Privacy Policy

1. About BluWorkflow

BluWorkflow is a case and workflow management platform for professional users, teams and organisations. It supports clients, cases, documents, workflow activity, team access and optional AI-assisted case reviews. In this policy, “BluWorkflow”, “we”, “us” and “our” refer to the BluWorkflow service; the confirmed legal operator must be inserted above when supplied.

2. Information processed

Account and organisation information

This may include a person's name, email address, password-derived authentication information, verification and reset records, organisation membership, role, permissions and multi-factor authentication settings.

Information entered into BluWorkflow

Users and organisations may enter or upload client information, case information, documents and attachments, case notes, workflow information, deadlines, reminders, required document status, activity and case history.

The organisation using BluWorkflow is responsible for ensuring it is authorised to process information it enters about its clients, cases and activities.

Billing information

BluWorkflow processes the selected plan, subscription status, active seat quantity, trial and billing-period information, and identifiers used to reconcile the organisation with Stripe. Stripe-hosted checkout and billing-portal pages handle payment-method entry. BluWorkflow sends Stripe the signed-in customer's email where needed, the server-selected plan price, the server-calculated seat quantity and organisation/plan references.

Technical and security information

This may include IP address, device and browser information, authentication and session information, application activity, audit events, security logs, and error or diagnostic information where available. The web application stores authentication tokens in browser local storage so the signed-in session can operate.

Support communications

If someone contacts BluWorkflow, the service may process their email address, correspondence, screenshots and other information voluntarily supplied with the request.

3. How information is used

• Provide and operate the service.
• Authenticate users and protect accounts.
• Manage organisations, memberships, roles, permissions, plans and active seats.
• Store and display clients, cases, documents, workflows, deadlines and reminders.
• Maintain activity and audit information.
• Provide an AI-assisted review when an authorised user requests one.
• Administer subscriptions through Stripe.
• Respond to support requests, diagnose problems and maintain security.
• Meet applicable legal obligations once those obligations and lawful bases are confirmed.

4. Optional AI-assisted features

Supported reviews can summarise structured case context, compare required document types with recorded status, suggest next actions, and review risks or timelines. When an authorised user requests a review, relevant structured context is sent to the configured external AI provider. BluWorkflow currently uses OpenAI technology for this function.

AI output is advisory. It does not autonomously contact clients or modify case records. Users remain responsible for reviewing it before use.

5. Service providers and disclosure

Information may be made available where necessary to cloud infrastructure and technology providers operating the service, Stripe for subscription checkout and management, OpenAI when an authorised user requests an AI-assisted review, and authorities or other parties when legally required. BluWorkflow does not sell customer case information for third-party advertising.

6. Organisation access and permissions

BluWorkflow uses organisation-based access. A user's access depends on active organisation membership, assigned role permissions and applicable plan capabilities. Organisation owners and authorised administrators can manage membership, roles and access within their organisation.

7. Security

The current implementation includes authentication controls, optional multi-factor authentication, role and capability checks, organisation-scoped data access, protected document routes, audit logging and browser security headers. No system guarantees absolute security. Users should protect credentials and report suspected compromise. See the Security page for a factual control summary.

8. Retention

Information is retained to operate the service, maintain security, resolve issues and meet applicable obligations. A confirmed category-by-category retention schedule has not yet been supplied, so no fixed periods are stated here.

9. Privacy rights

Rights depend on the person, location and applicable law and may include access, correction, deletion, restriction, objection, portability, and withdrawal of consent where consent applies. Information entered by an organisation may be controlled by that organisation, so a request may need to be directed to it. The applicable lawful bases and controller details remain to be confirmed.

10. Account and data deletion

Signed-in users can request permanent account deletion by opening Settings, choosing Profile, and using Danger Zone → Delete Account. Confirmation requires the current password and takes effect when accepted.

BluWorkflow will not leave a shared organisation without an owner. A sole owner must transfer ownership before deleting their account while other members remain. If the user is the sole owner and sole member, the organisation and its organisation-owned data are also deleted. Certain audit or security records may be anonymised rather than linked to the deleted account.

11. International processing

BluWorkflow's providers may process information outside the user's country. The applicable legal transfer mechanism and provider-specific transfer details require confirmation and are not asserted here.

12. Children

BluWorkflow is designed for professional and organisational use, not for children to create or operate accounts independently.

13. Changes to this policy

This policy may be updated when the service, legal requirements or processing practices change. The published page will show its effective date.