Privacy Policy
Version 1.0 — effective 15 October 2026
1. Who we are
Bluebag Technologies LLC (“Bluebag”, “we”, “us”) decides how and why your personal information is used in the Bluebag webapp at app.bluebag.app, which makes us the controller of that information.
Contact us about privacy at privacy@bluebag.app.
2. What we collect
When you sign up: your email address, first name and last name.
When you set up your account (onboarding) or edit your profile:
- legal first, middle and last name, and date of birth;
- home address;
- nationality and country of tax residence, and your tax identification number (for example your National Insurance number or UTR);
- occupation, and where the money you will use comes from (source of funds);
- an optional username and an optional profile picture;
- which versions of our terms and this policy you accepted, and when.
When you use the webapp:
- sign-in records: when you sign in, from which internet (IP) address, and information about your browser and device. Our sign-in provider uses this to spot risky sign-ins (for example from an unusual location or device) and may then ask for extra verification;
- technical logs: each request to our servers is logged with its time, the address it came from and whether it succeeded, so we can keep the service working and secure.
When you contact us: what you tell us, and our replies.
We do not collect your phone number, copies of identity documents, or biometric data, and we do not use cookies or other tracking for analytics or advertising.
3. Why we use it, and our legal basis
| Purpose | Information | Legal basis |
|---|---|---|
| Create and run your account, sign you in, show your profile | Email, names, username, profile picture, sign-in records | Performing our contract with you |
| Meet our legal duties, including anti-money-laundering and counter-terrorist-financing checks, sanctions screening and tax reporting | Legal name, date of birth, address, nationality, tax residence and number, occupation, source of funds | Legal obligation |
| Prevent fraud and keep the service secure, including detecting risky sign-ins and automated abuse | Sign-in records, technical logs | Our legitimate interest in protecting you, us and the service |
| Answer your questions and complaints | Your messages and account details | Performing our contract; legitimate interests |
| Send you messages about your account (sign-in codes, important changes) | Performing our contract | |
| Marketing | — | We do not send marketing. If we start, we will ask for your consent first |
We check that you are 18 or over from your date of birth. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. The risky-sign-in check described above may ask you for extra verification, but it does not close or restrict your account by itself.
4. Who we share it with
We do not sell your personal information. We share it only with:
- service providers who process it for us, under contract and only on our instructions: Amazon Web Services (hosting, database, sign-in service and email delivery) and Microsoft (our own email, which we use to answer you);
- authorities, such as regulators, tax authorities and law enforcement, when the law requires us to or to prevent or report crime;
- a buyer or successor, if all or part of our business is sold or reorganised, who must protect your information as this policy describes.
When we add identity-verification or payment providers, or the wallet, we will name them here and tell you before they receive your information.
5. Where it is stored
Your information is stored with Amazon Web Services in the United States (Northern Virginia). Transfers from the UK and the EU to the United States are protected by the European Commission’s standard contractual clauses and the UK International Data Transfer Addendum, which are part of Amazon Web Services’ data processing terms. You can ask us for a copy of the relevant safeguards.
6. How long we keep it
| Information | How long |
|---|---|
| Account and identity information | While your account is open, then 5 years after it closes, as anti-money-laundering law requires |
| Records of transactions, once the wallet exists | 5 years after the transaction or the end of our relationship, whichever is later |
| Unfinished sign-ups (an email address whose code was never entered) | Deleted automatically after about 24 hours |
| Sign-in records and technical logs | Up to 90 days for operational logs; security and audit records up to 10 years where the law or regulators expect them |
| Support messages | 2 years after the matter is closed |
| Profile picture | Until you remove it or your account is closed |
When information no longer needs to be kept, we delete it or anonymise it so it can no longer identify you.
7. How we protect it
Your information is encrypted while travelling over the internet and while stored. Access is limited to the people and systems that need it, every access to our infrastructure is logged, and our systems are monitored for threats. No system is perfectly secure; if a breach puts your rights at risk we will tell you and the regulator as the law requires.
8. Your rights
You have the right to:
- ask for a copy of your information;
- have inaccurate information corrected (most of it you can correct yourself in Profile & settings);
- have your information deleted, or its use restricted, where the law allows. We cannot delete information we must keep by law, such as anti-money-laundering records;
- object to our use of your information on the basis of legitimate interests;
- receive the information you gave us in a portable format;
- withdraw consent at any time, where we rely on consent.
Email privacy@bluebag.app. We reply within one month. We may need to confirm your identity first.
You can complain to the Information Commissioner’s Office (ico.org.uk) in the UK, or to the data protection authority where you live in the EU. We would appreciate the chance to resolve your concern first.
9. Cookies and information stored in your browser
When you sign in, we set one cookie, a session cookie, so the webapp knows you are signed in. It holds only a random identifier, not your personal details, and our website’s own scripts cannot read it. It is strictly necessary for the service, so we do not ask for consent to it. Your session ends, and the cookie stops working, when you sign out, after 15 minutes without activity, or 12 hours after you signed in, whichever comes first. While you sign in, a second, short-lived cookie links the code we email you to your browser; it expires after a few minutes.
We also use a security service that checks your browser is not an automated program, to protect sign-up and sign-in from abuse; it may store a short-lived security token in your browser for that purpose only.
We do not use cookies or similar technology for analytics or advertising; if that changes, we will ask first where the law requires it.
10. Age
Bluebag is only for people aged 18 or over. If you believe someone under 18 has given us their information, contact privacy@bluebag.app and we will delete it.
11. Changes to this policy
Each version has a number and an effective date. We will tell you about significant changes by email and in the webapp before they take effect.