This notice explains what personal information Blugency collects, why we collect it, who we give it to, how long we keep it, and what you can ask us to do with it. It covers our marketing website at https://blugency.co, our product application at https://app.blugency.co, the ways you can contact us or book a meeting with us, and the information you give us when you become a client of our services. There is no second privacy notice for the application: this one covers both, and section 16 explains what that means in practice. If you use our tax or bookkeeping services, some of your information is also covered by federal financial privacy rules, and section 3 explains how the two fit together. We have written this in plain English on purpose. If any of it is unclear, email support@blugency.co and we will explain it.
1. Who we are and what this notice covers
We are Blugency LLC, a New Mexico limited liability company. We trade as Blugency. Our registered address is 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, United States. Our email address for everything in this notice is support@blugency.co, and privacy requests go to privacy@blugency.co as section 11.2 explains.
We were founded in 2021, we have 10+ team members, and we have served 500+ companies. We sell business formation, business essentials, compliance and changes, tax and accounting, and Studio services (brand, websites, apps and growth) to founders in the United States and around the world. Everything we do is delivered online.
1.1 We are the controller of the information described here
For the information described in this notice, Blugency LLC is the controller. Some state privacy laws use the word business instead of controller. Both mean the same thing here. We are the company that decides why your information is collected and what happens to it, and we are the company to hold responsible for it.
1.2 When we are not the controller
Sometimes you send us personal information about other people. A marketing client sends us a contact list, or gives us access to an account full of their own customers' details. In those situations you decide why that information is processed and we act on your instructions, which makes us a processor rather than a controller. That relationship is governed by a separate written agreement, our Data Processing Addendum, rather than by this notice. That document sets out our role service by service, because for most of what we sell we are the controller in our own right rather than anyone's processor. Everything this notice says about how we protect information still applies either way.
1.3 What this notice does not cover
It does not cover websites we link to, which have their own policies. It does not cover what happens inside a third-party service beyond what we describe in section 15, such as the booking widget embedded on our website. It does not cover a bank, a government agency, or any other organization you deal with directly, even if we introduced you to them.
1.4 This notice is not legal or tax advice
This page describes what we do with information. It does not tell you what the law requires of you or of your business.
We are not a law firm and we do not provide legal advice or legal representation. We are not a licensed certified public accounting firm. Reading this notice, contacting us, or buying a Service does not create an attorney-client relationship with Blugency.
Some Services are delivered by licensed professionals engaged by Blugency as contractors. Trademark and other intellectual property filings are prepared and filed by attorneys admitted to practice before the United States Patent and Trademark Office. Tax filings are prepared and signed by Certified Public Accountants, and ITIN applications are handled by an IRS Certifying Acceptance Agent. Blugency reviews their completed work for the standard of delivery, and those professionals owe you the duties their own credentials impose. Section 7 explains what they receive of your information and why. Our Legal Disclaimer sets out that position in full.
2. Definitions
We use a small number of defined terms. Where a term is capitalized in this notice, it carries the meaning below.
Personal Information means information that identifies you, relates to you, describes you, or could reasonably be linked with you or your household. Some laws call this personal data. We treat the two as the same thing.
Sensitive Personal Information means the narrower group of information that state privacy laws single out for extra protection. For us that means Social Security numbers, ITINs, driver's license and passport details, financial account numbers, log-in credentials, and citizenship or immigration status where a tax form asks for it. Several state laws, California's included, treat citizenship and immigration status as sensitive, so we treat it that way too. The law also treats health data, genetic and biometric data, racial or ethnic origin, religious or philosophical beliefs, union membership, sex life and sexual orientation, the contents of your private messages, and precise geolocation as sensitive. We do not collect any of those.
Sell means disclosing Personal Information to a third party for money or for other valuable consideration. This is the definition California law uses, and it is wider than most people expect.
Share means disclosing Personal Information to a third party for cross-context behavioral advertising, whether or not we receive anything in return. This is also a California definition, and it is the concept that catches advertising pixels and retargeting tags.
Services means the services we sell across our five service lines: Business Formation, Business Essentials, Compliance & Changes, Tax & Accounting, and Studio, as described in our Terms of Service.
Site means our marketing website at https://blugency.co.
Application means our product application at https://app.blugency.co, which this notice covers alongside the Site.
Client means a person or business that has bought a Service from us.
Visitor means anyone who uses the Site without buying a Service.
Service Provider means a company that handles Personal Information in order to do a job for us, under a contract that stops it from using that information for its own purposes.
Tax Return Information has the meaning given in 26 C.F.R. section 301.7216-1, and in plain terms means the information you give us in connection with preparing your tax return, together with the return itself and anything derived from it. Our Terms of Service and our Data Processing Addendum use the term in exactly the same sense.
Opt-Out Preference Signal means a setting sent by your browser or a browser extension that tells every website you visit not to Sell or Share your information. Global Privacy Control is the most widely used example.
3. Tax information and our GLBA Privacy Notice
3.1 We are a financial institution under federal law
Because we prepare and file tax returns, federal law treats us as a financial institution under the Gramm-Leach-Bliley Act. That is a technical label and it does not mean we are a bank. It means the information you give us in connection with tax and bookkeeping work sits under a specific federal privacy regime, and it is why you receive a separate GLBA Privacy Notice at the start of your customer relationship with us. That notice is delivered to you directly rather than published on our website, and it tells you what we do with that information, who we can share it with, and what you can limit.
3.2 Two layers, not one
This notice and the GLBA Privacy Notice work together.
The federal layer covers the information you give us as a customer of our tax and bookkeeping services. The GLBA Privacy Notice is the document that governs it.
The state privacy law layer covers everything else: Visitors to the Site, people who send us a message, people who book a meeting, prospects who never buy anything, and Clients of our formation, registered agent, trademark and design services. This notice is the document that governs that.
We want to be direct about one thing. We do not claim that being a financial institution exempts us from state privacy laws. In several states it plainly does not, and in several others the exemption covers only the specific data that federal law regulates rather than our whole company. So we apply the state privacy law standard to everything that is not covered by the federal financial privacy rules, and where we are unsure which layer applies to a particular request, we apply whichever gives you more.
3.3 Tax Return Information and section 7216
Federal tax law is stricter than everything else in this notice.
Under 26 U.S.C. section 7216 and 26 C.F.R. section 301.7216-3, we may not use or disclose Tax Return Information for any purpose other than preparing and filing your return, except where the law specifically permits it or where you have given us a separate written consent.
That consent is a standalone form. It is not this notice, it is not our Terms of Service, and it is not a checkbox at checkout. Signing one is always voluntary. Declining does not change the price of tax preparation, does not change how quickly we do it, and does not affect whether we will do it at all. If we ever ask for one, the form itself will say all of that, because federal law requires it to.
In practice this means we will not use what we learn from your tax return to sell you another Blugency service unless you have signed a consent that allows exactly that.
Federal law treats a disclosure to any return preparer located outside the United States as a separate matter, and that includes a person outside the country who can see the information remotely even when the information itself is stored here. We do not make a disclosure of that kind without first obtaining the separate written consent federal law requires for it, in the form that law prescribes.
3.4 How we deliver these notices and consents to you
We deliver our notices, consents and other required records to you electronically, by email or through the Application.
Before we ask you to agree to receive records that way, we tell you what you are agreeing to: which records it covers, the hardware and software you need in order to read and keep them, how to withdraw your agreement and what happens if you do, and how to keep the contact details we hold for you up to date. You see that consent on its own, with its own checkbox, before you create an account, rather than folded into the box you tick to accept our terms, and we keep a record of the moment you gave it. You can ask us at any time for a paper copy of anything we sent you electronically, and we will post it to the address you give us. We do not charge for a paper copy, and asking for one does not affect the Service you bought.
4. What we collect and where it comes from
We only ask for what a specific service actually needs. We aim to keep our collection limited to what is reasonably necessary and proportionate to provide the product or service you asked us for, which is the standard the strictest state law sets, and we would rather apply one honest standard everywhere than several.
4.1 The contact form
| What we collect | Do you have to give it | Why we need it |
|---|---|---|
| First name | Yes | So we know who we are replying to |
| Last name | Yes | So we know who we are replying to |
| Email address | Yes | So we can reply |
| Company name | No | Helpful context, nothing more |
| Your message | Yes | It is the reason you wrote to us |
Nothing from the contact form is stored in a database by our website. The form is delivered as an email by Resend to support@blugency.co, and from that point it lives in our support mailbox in the same way as any other email you might send us.
We do not collect a phone number on this form, and we do not ask for anything about your business beyond what you choose to put in the message.
4.2 Booking a meeting
Meetings are booked through a Cal.com scheduling widget embedded on our website. The form is Cal.com's rather than ours, and it runs inside a frame on our page.
Cal.com collects your name, your email address, and any answers you give to the booking questions it asks. Completing a booking creates a Zoom meeting and a Google Calendar event, which means Zoom and Google receive your name and email address for the purpose of setting up and holding that meeting. Section 15.2 explains the widget in more detail, including cookies.
We record these meetings. A meeting booked through our website is recorded in Zoom. We do it for two reasons and no others: to keep our own record of what was said and what was agreed, and to review the quality of our team's work. A recording is personal information about everyone in the meeting, so everything in this notice applies to it. Specifically:
- The recording is stored in Zoom, on our own Zoom account, which is why Zoom appears on our Subprocessors page.
- Access is limited to the people at Blugency who need it for the two purposes above, on the same basis as everything else in section 10.
- We do not use a recording for marketing, we do not publish it, and we do not put it into any advertising, enrichment or profiling tool. We do not give it to anyone outside Blugency except where the law requires us to.
- You can ask us for a copy of a recording of a meeting you were in, or ask us to delete it, through the process in section 11.
We keep a recording for 1 year from the date of the meeting, and then we delete it. That is the whole period. Nothing is kept longer for a general purpose, and the only reason a particular recording would outlive it is a legal hold, meaning a specific legal claim or a lawful demand that requires us to preserve it, in which case we keep only that recording and only for as long as the claim or the demand lasts.
If you would rather not be recorded, tell us before the meeting or at the start of it, and we will either hold the meeting without recording it or arrange the conversation another way, including by email.
4.3 The newsletter signup
There is a newsletter signup in the footer of our website. It is connected to an email provider. Submitting it sends you a confirmation link, and your address is not stored anywhere until you click it.
The signup runs on Resend Audiences, which is part of the Resend service that already delivers your contact form messages to us, so no new company joins the list on our Subprocessors page. It uses a confirmed opt-in, which means you enter your address, we email you a link, and nothing is sent to you until you click it. Every email carries a working unsubscribe link and our postal address, and we act on an unsubscribe request no later than 10 business days after we receive it, which is the deadline federal law sets. This notice, our Cookie Policy and our Subprocessors page are all updated before the signup is switched on rather than after.
4.4 Becoming a Client
When you buy a Service, onboarding asks for the information that Service actually requires. Some of it is the same whichever Service you buy, and the rest depends on the work.
Whichever Service you buy, onboarding asks for your full legal name, your postal address, your telephone number and your email address, and, where our customer is a company, the names, addresses and ownership details of its members, owners, officers and directors.
On top of that, each Service line adds the following.
| Service line | What we ask for |
|---|---|
| Business Formation | Home and business addresses, the details of owners, members, officers and directors, and identity documents where a state agency or a bank requires them |
| Business Essentials | Company and owner details for the EIN, ITIN, DBA, DUNS and resale certificate requests; the letters and documents received at your U.S. Business Address, which we scan to your dashboard; banking setup details |
| Compliance & Changes | The company and filing details for annual reports, amendments, agent changes, good standing, foreign qualification, apostilles and dissolution; beneficial owner details where a BOI report is required (name, date of birth, address and an identity document); EIN letters and IRS notices you upload |
| Tax & Accounting | Your Social Security number, your ITIN or your EIN, filing status, information about dependents, income and expense records, bank account details where a refund or a payment requires them, and prior returns |
| Trademark Registration | The mark you want to register, specimens of use, details of the owner and where the owner is domiciled, and the contact details of the applicant |
| Studio | Brand assets and content you send us, information about your business, and access credentials for accounts you ask us to work on |
Your Social Security number and your ITIN are Sensitive Personal Information, and we treat them as such. So are driver's license and passport details, financial account numbers, log-in credentials, and citizenship or immigration status where a tax form asks for it. We ask for any of them only where a specific Service genuinely requires it. Section 6.2 sets out the short list of things we may do with them, section 12.3 explains what that means for the California right to limit, and every right in section 11 applies to them in full, including your right to know what we hold, to have it corrected, and to ask for it to be deleted where the law does not require us to keep it. Section 10.3 tells you how to send us a document that contains one, because ordinary email is the wrong place for it.
4.5 Information we collect automatically
Server logs. Our website is hosted and delivered by Vercel. Like every web server, it records requests: your IP address, the date and time, the page or file you asked for, the page you came from, your browser and operating system, and whether the request succeeded. We use those records to serve the website, to keep it running, to investigate errors, and to detect abuse. We do not use them to build a picture of you.
Bot protection. Cloudflare Turnstile runs invisibly on our contact form and, in the application at https://app.blugency.co, on the order forms and the contact form there. It looks at signals from your browser and device to tell a person apart from a script. There is no puzzle to solve, no images to click, and nothing for you to do. Cloudflare handles those signals for us under its Turnstile Privacy Addendum, which forms part of this notice for the bot protection described here. We also use a hidden field that a real person never sees and a signed timestamp on the form. Both are there to catch automated submissions, and neither is used to identify you.
Cookies and similar technologies. Our website sets no advertising cookies and no marketing cookies. Strictly necessary cookies from Vercel and from Cloudflare Turnstile may be present, because the platforms that serve and protect the site use them to do that job. The Cal.com widget sets its own cookies and storage inside its frame, under Cal.com's own policy rather than ours. We keep the verified list of what is actually set, with lifespans, on our Cookie Policy page.
4.6 Information from other sources
We do not buy Personal Information, and we do not enrich what you give us with data bought from brokers or list vendors.
We do receive information about you from other places in the ordinary course of doing the work: from a state or federal agency in connection with a filing we make for you, from a bank or other partner where you asked us to set something up, and from a colleague at your company who gives us your details as the person to contact.
5. What we do not collect and do not track
This deserves its own section, because most privacy policies exist to describe tracking that is there, and ours has to describe tracking that is not.
Today, on https://blugency.co:
- There is no analytics tool of any kind. No Google Analytics, no product analytics, nothing that measures your behavior across pages for statistics.
- There are no advertising or marketing trackers. No Meta pixel, no advertising network tags, no retargeting, no conversion pixels.
- We set no advertising cookies and no marketing cookies. Our Cookie Policy is the document that owns this subject, and it describes the small set of strictly necessary technology that is present.
- We do not track you across other websites, and we have nothing installed that could.
- We do not collect precise geolocation.
- We do not build behavioral profiles, and we do not use your information to make automated decisions that produce legal or similarly significant effects about you.
If any of that changes, here is what we will do before it changes rather than after. We will update this notice with the name of the tool and what it collects. We will add it to our Subprocessors page. We will put a consent mechanism in place so you can accept or refuse non-essential cookies and tracking before any of it runs. And we will honor Opt-Out Preference Signals against it from the first day it is live.
6. Why we use your information
6.1 Our purposes
| Why we use it | What we use |
|---|---|
| Answering you when you write to us | Contact form details and the content of your message |
| Setting up and holding a meeting | Booking details from Cal.com, and the Zoom and Google Calendar entries a booking creates |
| Keeping our own record of a meeting, and reviewing the quality of our team's work | The Zoom recording of that meeting, as section 4.2 describes |
| Providing the Service you bought | Everything in section 4.4 relevant to that Service |
| Making a filing with an agency at your instruction | The specific details that agency's form requires |
| Taking payment | Your name, email address, billing address, the amount and the order it relates to, and the card or bank details you give Stripe, which processes payments for us |
| Keeping the records the law requires us to keep | Client files, tax records, and records of what we filed and when |
| Security, fraud prevention, and keeping the Site running | Server logs and bot protection signals |
| Improving how we work | Aggregate patterns in the questions we get and the work we do, not individual profiles |
| Establishing, exercising or defending legal claims, and complying with the law | Whatever is genuinely relevant to the claim or the obligation |
| Sending you service messages about something you bought | Your email address and the details of that Service |
| Marketing our own Services | Your email address, if you confirmed a newsletter subscription. See section 4.3 |
6.2 Sensitive Personal Information
We use Sensitive Personal Information only to perform the Service you asked for, to verify who you are, to prevent and detect security incidents and fraudulent or malicious activity, and to comply with the law. Those are the purposes California's rules permit without giving you a right to limit them, and we hold ourselves to that list nationwide.
We do not use Sensitive Personal Information to infer characteristics about you. We do not put it into any marketing tool, any advertising platform, any data enrichment service or any AI assistant. It exists in our systems to get your filing done and for no other reason.
Section 12.3 explains what that means for the California right to limit.
6.3 Legal bases, for visitors outside the United States
Some of you write to us from countries whose privacy law is built around the idea of a legal basis. Where such a law applies to something we do with your information, these are the bases we rely on.
| Basis | When we rely on it |
|---|---|
| Performance of a contract, or steps taken at your request before a contract | Answering your inquiry, arranging a meeting, and delivering a Service you bought |
| Legal obligation | Keeping tax and business records, and responding to lawful demands |
| Legitimate interests | Keeping the Site secure and available, preventing fraud and abuse, and defending legal claims |
| Consent | Anything we ask you to opt into, including our newsletter or a non-essential cookie. You can withdraw consent at any time, and withdrawing it does not affect what we did before you withdrew it |
Section 13 explains our position for people outside the United States more fully.
7. Who we share it with
7.1 The companies that help us run the Site and the Services
| Provider | What it does for us | What it handles |
|---|---|---|
| Vercel | Hosts and delivers our website | Requests to the Site, including IP addresses, in server logs |
| Cloudflare | Turnstile bot protection on the contact forms and the order forms, under its Turnstile Privacy Addendum | Browser and device signals, and IP address |
| Resend | Delivers contact form submissions to us as email | Everything you type into the contact form |
| Apple | Hosts our support@blugency.co mailbox, on iCloud with our own domain | Every message sent to or from that address, and anything attached to it |
| Sanity | Content management for our blog | The articles we publish. It does not receive contact form or booking data |
| Cal.com | The meeting booking widget on our website | Your name, your email address, and your answers to its booking questions |
| Zoom | The video meeting a booking creates, and the recording of it | Your name and email address for the meeting, the meeting itself, and the recording described in section 4.2 |
| The calendar event a booking creates | The event details, including your name and email address | |
| Stripe | Processes payments for the Services, by card and by ACH bank transfer | Your name, email address, billing address, the amount and the order it relates to, and the card or bank account details you give Stripe in order to pay |
| Anthropic PBC | The AI model behind Blu, the assistant on our website | What you write in the chat with Blu |
We engage each of these companies as a Service Provider. We have written data protection terms in place with every one of them. In each case we accepted that provider's standard data processing terms, which limit the provider to handling the information in order to do its job for us and stop it from selling the information, keeping it beyond our relationship, or combining it with information from other sources. We keep a copy of the terms we accepted for each provider.
We keep the current list, including what each provider does and where it operates, on our Subprocessors page. That page is the authoritative list and the table above is a summary of it. If we add a provider or change one, that page changes first.
The rule behind that page is worth stating on its own, because it is what makes the list meaningful: if a tool receives your Personal Information, it goes on that page. A tool that is not named there is a tool your information should not be going into.
That rule covers AI tools, and we want to answer the question directly rather than leave you to infer it. One AI provider is named on our Subprocessors page: Anthropic PBC, whose model powers Blu, the assistant on our website. It receives what you write in the chat with Blu, and nothing from your account, your orders or your documents. We do not enter your Personal Information into any other AI tool or into any other tool that is not named on that page. No Tax Return Information, no identity document, no Social Security number and no ITIN goes into a tool of that kind, at any stage of any Service. If that ever changes, the tool goes on that page and into this notice before it receives anything, not after.
7.2 Agencies and professionals involved in your work
To deliver a Service, we send information where you have asked us to send it. That includes a Secretary of State or other state agency for a formation or a filing, the IRS or a state tax authority for a return or a registration, the United States Patent and Trademark Office for a trademark application, a bank where you asked us to help open an account, and the accountants, enrolled agents or attorneys involved in your matter. That last group includes the CPAs who prepare and sign your return, the IRS Certifying Acceptance Agent who handles an ITIN application, and the attorney who prepares and files a trademark application for you.
For tax work, what we may send and to whom is governed by the federal tax rules in section 3, not only by this notice.
7.3 Legal and safety disclosures
We may disclose Personal Information where we are legally required to, including in response to a court order, a subpoena, or another valid legal demand, and where we need to in order to establish or defend legal claims, to enforce our agreements, or to protect the rights and safety of our Clients, our team or the public.
We do not hand over information simply because somebody asks. If we receive a legal demand for your information and we are allowed to tell you about it, we will.
7.4 Business transfers
If we are ever involved in a merger, an acquisition, a financing or a sale of assets, information may move with the business. If that happens, this notice continues to apply to the information until we replace it with one that is at least as protective, and we will tell you.
7.5 What we never do with it
We do not give your Personal Information to advertising networks. We have never sold, licensed or exchanged a lead or a customer list, we do not do it today, and no co-marketing list swap is planned, so we are not a data broker and we are not registered as one anywhere. We do not run credit checks on you, and we do not report your payment behavior to credit bureaus or to any other company.
8. Selling and sharing your information
We want to be precise here, because Sell and Share have specific legal meanings that are wider than the everyday ones.
We do not Sell your Personal Information. Under California law a sale means disclosing it to a third party for money or for other valuable consideration, not just for cash. We do neither.
We do not Share your Personal Information for cross-context behavioral advertising. Under California law that means disclosing it to a third party so that ads can be targeted to you on other websites and apps, whether or not anything comes back to us. We have no advertising technology on our website at all, so there is nothing to share it with.
We do not sell Sensitive Personal Information to anyone, for any consideration. Several states, including Maryland and New Jersey, prohibit that outright. We do not do it anywhere, in any state.
We do not Sell or Share the Personal Information of anyone we know to be under 16. Our Services are not for anyone under 18 at all. See section 14.
The providers listed in section 7.1 are Service Providers under contract, which is a different thing from a sale or a share.
Job applicants and partner applicants
If you apply to work with Blugency or to join our partner network, we collect the information you submit in your application: your name, email address, phone number, country, professional background, links you share such as a portfolio or LinkedIn profile, your resume if you attach one, and your answers to the application questions. We use this information to evaluate your application, communicate with you about it, and comply with legal obligations. Applications are delivered to our internal mailboxes and are never sold or shared with third parties for marketing. We retain application materials for up to twelve months after a decision, then delete them, unless you join Blugency or ask us to delete them sooner by emailing privacy@blugency.co.
9. How long we keep your information
Our rule is simple. We keep information for as long as it is reasonably necessary and proportionate to provide or maintain the specific Service you asked us for, and for as long as the law requires us to keep it. When neither applies, we delete it or put it beyond use.
| Category | How long we keep it |
|---|---|
| Contact form messages | 12 months in our support mailbox after your inquiry is closed, and then deleted |
| Booking records held by Cal.com | 12 months |
| Meeting and calendar records in Zoom and Google Calendar | 12 months |
| Zoom meeting recordings | 1 year from the date of the meeting, and then deleted |
| Newsletter signups | Your email address, kept from the moment you confirm until you unsubscribe |
| Client files for formation, registered agent, trademark and design work | For the life of the engagement, and then 7 years after it ends |
| Tax records, workpapers and identity documents | 7 years, which is the period ordinary tax record practice works to |
| Payment and billing records | 7 years |
| Server logs | For the retention period our hosting provider applies |
| Bot protection signals | For the verification period Cloudflare applies to them |
Two notes on that table. If you are a former client and you want your documents, you have 90 days from the end of your engagement to download them, and our Terms of Service set that out. And the last two rows are the ones where the period belongs to a provider rather than to us, so we are confirming each figure from that provider's own documentation rather than estimating it.
Conversations with Blu, our assistant, are stored for 90 days so we can improve its answers and follow up on requests you make, then deleted.
When we delete something, copies can survive for a short time in routine backups. Those are overwritten on their normal cycle and are not used for anything else in the meantime.
10. How we protect your information
10.1 What we do
We use administrative and technical safeguards designed to protect Personal Information against loss, misuse and unauthorized access, together with physical safeguards over the equipment and records we ourselves control. Specifically:
- Our website is served over an encrypted connection, and the provider systems we work in are reached over encrypted connections.
- Access to Client information is limited to the people who need it in order to do their work. Accounts are individual rather than shared, and access is removed when someone leaves or moves to work that does not need it.
- Accounts that can reach Client information require multi-factor authentication.
- The devices our team works on use full disk encryption, a screen lock, and operating system software that is supported and kept updated.
- Client information sits in hosted systems that encrypt data at rest.
- Where a Service needs an identity document or a tax identifier, we give you a route built for the purpose rather than asking you to email it. Section 10.3 explains.
Because we prepare and file tax returns, we are a financial institution under the Gramm-Leach-Bliley Act, and the FTC Safeguards Rule, 16 C.F.R. Part 314, applies to us. Among other things, that Rule requires a company in our position to hold a written information security program with one named individual responsible for it. What this section describes is the set of safeguards we actually apply, which is the honest way round: a control you can rely on is one that is running, not one that appears in a document.
10.2 What we do not claim
We do not hold a SOC 2 report and we are not certified to ISO 27001. If that changes, we will say so here.
We do not operate our own data centers, so we make no claims about buildings, cameras or badge access. The infrastructure underneath our website belongs to the providers named in section 7.1, and they run their own security programs.
We are not going to tell you that your data is completely secure or that it cannot be reached by anyone unauthorized, because nobody can honestly say that about any system connected to the internet. What we can tell you is what we do, what we do not do, and that we will tell you if something goes wrong.
10.3 Email and sensitive documents
Ordinary email is not a secure channel. Please do not send a Social Security number, an ITIN, a passport scan or a bank account number in a plain email, and we will not ask you to. Where a Service needs a document like that, we will give you a route to send it that is built for the purpose.
10.4 If something goes wrong
If a security incident affects your Personal Information, we will investigate it, do what we can to contain it, and notify you and the relevant regulators where the law requires it.
Several sets of rules can apply to the same incident, and they do not line up neatly.
New Mexico's breach law sets a deadline of 45 calendar days from discovery for notifying affected residents, and requires notice to the New Mexico Attorney General within that same period when more than 1,000 New Mexico residents are notified. That law exempts businesses regulated under the Gramm-Leach-Bliley Act, which may mean it does not apply to us. We treat its timetable as our own standard anyway, because we would rather hold ourselves to it than argue about whether an exemption applies while you are waiting to hear from us.
The FTC Safeguards Rule applies to us and is not affected by that exemption. It requires us to report to the Federal Trade Commission no later than 30 days after discovering unauthorized acquisition of unencrypted customer information affecting 500 or more consumers.
Other states set their own deadlines for their own residents, and those apply to us on their own terms. Where several apply at once, we work to the shortest one for the people affected.
11. Your privacy rights and how to use them
11.1 The rights
- Know and access. Ask what Personal Information we hold about you, where we got it, why we have it, and who we have given it to.
- Correct. Ask us to fix information that is wrong or incomplete.
- Delete. Ask us to delete information we hold about you.
- Portability. Ask for a copy in a structured, commonly used format that you can take elsewhere.
- Opt out of a Sale. Tell us not to sell your Personal Information.
- Opt out of Sharing and targeted advertising. Tell us not to disclose it for advertising that follows you across other sites and apps.
- Opt out of profiling. Tell us not to use automated processing to make decisions about you that produce legal or similarly significant effects.
- Limit the use of Sensitive Personal Information. Restrict what we do with the most sensitive categories. Section 12.3 explains how this works for us.
- Withdraw consent. Where we relied on your consent, take it back.
- Ask for a list of third parties. Ask which third parties we disclosed your Personal Information to. Connecticut, Minnesota and Oregon give this right specifically, and we will answer it for anyone who asks.
- Be free from retaliation. Use any of these rights without being treated worse for it.
- Appeal. If we refuse a request, ask us to think again. See section 11.6.
Not every one of these rights belongs to every person under every state law. Rather than making you work out which law covers you, we apply this list to everyone in the United States. If a particular request is one we cannot grant, we will tell you which part of it we cannot grant and why.
Some of these rights do not apply to information covered by the federal financial privacy rules described in section 3. Where that is the case, we will tell you in our response, and the GLBA Privacy Notice we gave you explains what applies instead.
11.2 How to make a request
Email privacy@blugency.co with "Privacy request" in the subject line, and tell us what you want us to do. That is the whole process. You do not need an account, there is no form to fill in, and there is no fee. If you write to support@blugency.co instead, that is fine too and we pass it across ourselves rather than sending you away to start again.
Privacy requests have one named owner inside the company, so that they do not sit in a shared inbox waiting for somebody to pick them up. We log every request we receive, with the date it arrived, what was asked for, the decision we made, and the date we answered. That log exists so that we can show what we did with your request if you ever ask, or if a regulator does.
If email does not work for you, reach us any way you can, including by post at the address in the Contact section, and we will make it work. If you need this notice or our response in an alternative accessible format, ask and we will provide one.
11.3 How we check who you are
We ask for enough to be reasonably sure the request is really from you, and no more than that.
Usually that means replying from the email address we already hold for you. For a request about Sensitive Personal Information, or to delete a Client file, we may ask you to confirm one or two pieces of information we already hold so that we can match them. We will not ask you to send an identity document just to make a privacy request unless there is no other safe way to verify you.
Anything you give us to verify a request is used only for that, and then deleted.
11.4 How long we take
We confirm that we have received your request within 10 business days, which is what California's rules require, and we answer it within 45 days of receiving it. If a request is complex, or if you have made several, we may take one further 45 days. If we need that extra time we will tell you before the first period ends, and we will tell you why.
11.5 Someone acting for you
You can use an authorized agent to make a request for you.
We may ask your agent for written permission signed by you, and we may contact you to confirm that you gave it and to verify who you are. If you have given your agent a power of attorney under sections 4121 to 4130 of the California Probate Code, we will not ask for that additional proof. We will never require you to give anyone a power of attorney in order to use an agent.
11.6 If we say no, you can appeal
If we refuse a request, we will tell you why in writing, and the same message will tell you how to appeal.
To appeal, reply to our decision or email privacy@blugency.co with "Privacy appeal" in the subject line, and tell us why you think we got it wrong. Appealing is no harder than making the original request.
An appeal does not go back to whoever decided your request. It is routed to a company officer who had no part in the original decision, and that person reviews it. That is the whole reason the route exists, and it is why an appeal is not simply a second look by the same reader.
We will decide your appeal in writing within 60 days of receiving it, and we will explain the reasons for the decision.
If we deny your appeal, you can complain to the Attorney General in your state. We will include a direct link to your state's complaint portal in the decision we send you, and you can ask us for it at any time at privacy@blugency.co.
11.7 Opt-Out Preference Signals and Global Privacy Control
Global Privacy Control is a setting in some browsers and extensions that tells every website you visit not to Sell or Share your information.
We treat an Opt-Out Preference Signal as a valid opt-out request from the browser that sends it. We honor it without asking you to identify yourself, without asking for anything extra, without charging you, and without changing anything else about how the website behaves for you.
Because we do not Sell or Share Personal Information, there is nothing for the signal to switch off on our website today. We honor it anyway, so that if we ever do something the signal is meant to stop, the protection is already working rather than being added afterwards.
Some browsers also send an older Do Not Track header. There is no agreed standard for what a website should do when it receives one, so we do not respond to it separately. We do not track you across other websites for anyone in the first place, whatever your browser sends.
11.8 No retaliation
We will not deny you a Service, charge you a different price, give you a lower quality of Service, or suggest that any of those things will happen, because you exercised a privacy right.
We do not offer discounts or other incentives in exchange for your Personal Information. If we ever do, we will describe the program and what the information is worth to us before you decide anything.
11.9 When we may have to say no, in whole or in part
Sometimes the law stops us from doing what you ask, and we would rather tell you that here than surprise you in a reply. We may refuse a request, or grant part of it and refuse the rest, where:
- the law requires us to keep the information, which is common for tax records, filings we made for you, and records of what we did and when;
- the information is covered by the federal financial privacy rules described in section 3, which give you a different set of protections rather than the ones in section 11.1;
- we still need it to finish something you asked us to do, to take a payment you owe, or to detect and deal with security incidents and fraud;
- we need it to establish, exercise or defend a legal claim; or
- we cannot reasonably verify that the request came from you, after we have given you a fair chance to help us verify it.
When any of that applies, we will tell you which part of your request we cannot grant and why, we will do the part we can, and we will tell you how to appeal under section 11.6.
12. Additional information for California residents
This section is for California residents and adds to everything above. It does not replace any of it.
12.1 Notice at Collection
California requires us to tell you, at or before the point we collect Personal Information, what we collect, why, whether we Sell or Share it, and how long we keep it. This section is that notice. Our commitment is that this page is linked from the footer of every page on our website and from every place on the site where we collect Personal Information, which is how the rule is satisfied online.
| Statutory category | What we collect in it | Why | Sold or Shared | How long we keep it |
|---|---|---|---|---|
| Identifiers | Name, email address, postal address, IP address, and where a Service requires it a Social Security number, ITIN or other government identification number | To reply to you, to provide Services, to make filings at your instruction, and for security | No | Per the criteria in section 9 for the relevant record type |
| Customer records information under Civil Code section 1798.80 | Name, address, telephone number, Social Security number, financial account details, and employment information | To provide Services and to keep required records | No | Per the criteria in section 9 for Client files and tax records |
| Protected classification characteristics | For tax work only, information such as marital status, dependents, date of birth, and citizenship or immigration status where a government form requires it. Citizenship and immigration status is also Sensitive Personal Information and we handle it as such | Because a specific tax form requires it | No | For the periods tax law requires |
| Commercial information | The Services you asked about, bought or considered, and records of what we delivered | To provide and account for the Services | No | For the life of the engagement and the periods described in section 9 |
| Biometric information | None. We do not collect it | Not applicable | No | Not applicable |
| Internet or other network activity | Server log records of requests to our website, and the browser and device signals our bot protection uses | To serve and secure the website. There is no analytics and no advertising technology on the Site | No | For the retention periods our hosting and bot protection providers apply |
| Geolocation data | Only the approximate location that can be inferred from an IP address in a server log. We do not collect precise geolocation | Security and abuse prevention | No | With the server logs |
| Audio, electronic, visual or similar information | The content of a meeting you book with us, the Zoom recording of that meeting described in section 4.2, and documents or images you send us | To hold the meeting, to keep our own record of it, to review the quality of our team's work, and to do the work you bought | No | Per section 9, and see section 4.2 for recordings |
| Professional or employment information | Your role and your company | To provide the Service | No | Per the criteria in section 9 |
| Education information | None. We do not collect it | Not applicable | No | Not applicable |
| Inferences | None. We do not build profiles or draw inferences about you | Not applicable | No | Not applicable |
| Sensitive Personal Information | Social Security number, ITIN, driver's license or passport details, financial account numbers, log-in credentials for the Application or for accounts you ask us to work on, and citizenship or immigration status where a tax form asks for it | Only the purposes in section 12.3 | No. We never Sell or Share it, in any state | Per the criteria in section 9 for tax records and Client files |
12.2 Where it comes from and who gets it
Our sources are set out in section 4: you, your browser and device, our providers, and agencies and partners involved in your work. The categories of recipient are set out in section 7: our Service Providers, the agencies and professionals involved in your matter, legal and safety recipients, and a successor in a business transfer.
12.3 Sensitive Personal Information and the right to limit
California gives you a right to limit the use and disclosure of Sensitive Personal Information where a business uses it beyond a defined set of permitted purposes.
We use Sensitive Personal Information only for those permitted purposes: to perform the Service you asked for, to verify identity, to prevent and detect security incidents and fraudulent or malicious activity, to keep our systems working, and to comply with the law. We do not use or disclose it to infer characteristics about you.
Because of that, the right to limit does not arise here, and you will not find a "Limit the Use of My Sensitive Personal Information" link on our website. If we ever want to use Sensitive Personal Information for anything outside those purposes, we will post that link and give you the right to limit before we make the change, not after.
12.4 Sale, sharing and advertising
We do not Sell or Share Personal Information, as section 8 explains, so there is no "Do Not Sell or Share My Personal Information" link on our website. If that ever changes, the link goes up before the change takes effect and we will honor Opt-Out Preference Signals against it from the start.
We do not offer any financial incentive in exchange for Personal Information, so there is no notice of financial incentive to give you.
12.5 Your California rights
You have the rights listed in section 11, and you exercise them the same way: email privacy@blugency.co with "Privacy request" in the subject line. Verification is described in section 11.3, our timelines in section 11.4, authorized agents in section 11.5, and appeals in section 11.6.
We will not discriminate against you for exercising a California privacy right.
12.6 Shine the Light
California Civil Code section 1798.83 lets residents ask a business whether it disclosed Personal Information to third parties for those third parties' own direct marketing purposes. We do not do that, and we have no such disclosures to report.
13. If you are outside the United States
We are a United States company, formed and registered in New Mexico and operating from the address in the Contact section. If you contact us, book a meeting or buy a Service from us, your information comes to the United States and is handled here. That means United States law applies to it, and in some circumstances United States authorities can require access to information held here in ways that differ from the country you are in.
Every provider named in section 7.1 processes and stores our information in the United States. Where a provider offers a choice of region, we have chosen a United States one. Our Subprocessors page names each provider, says what it does for us, and states where its processing takes place.
We have no entity, office or establishment in the European Union or the United Kingdom. We have not appointed an EU representative or a UK representative, and we are not going to imply otherwise.
We also do not go looking for customers in either place. We do not target the European Union or the United Kingdom, we do not run advertising aimed at those markets, we publish no EU or UK language pages, and our prices are in United States dollars only. Founders based anywhere are welcome to buy from us, and plenty do, but that is you coming to us rather than us marketing to you where you live.
None of that changes how we will treat you. If a law in your country gives you rights over your information, tell us what you want and we will handle your request through the process in section 11, the same way we handle everyone else's. Where a law that uses the concept of a legal basis applies to something we do, section 6.3 sets out the bases we rely on.
14. Children
Our Services are for adults who are starting or running a business. They are not directed to anyone under 18, and we do not knowingly collect Personal Information from anyone under 18. We do not knowingly collect Personal Information from a child under 13, which is the age protected by the federal Children's Online Privacy Protection Act.
If you believe a child has given us Personal Information, email support@blugency.co and we will delete it.
We do not process the Personal Information of anyone under 16 for targeted advertising, for a Sale, or for profiling. We do not do any of those things for anyone of any age.
15. Other websites and embedded content
15.1 Links to other sites
Our website links to other websites, including agency websites, provider websites, and pages we cite in blog articles. Once you follow a link, you are on someone else's website under someone else's policy. We cannot control what they do and this notice does not apply there.
15.2 The Cal.com booking widget
The booking form on our website is embedded from Cal.com and runs inside a frame on our page. It looks like part of our website, but the form itself is Cal.com's.
What you type into it goes to Cal.com. Cal.com sets its own cookies and storage inside that frame, under its own privacy notice rather than this one. We receive the booking details. Completing a booking creates a Zoom meeting and a Google Calendar event, so Zoom and Google receive your name and email address for that purpose.
If you would rather not use the widget at all, email support@blugency.co and we will arrange a time with you by email.
15.3 Our blog
Our blog is published through Sanity. Reading an article does not sign you up for anything and does not put you into any tracking tool. The only record it leaves with us is the ordinary server log entry described in section 4.5, which does not tell us who you are.
16. The Blugency application
The Application at https://app.blugency.co runs on separate infrastructure from our marketing website. It has accounts, file uploads and payments, none of which exist on the Site.
It does not have a separate privacy notice. This notice is the privacy notice for the Application as well as for the Site, and our Terms of Service, Purchasing Terms, Cookie Policy, Subprocessors page and Data Processing Addendum cover both in the same way. When you create an account you are shown these documents rather than a second set, and there is no separate policy anywhere that says something different about your information.
In practice that means the information you upload as a Client, and the payment and billing records the Application holds, are covered by section 4.4, section 6, section 7, section 9 and section 11 exactly as everything else is. Payments are processed by Stripe, which is named in section 7.1 and on our Subprocessors page, and payment and billing records are kept for 7 years.
17. Changes to this notice
We update this notice when what we do changes. When we do, we change the version number and the date at the top of the page.
If a change is significant, we will not rely on you noticing. We will say so on the website, and where we have your email address because you are a Client, we will email you.
Two commitments about timing. First, we will publish any change that introduces analytics, advertising technology or other non-essential tracking before it goes live, together with the consent mechanism described in section 5. Second, we will keep earlier versions of this notice available on request, so that you can see what applied at any point in the past.
Related pages that may change alongside this one are our Terms of Service, our Purchasing Terms, our Legal Disclaimer, our Cookie Policy, our Subprocessors page, our Data Processing Addendum and our Accessibility Statement.
Contact
Privacy questions, privacy requests, and appeals against a decision we made:
Email: privacy@blugency.co, or support@blugency.co if that is the address you already have for us. Both reach us, and we route a privacy request to the right person ourselves.
Post: Blugency LLC, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, United States
For a privacy request, put "Privacy request" in the subject line. For an appeal, put "Privacy appeal" in the subject line. If you would rather write to us, use the postal address above and tell us how you would like us to reply.