PRIVACY NOTICE OF BLUBEAM

At BluBeam LLC, we care about your privacy and are committed to protecting it. This Privacy Notice (“Notice” or “Privacy Notice”) explains who we are, what personal data we collect, how we use it, the legal grounds we rely on when processing your Personal Data, how we keep it secure, and your privacy rights, in accordance with applicable Data Protection Laws (as defined in the “Definitions” section).

I. Applicability of this Privacy Notice

This Privacy Notice applies to you as a user (“You,” “Your,” and sometimes “Customer”) of BluBeam, our AI-agent orchestration software for Linux (the “Software” or “Product”), and of our website at blubeam.pro (the “Site”) and related services (together, the “Services”). If you do not agree with this Privacy Notice, do not access or use the Software or the Services. The core functionality of the Software is described in the Terms of Service.

The data controller of Your Personal Data is:

BluBeam LLC (hereinafter “We,” “Us,” “Our,” or “BluBeam”)

Registered address: [BLUBEAM LLC REGISTERED ADDRESS]

Privacy contact: blubeam@agentmail.to

This Privacy Notice does not apply to: (a) third-party services that are not our Data Processors, with whom no Personal Data is shared; (b) anonymized or aggregated data that can no longer identify you; and (c) data you choose to keep entirely on your own device or infrastructure, which we never receive (see “Self-Hosted Data” below).

Self-Hosted Data (important). BluBeam is self-hosted software that runs on your own Linux desktop or server. Your AI provider API keys, prompts, agent configurations, workflows, conversation content, and outputs are stored locally on your device and are not transmitted to or collected by BluBeam LLC in the normal operation of the Software. We do not have access to that content. Data we do process is limited to what is described in Section III.

Our Product is not intended for individuals who are minors under the laws of their country of residence. We do not knowingly collect personal data from minors. If you are a minor, please do not use the Product or provide us with personal data. If you believe a minor has provided us personal data, contact us at blubeam@agentmail.to and we will take steps to delete it.

We do not collect or process special categories of Personal Data (such as race or ethnicity, religious beliefs, sexual orientation, political opinions, trade-union membership, health, genetic, or biometric data), nor information about criminal convictions.

A separate Terms of Service governs the licensing, access, and use of the Product and is an integral part of this Privacy Notice.

II. Definitions

Capitalized terms not otherwise defined have the meanings below:

Data Processor means a natural or legal person or body that processes Personal Data on behalf of BluBeam.

Data Protection Laws means applicable data-protection or privacy laws, including: (i) the EU General Data Protection Regulation (“GDPR”); (ii) the UK GDPR and Data Protection Act 2018 (“UK GDPR”); (iii) the California Consumer Privacy Act as amended (“CCPA/CPRA”); and (iv) any other applicable laws that are similar to or successors of the foregoing.

Device means the Linux-based computer or server that belongs to you and on which you install and run the Software.

Personal Data means any information relating to an identified or identifiable natural person.

Software / Product means BluBeam, including its Basic and Pro editions, updates, and related documentation.

Services means the Software, the Site at blubeam.pro, account and licensing services, and support.

III. Information We Collect and Purposes

We collect only the limited data needed to provide accounts, licensing, payments, support, and (where you opt in) diagnostics. Specifically:

a) Account data

When you create an account on blubeam.pro, we collect your email address and a securely hashed password. Purpose: to create and secure your account, authenticate logins, and communicate service and account information. Legal basis: performance of a contract.

b) License and activation data

For Pro, we process your license key and its activation status (edition, whether active, associated account). When the Software verifies a key, it sends the key to our licensing endpoint to confirm entitlement. Purpose: to issue, validate, and manage Pro licenses. Legal basis: performance of a contract.

c) Payment data

Paid subscriptions are processed by our third-party payment processor, [PAYMENT PROCESSOR, e.g. Stripe]. We do not store full payment-card numbers; the processor handles card data under its own privacy terms. We receive limited billing metadata (such as subscription status and the last four digits of a card). Purpose: to take payment and manage subscriptions and discount codes. Legal basis: performance of a contract.

d) Website security and log data

When you log in to the Site, we record your IP address, timestamps, and success/failure of login attempts, and we may temporarily block an IP address after repeated failed logins. We keep an administrative audit log of security-relevant actions. Purpose: to secure accounts and the Site, prevent abuse, and comply with law. Legal basis: legitimate interests (security) and legal obligation.

e) Opt-in error and diagnostic reports

If — and only if — you enable error reporting in the Software, BluBeam collects technical error information (error messages, stack traces, app version, edition, operating-system and architecture details) and sends it to us approximately weekly. Before anything leaves your Device, the Software automatically scrubs credentials such as API keys, tokens, your BluBeam license key, and email addresses from the report. This feature is off by default. Purpose: to diagnose and fix bugs and improve stability. Legal basis: consent, which you may withdraw at any time by disabling the feature.

f) Support communications

If you contact us (for example at blubeam@agentmail.to), we process the information you provide to respond. Purpose: to provide support. Legal basis: legitimate interests and, where applicable, performance of a contract.

g) Website cookies and similar technologies

The Site uses strictly necessary cookies (for example, session and authentication cookies). See Section IV. Purpose: to operate the Site and keep you signed in. Legal basis: legitimate interests for strictly necessary cookies; consent for any non-essential cookies.

What we do NOT collect. Because BluBeam is self-hosted, we do not collect your AI provider API keys, the content of your prompts or agent conversations, your agent or workflow configurations, or the outputs your agents produce. These remain on your Device. Opt-in error reports are scrubbed of secrets before they are sent.

IV. Cookies and Similar Technologies

A cookie is a small text file stored on your device. On blubeam.pro we use strictly necessary cookies to authenticate your session and keep the Site secure and functional. These do not require consent under most Data Protection Laws. If we introduce analytics or other non-essential cookies, we will request your consent first and provide controls to manage them. You can also control cookies through your browser settings, though disabling strictly necessary cookies may prevent you from signing in.

V. Legal Basis We Rely On

Where the GDPR or UK GDPR applies, we process Personal Data on one or more of the following legal bases:

Performance of a contract — to provide accounts, licensing, payments, and the Services you request.

Consent — for opt-in error reporting and any non-essential cookies; you may withdraw consent at any time.

Legitimate interests — to secure our Site and accounts, prevent fraud and abuse, and improve our Services, balanced against your rights.

Legal obligation — to comply with applicable law, including tax, accounting, and security-related requirements.

VI. Third-Party Information and Personal Data Disclosure

We do not sell your Personal Data. We share it only with Data Processors and partners that help us operate the Services, under contracts requiring appropriate safeguards. These may include:

Hosting and infrastructure — our website, database, and licensing endpoints (e.g., [CLOUD/CDN PROVIDER, e.g. Cloudflare]).

Payment processing — [PAYMENT PROCESSOR], which handles card data under its own terms.

Email delivery — our transactional email provider used to send password-reset and account emails.

We may also disclose Personal Data where required by law, to protect our rights, or in connection with a merger, acquisition, or sale of assets, subject to this Notice.

AI providers. When your agents call third-party AI provider APIs, they do so directly from your Device using your own API keys and accounts. Those providers process your prompts and content under their own privacy policies and terms. BluBeam LLC is not a party to, and does not receive, that content.

VII. Customer Interactions and Communications

From time to time we may contact you about your account, service changes, security matters, or (with your consent where required) product news. You can opt out of non-essential marketing communications at any time using the unsubscribe mechanism provided or by contacting blubeam@agentmail.to. We will still send essential transactional and security messages related to your account.

VIII. Duration of Personal Data Storage

We keep Personal Data only as long as necessary for the purposes described in this Notice or as required by law. In general: account and license data are retained while your account is active and for a reasonable period afterward; billing records are retained as required by tax and accounting law; security logs are retained for a limited period appropriate to their purpose; and opt-in error reports are retained only as long as needed to diagnose and fix issues. When data is no longer needed, we delete or anonymize it.

IX. Security and Confidentiality

We use technical and organizational measures appropriate to the risk, including hashing of account passwords, encrypted transport (HTTPS/TLS), access controls and administrative audit logging, IP-based protections against repeated failed logins, and automatic redaction of secrets from opt-in error reports before transmission. No method of transmission or storage is completely secure, and we cannot guarantee absolute security; however, we work to protect your Personal Data and to promptly address any vulnerabilities we identify.

X. Personal Data Breach Notification

If a Personal Data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required by applicable law, affected individuals, within the timeframes and in the manner required by the applicable Data Protection Laws.

XI. Your Rights as the Data Subject

Subject to applicable law, you have the right to: access your Personal Data; correct inaccurate data; request erasure; restrict or object to certain processing; data portability; and withdraw consent where processing is based on consent. To exercise any right, contact us at blubeam@agentmail.to. We will respond within the timeframe required by applicable law. You also have the right to lodge a complaint with your local supervisory authority.

XII. California Addendum — For Residents of California

If you are a California resident, the CCPA/CPRA provides additional rights, including the right to know what Personal Information we collect and how we use it, the right to request deletion, the right to correct inaccurate information, and the right to non-discrimination for exercising your rights. We do not sell your Personal Information, and we do not “share” it for cross-context behavioral advertising. The categories of Personal Information we collect are described in Section III (identifiers such as email and IP address, account and license records, and payment metadata held by our processor). To exercise your California rights, contact blubeam@agentmail.to. You may use an authorized agent to submit requests, subject to verification.

Where the UK GDPR and the Data Protection Act 2018 apply, references in this Notice to the GDPR should be read as references to the UK GDPR. Our lawful bases, your rights, and our obligations are equivalent to those described above. The relevant supervisory authority is the UK Information Commissioner’s Office (ICO). Where we transfer Personal Data outside the UK, we rely on an appropriate transfer mechanism, such as the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.

XIV. Changes to this Privacy Notice

We may update this Privacy Notice from time to time. When we make material changes, we will update the “Last updated” date above and, where required by law, provide additional notice. Your continued use of the Services after changes take effect constitutes acceptance of the updated Notice.

Privacy Policy