we request permission to create and read meetings and read your basic profile so we can schedule Zoom meetings on your behalf and attach join links to your events. We do not access your recordings, transcripts, chat, or contacts. You can disconnect at any time from BlueHill Settings or the Zoom App Marketplace. See the Zoom integration page for details.
• Google — if you connect Google Calendar, we access the calendar data needed to read and write events you schedule through BlueHill. BlueHill's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

We retain account and customer data for as long as your account is active or as needed to provide the Services. When you delete content or close your account, we delete or de-identify the associated personal information within a commercially reasonable period, except where we must retain it to comply with legal obligations, resolve disputes, or enforce our agreements. Integration credentials are deleted when you disconnect the integration.

We protect your data with industry-standard safeguards, including encryption in transit (TLS 1.3) and at rest (AES-256), access controls, and regular monitoring. No method of transmission or storage is perfectly secure, but we work continuously to protect your information and promptly address vulnerabilities.

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. These include rights under the EU/UK GDPR and the California Consumer Privacy Act (CCPA/CPRA).

To exercise any of these rights, email privacy@usebluehill.com. For customer data you store in BlueHill, we act as a processor on behalf of your organization; we will route requests to the relevant account administrator where appropriate. We will not discriminate against you for exercising your rights.

BlueHill is operated from the United States and our infrastructure is hosted on AWS (US-East by default, with EU residency available on Enterprise plans). If you access the Services from outside the United States, your information may be transferred to and processed in the United States and other countries with appropriate safeguards in place.

The Services are intended for business use and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you through the Services or by email. Your continued use of the Services after an update means you accept the revised policy.

Questions or concerns about this policy or your data? Reach us at privacy@usebluehill.com or hello@usebluehill.com.