Privacy Policy

Who we are

Bluebase (“Bluebase”, “we”) provides a platform that organizations use to provision AI agents to their people. This policy explains what information the Bluebase service collects, how we use it, and the choices you have.

Information we process

• Account information— your name, email address, and role in your organization, used to sign you in and apply your organization's permissions.
• Customer content — what your organization authors or uploads (agents, workflows, knowledge-base documents) and your conversations with agents.
• Connected-system data— data your organization's agents read from business systems it connects, retrieved at request time to answer your request.
• Connected mailbox data — if you choose to connect your Google or Microsoft mailbox, as described in the next sections.

Google user data

Connecting Gmail is optional and is done by each user for their own mailbox. It is separate from signing in to Bluebase. When you connect, Bluebase requests these Google permissions:

• Read your email (gmail.readonly) — so an agent workflow your organization built can search your mailbox and read the matching messages when you ask it to.
• Send email on your behalf (gmail.send) — so an agent can send a message you have reviewed. Every message is shown to you — recipients, subject, and body — and is sent only after you approve it. Bluebase never sends email without your approval.
• Your email address and basic account identity (openid, email) — to confirm the account belongs to a domain your organization allows.

How we use it.Google user data is used only to provide the features you invoke in Bluebase. Messages are retrieved when you make a request and processed in memory to produce the response. To do this, message content relevant to your request is sent to our AI model provider (Google's Gemini API) to generate the response. Google user data is not used to develop, improve, or train generalized AI or machine-learning models, is not used for advertising, and is never sold.

What we store. We store the access grant Google issues (a refresh token), encrypted with AES-256-GCM under a key specific to your organization, together with your mailbox address and account identifier. We do not store copies of your mailbox. Records of an agent run — encrypted under the same organization key — may include excerpts of messages that run processed, and a draft awaiting your send approval is held until you approve or cancel it.

Sharing and human access. We do not transfer Google user data to third parties except as needed to provide the feature you invoked (the AI model provider and the infrastructure providers listed below), for security purposes, or to comply with law. Bluebase personnel do not read your Google user data unless you give us explicit permission for specific messages (for example, a support request), it is needed for security purposes such as investigating abuse, or it is required by law. Access by Bluebase personnel to encrypted customer content is logged.

Limited Use.Bluebase's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access.You can disconnect your mailbox at any time under Settings → Connected accounts; we revoke the grant with Google and delete the stored token. You can also remove Bluebase from your Google Account's third-party access page. Access is also revoked when you are removed from your organization or your organization's account is deleted.

Microsoft mailbox data

Connecting a Microsoft 365 mailbox works the same way, with the delegated permissions to read mail and send mail on your behalf. The same uses, storage, sharing, and approval rules apply. Microsoft does not offer an endpoint to revoke a delegated grant, so when you disconnect we delete our only copy of the token; you can also remove Bluebase's consent in your Microsoft account or organization settings.

Security

Customer content is encrypted at rest under a per-organization key, and all traffic is encrypted in transit. Access within an organization is controlled by role. Search indexes built from knowledge-base documents are protected by per-organization access controls and storage encryption.

Service providers

We use these infrastructure providers to operate Bluebase: Supabase (database and file storage), Vercel (application hosting), Google (Gemini AI models), Modal (document processing for knowledge-base uploads), and Resend (account email). Each processes data only to provide its service to us.

Retention and deletion

We keep customer content for as long as your organization uses Bluebase. When an organization's account is deleted, its encryption key is destroyed, rendering its encrypted content unrecoverable, and mailbox grants are revoked.

Contact

Questions about this policy or your data: privacy@bluebase.ai.