Blue Rain Labs LogoBlue Rain Labs

Client Hub Privacy Policy

Version 1
Effective September 29, 2026

1. Who we are and what this policy covers

1.1This Privacy Policy explains how Blue Rain Labs Inc. ("Blue Rain Labs", "we", "us") collects, uses, shares and protects personal information through the Blue Rain Labs Client Hub at hub.bluerainlabs.com and the API Gateway at api.bluerainlabs.com (together, the "Services"). Terms defined in the Client Hub Terms of Service, such as Client Data, User and Owner, have the same meaning here.

1.2Our public website, bluerainlabs.com, has its own privacy policy covering visitors, enquiries and prospective clients. This policy applies once you or your organization use the Services.

1.3Our office is at Unit 147, 1329 Queen Street East, Toronto, Ontario M4L 1C6. We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (Canada) and, where they apply, provincial private-sector privacy laws such as those of British Columbia and Quebec.

2. Our two roles

2.1Information we are responsible for. For information about you as a User and about your organization as our client, such as your account, sign-in and billing records, support requests and how you use the Client Hub, we decide how it is used and we are responsible for it under this policy.

2.2Information we hold for you. Your websites and applications send us personal information about your own customers, prospects, subscribers and website visitors through the API Gateway, such as contact-form leads, newsletter subscribers and your application's user accounts. That information is Client Data. Your organization is responsible for it, and we process it as your service provider, on your instructions and only to provide the Services, as set out in Section 11 of the Terms. Your own privacy notice, not this one, tells those people how you use their information. Section 13 explains how we help you answer their requests.

3. What we collect

3.1Account and profile. Your name and email address, and if you add them, your phone number, job title and profile picture; your role in each organization you belong to; and invitations sent to you, including who sent them. Firebase Authentication handles your password. We never see or store it.

3.2Your organization. Its name and legal name, billing email, address, any tax identifiers you give us, and the projects, features and services it holds.

3.3Billing. Invoices, subscriptions and payment status. You enter card and bank details with Stripe, which stores them. We keep only Stripe's references to your customer record, subscriptions and invoices.

3.4Sign-in and security records. For each sign-in session, the network (IP) address, the browser and device description your browser sends (its user agent), when the session started and was last active, and when it expires. We count failed sign-in attempts per IP address to stop password guessing. We also keep the password reset and invitation links we issue.

3.5Terms acceptance records. When you accept the Terms of Service we record your user ID and email address, the version you accepted and a fingerprint of its text, the organizations and roles your acceptance binds, your IP address together with the chain of forwarding addresses reported by our hosting infrastructure, your browser's user agent, and the date and time.

3.6Support and correspondence. Support requests you submit in the Client Hub, including requests to close an account, and email you send us.

3.7Records of administrative changes. When a User or a member of our staff changes an organization, its Users or roles, its projects, features or services, or its API keys, we record who made the change, what changed and when.

3.8API keys. The keys issued to your projects, stored in a form we can verify but not read back, with their names, status, when they were created, last used and revoked, and how often they are used.

3.9How you use the Client Hub. Only if you accept analytics. See Section 5.

3.10Client Data. Depending on the features your organization uses: contact-form leads (name, email address, subject and message, the page and form it came from, IP address, browser user agent and marketing consent choice); newsletter subscribers (email address, name, how they signed up, and their consent and confirmation records, including the IP address at sign-up); a record of each newsletter sent to each recipient; user accounts your applications share with us (name, email address, sign-in method, account status, profile details and marketing consent); and blog content. We hold Client Data for you under Section 2.2.

4. How we use it

4.1We use personal information about you and your organization to:

(a)create and secure your account, sign you in, and keep unauthorized people out;

(b)provide the Services, including hosting, email sending, and the features and services your organization holds;

(c)bill, collect payment, and keep accounting and tax records;

(d)answer support requests and contact you about the Services, including service, security and billing notices and changes to the Terms or this policy;

(e)record your acceptance of the Terms, as evidence of our agreement;

(f)keep an audit trail of administrative changes, and investigate misuse, security incidents and breaches of the Terms;

(g)understand how the Client Hub is used so we can improve it, only if you accept analytics (Section 5); and

(h)comply with the law and enforce our agreements.

4.2Consent. The uses in Section 4.1, other than (g), are necessary to provide the Services your organization signed up for, and you consent to them by using the Services. Analytics is optional and runs only with your express consent.

4.3What we do not do. We do not sell or rent personal information, use it for advertising, or use Client Data for our own purposes. We do not make decisions about you by automated means. Any marketing email we send you complies with Canada's Anti-Spam Legislation and lets you unsubscribe.

4.4Staff access. Our staff access your organization's information only to provide, support, secure and bill the Services, to investigate suspected misuse or breaches of the Terms, or when the law requires it.

5. Cookies and analytics

5.1What the Client Hub needs to work. We use the following without asking, because the Client Hub cannot work without them:

  • Firebase Authentication keeps your sign-in in your browser's storage so you stay signed in.
  • The brl_consent cookie stores your analytics choice, granted or denied, for 13 months. It is set on .bluerainlabs.com, so the same choice applies on bluerainlabs.com.
  • The brl_consent_hub_v cookie records which version of the Client Hub's cookie and analytics setup your choice answered, for the same 13 months. If we change the cookies or analytics we use, for example by adding a feature that needs a new one, we ask you again, whatever you chose before.

5.2Google Analytics, only if you accept. Analytics is off until you choose Accept in the cookie banner. Until then Google Analytics is not loaded and nothing is sent to Google. If you accept, Google Tag Manager loads Google Analytics, which sets its own cookies (_ga and one beginning _ga_) lasting up to two years, and sends Google:

  • the pages you view, with sensitive parts of the address such as reset codes removed, and which part of the Client Hub and which feature you opened;
  • signing in and out, and a small number of actions: submitting a support request, requesting a plan change and completing a password reset;
  • your user ID, a random identifier that is not your name or email address, and whether you are a client or a member of our staff; and
  • the device, browser, approximate location and referral information Google Analytics collects automatically.

We never send your name or email address to Google Analytics. Google keeps this event data for 14 months and then deletes it.

5.3No advertising. We do not use advertising or remarketing cookies. The advertising signals in Google Consent Mode (ad storage, ad user data and ad personalization) are always set to denied, and Google Tag Manager on the Client Hub loads Google Analytics and nothing else.

5.4Changing your choice. Once signed in, use Profile Settings → Privacy. You can also use the Cookie preferences link on the Client Hub sign-in page and at the end of this policy. Turning analytics off reloads the page so that Google Analytics stops.

6. Who we share it with

6.1Service providers. We share personal information only with the service providers below, only as needed for the purpose shown, and under contracts that require them to protect it:

  • Google Cloud and Firebase (Google LLC, United States): hosting of the Client Hub and API Gateway, the database, file storage, sign-in, scheduled jobs and backups.
  • Stripe (United States): payments, invoices and subscriptions. Stripe collects card and bank details directly.
  • Postmark (ActiveCampaign, LLC, United States): delivery of account email such as invitations, password resets and notices, and of the newsletters and notifications sent through the Services.
  • Google Workspace (Google LLC, United States): our email, and internal alerts to our staff about new support requests and billing events.
  • Google Analytics (Google LLC, United States): measuring how the Client Hub is used, only with your consent.
  • Sherweb (Sherweb Inc., Canada): our distributor for Google Workspace, for organizations that buy it through us. Sherweb receives the organization's name, domain and the account details needed to provision and manage its licences, processes them as a service provider, and may store them outside Canada. Google then provides Workspace to your organization under Google's own terms.

6.2When the law requires it. We disclose personal information when the law requires it, for example under a court order, warrant or subpoena, and only what is required. Where the law allows, we tell the affected organization first.

6.3Business transfer. If our business is sold, merged or reorganized, personal information may pass to the successor, which must protect it as this policy describes.

7. Where your information is stored

7.1The Services run on Google Cloud in the United States, and most of the providers in Section 6 also process information there. We do not store your information in Canada, and we do not claim to.

7.2Information stored or processed outside Canada is subject to the laws of the country where it is held, and may be accessed by that country's courts, law enforcement and national security authorities.

7.3We develop and test the Services with test data only. Your information is not copied into our development environment.

8. How long we keep it

8.1We keep personal information only as long as we need it for the purposes in this policy or the law requires, then delete or anonymize it on the following schedule:

  • Password reset and invitation links: 30 days after they expire.
  • Failed sign-in counters: 30 days after the last attempt.
  • Sign-in session records: 12 months after the session expires.
  • Support requests: 3 years after the last update.
  • Email you send us: 3 years after the last message in the conversation.
  • API key records: 2 years after the key is revoked or expires.
  • Records of administrative changes: 7 years.
  • Invoices: 7 years, as the Income Tax Act (Canada) requires.
  • Records of payment events received from Stripe: 90 days.
  • Records of deliveries to your websites' webhooks: 90 days.
  • Newsletter send records: 12 months after the newsletter was sent.
  • Unsubscribed newsletter subscribers: personal details removed 3 years after they unsubscribe; an irreversibly scrambled marker stays so we never email them again.
  • Deleted application user accounts: 90 days after your application deletes them.

8.2Your account. We keep your account, profile and organization records and your Terms acceptance records while your account is open and for 2 years after it is closed or your organization's relationship with us ends, as evidence of our agreement and in case of a claim, and then delete them.

8.3Client Data. We keep Client Data while your organization is active. When the relationship ends, you have 30 days to ask for an export under Section 11.7 of the Terms, and we then delete it.

8.4Consent cookies. 13 months, whether you accepted or declined, after which we ask again. We also ask again sooner if we change the cookies or analytics we use (Section 5.1).

8.5Backups. We keep daily backups of the Client Hub's database for 98 days, and can restore it to any point in the last 7 days. Deleted information remains in backups until they expire, so it is fully removed within 98 days of its deletion. We use backups only to recover the Services, not to bring back information that was deleted on purpose.

8.6Service providers. Stripe, Postmark and Google keep the information they hold under their own retention policies and legal obligations.

9. How we protect it

9.1We protect personal information with safeguards appropriate to its sensitivity, including:

(a)encryption in transit and at rest;

(b)sign-in through Firebase Authentication, with repeated failed attempts blocked;

(c)authorization on our servers for every request, so a User sees only the organizations they belong to and can change only what their role allows;

(d)credentials for the services we connect on your behalf kept encrypted, separate from the rest of your data;

(e)card and bank details handled by Stripe, never by our systems;

(f)a record of administrative changes; and

(g)access to live data limited to the staff who need it, with development and testing done on test data only.

9.2No system is perfectly secure. If you think someone has accessed your account without permission, tell us immediately through the Client Hub support form or at support@bluerainlabs.com.

10. Security breaches

10.1If a breach of our security safeguards involves personal information we are responsible for, we contain it, assess whether it creates a real risk of significant harm to anyone, and if it does, report it to the Office of the Privacy Commissioner of Canada and to any provincial commissioner where the law requires, and notify the people affected as soon as feasible.

10.2We keep a record of every breach, whether or not it had to be reported, for at least 24 months.

10.3If a breach affects Client Data, we notify your organization without undue delay and help you meet your own obligations, as Section 14.3 of the Terms describes. As the organization responsible for that information, you decide whether to notify your customers.

11. Artificial intelligence

11.1We use AI assistants, currently Anthropic's Claude and Google's Gemini, to help us write and review the Client Hub's software and our own business documents. They work on our source code and on test data. We do not give them your account information, your organization's data, or the leads, subscribers, support requests or invoices stored in the Client Hub, and the Client Hub itself does not use AI to process your information. If that changes, we will update this policy and tell you before the change takes effect.

12. Your rights and choices

12.1You may:

(a)ask what personal information we hold about you, how we use it and who we have disclosed it to, and get a copy;

(b)correct it: you can change most profile details in Profile Settings, and an Owner can change your organization's details;

(c)withdraw consent: you can turn analytics off at any time (Section 5.4). Withdrawing consent to a use the Services depend on may mean we can no longer provide them; and

(d)close your account from Profile Settings → Privacy, or by asking us. We keep the records Section 8 describes for the periods shown.

12.2How to ask. Write to privacy@bluerainlabs.com or to the address in Section 1.3. We will confirm your identity before disclosing or changing anything, and we respond within 30 days, or tell you within that time if the law allows us more. There is no charge.

12.3Quebec residents have additional rights under Quebec law, including to receive personal information they provided to us in a structured, commonly used technological format.

12.4Complaints. Please contact our Privacy Officer first (Section 16). You may also complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or to your provincial privacy commissioner.

13. Requests from your customers

13.1If one of your customers, subscribers or website visitors asks us about their information in your Client Data, we will refer them to you unless the law requires otherwise.

13.2We help you answer their requests, as Section 11.3 of the Terms provides. You can export your newsletter subscribers from the Client Hub. For contact-form leads and other Client Data, ask us, and we will find, export, correct or delete the records for a given person promptly so you can meet your own deadline.

14. Children

14.1The Services are for businesses and are not directed at children. We do not knowingly collect personal information from children as Users. Client Data may include information about children only if you collect it, and you are responsible for having a lawful basis to do so.

15. Changes to this policy

15.1We may update this policy. Each version shows its version number and effective date, and we keep a copy of every version.

15.2For a significant change we will tell your organization's Owners by email or by a notice in the Client Hub at least 30 days before it takes effect. If a change needs your consent, we will ask for it.

16. Contact and Privacy Officer

16.1Our Privacy Officer, Aaron Wright, is accountable for our compliance with this policy. Contact the Privacy Officer at privacy@bluerainlabs.com or by post at the address in Section 1.3.

16.2For help with your account, use the Client Hub support form or email support@bluerainlabs.com.