This page lists the companies that handle personal information on our behalf so that we can run our website and deliver our services. It is here so that you can see where your information goes without having to ask. It matters most if you are a business customer whose own compliance review or contract with us depends on knowing who we use.
1. What this page is
A subprocessor is a company we bring in to do part of the work, which means it handles personal information that reached us from you. Our hosting provider is a subprocessor. So is the service that delivers our contact form messages to us as email. They act on our instructions and for our purposes, not their own.
This is the live list. When it changes, this page changes, and section 7 explains how we tell you.
Where you have a Data Processing Addendum with us, that document uses the word Subprocessor in the same sense, and this page is the list it refers to. Where you do not, this page is still the plain answer to a fair question: who else touches my information.
Two things this page does not do. It does not describe what each provider does with data for its own purposes, which is set out in that provider's own privacy documentation. And it does not replace our Privacy Policy, which explains what we collect, why we use it, how long we keep it, and the rights you can use.
2. Definitions
Blugency, we, us and our mean Blugency LLC, a New Mexico limited liability company.
Site means our website at https://blugency.co.
Application means our product application at https://app.blugency.co, which our published legal set covers alongside the Site.
Services means the services we sell across our five service lines: Business Formation, Business Essentials, Compliance & Changes, Tax & Accounting, and Studio, as described in our Terms of Service.
Personal Information means information that identifies you or that can reasonably be linked to you. Our Privacy Policy defines the term in full and uses it in the same sense.
Subprocessor means a company that processes Personal Information on our behalf, on our instructions, as part of running the Site or delivering the Services.
3. The providers we use
Here is how to read the table. The first column names the company. The second says what it does for us, in plain terms. The third describes the kinds of data involved rather than every field, because the exact fields differ by what you do on the Site. The fourth describes where the processing happens.
| Provider | What it does for us | Categories of data involved | Where processing takes place |
|---|---|---|---|
| Vercel | Hosts our website and delivers it to your browser | Request data, including IP address, browser and device information, the pages requested, and the date and time | United States |
| Resend | Delivers our email: contact form messages and applications to our mailboxes, the confirmation emails we send you, and our newsletter | First name, last name, email address, phone number, country, what you write in a form and anything you attach such as a resume, and your email address if you subscribe to the newsletter | United States |
| Apple | Hosts our support@blugency.co mailbox, on iCloud with our own domain | Every message sent to or from that address, including anything attached to it, which for a client can include documents and identity information you send us | United States |
| Cal.com | Runs the embedded scheduling widget and holds the booking record | Your name, email address, answers to the booking questions, and the meeting time | United States |
| Zoom | Creates and hosts the video meeting that a booking sets up, and holds the recording of it | Your name, email address, the meeting details, anything shared during the meeting itself, and the recording | United States |
| Creates the calendar event that a booking sets up | Your name, email address, the meeting time and the event details | United States | |
| Cloudflare | Protects our contact form from automated abuse, through the Turnstile check that runs invisibly | IP address, and browser and device signals used to tell a person apart from a script | United States |
| Sanity | Manages the content of our blog | Published blog content, and the account details of our own team members who write and edit it | United States |
| Stripe | Processes payments for the Services, by card and by ACH bank transfer | Your name, email address, billing address, the amount and the order it relates to, and the card or bank account details you give Stripe in order to pay | United States |
| Anthropic PBC | The AI model behind Blu, our assistant | The text of conversations with Blu | United States |
3.1 Where processing takes place
Every provider on this page processes and stores our information in the United States. Where a provider offers a choice of region, we have chosen a United States one. Nothing on this list is set up to process your information anywhere else, and section 6 covers the separate and stricter rule that applies to tax return information.
3.2 What is not on this list, and why
No analytics or advertising provider. There is no analytics tool and there are no advertising or marketing trackers on the Site, so no provider of that kind appears here. Our Cookie Policy covers this in more detail.
No separate newsletter provider. The newsletter signup in our website footer runs on Resend Audiences, which is part of the Resend service already named in the table above, so it brings no new company into this list. It uses a confirmed opt-in, meaning you click a link in an email before we send you anything, and this page, our Privacy Policy and our Cookie Policy are all updated before the signup is switched on.
No data brokers or list vendors. We do not buy Personal Information, and we do not sell, rent, license or exchange it. We have never sold, licensed or swapped a lead or a customer list, we do not do it today, and no co-marketing list swap is planned. We are not a data broker and we are not registered as one in California, Texas, Oregon or Vermont, because nothing we do requires it. No provider on this list receives your information for its own marketing purposes. Our Privacy Policy sets out what we do and do not do with your information in full.
3.3 Our own mailbox and internal tools
The table above covers the providers that sit in the path of the Site and the Application. Behind them, your message lands in our support mailbox and our team works on your file from there.
That mailbox is support@blugency.co. It is hosted by Apple, on iCloud, using our own domain, which is why Apple is named in the table above. A company that holds our mailbox handles as much of your information as one that runs a form, and sometimes more, so it belongs on this page in exactly the same way.
The rule we hold ourselves to for everything else our team touches is short. If a tool receives your Personal Information, it belongs on this page, whatever kind of tool it is and however convenient it is to use. A tool that is not named here is a tool your information should not be going into.
That rule covers AI tools, and the answer is worth giving plainly. One AI provider is listed above: Anthropic PBC, whose model powers Blu, the assistant on our website. It receives what you write in the chat with Blu, and nothing from your account, your orders or your documents. We do not enter customer Personal Information into any other AI tool or into any other tool that is not named in the table in section 3. No tax return information, no identity document, no Social Security number and no ITIN goes into a tool of that kind. If we ever bring in another one, it is added to the table under section 7 before it receives anything.
4. Providers used by the Blugency application
The Application at https://app.blugency.co is a different system from the Site. It has accounts, file uploads and payments, which means it uses providers that the Site does not, for things like signing you in, storing your documents and taking your money.
The Application does not have its own subprocessor list somewhere else. This page is the list for both, and the providers it uses belong in the table in section 3 like every other. Stripe, which processes every payment for the Services, is named there already. The providers behind sign-in, the database, file storage and email inside the Application are being confirmed against what the Application actually runs, and they go into that table rather than into a second list.
5. How we choose and manage providers
We keep the number of providers small on purpose. Every one of them is a place your information can go, so each one has to earn its place.
We only bring in a provider where the work needs it. Hosting, email delivery, scheduling, bot protection and content management are functions we do not build ourselves.
We give each provider the least data that lets it do its job. Our contact form provider receives what you typed into the form so that it can deliver it to us as email. It does not receive anything else about you, because it does not need anything else.
We have written data protection terms in place with every provider named on this page. In each case we have accepted that provider's standard data processing terms, which limit it to acting on our instructions, stop it selling the data, stop it keeping the data beyond our relationship, and stop it combining the data with information from other sources. We keep a copy of the terms we accepted for every provider, so that we can show a business customer what is in place rather than describe it. As a financial institution under the Gramm-Leach-Bliley Act we are also required to select and oversee our service providers under the FTC Safeguards Rule, 16 C.F.R. Part 314, and that obligation applies to every provider named here.
We stay responsible. Using a provider does not move our obligations onto it. We remain answerable to you for the work we ask a provider to do, so bring the problem to us rather than chasing a company you never chose. What you can recover if something goes wrong is governed by our Purchasing Terms, our Terms of Service and, where you have one, your Data Processing Addendum. This paragraph tells you who to come to. It does not change those terms and it is not an admission of fault in any particular case.
6. Tax return information and other restricted data
Tax return information is treated more strictly than anything else we handle, because federal law requires it.
Our Terms of Service set out the rule we follow under 26 U.S.C. section 7216, and our Privacy Policy explains how it fits with everything else we do with your information. What matters on this page is the effect that rule has on the providers we use. No provider on this list is used to market to you, and none of them receives tax return information for a marketing purpose. This page does not ask for a consent under that rule and cannot serve as one.
Where a provider performs a supporting service for us and could come into contact with tax return information, the rules allow that only if the provider has first been given written notice of the penalties that federal law imposes for improper disclosure or use. That notice is part of how we bring a provider on.
Disclosure of tax return information to anyone located outside the United States requires your prior written consent, and that includes remote access by people outside the country to data that is stored inside it.
We are not a law firm and we are not a licensed certified public accounting firm, although the CPAs who prepare and sign returns, and the attorneys who file trademark and intellectual property applications, are engaged by us as contractors. This section describes rules we have to follow. It is not legal or tax advice to you, and our Legal Disclaimer sets out that position in full.
7. Changes to this list and how to object
When we add, replace or remove a provider, this page changes. We update the list, we update the date in section 8, and we note what changed.
Advance notice. Where you have a Data Processing Addendum with us, we give you at least 30 days notice before a new provider starts processing Personal Information for you, and you have 15 business days from that notice to object. Those are the same periods that document states, and they are the periods we work to.
How to be told about changes. Email us at support@blugency.co with "Subprocessor notifications" in the subject line and ask to be added to the notification list for this page. We keep that list ourselves, it is an email list and nothing more, and we use it for nothing except telling you that this page has changed. You can ask to come off it the same way.
How to object. Email support@blugency.co with "Subprocessor objection" in the subject line. Tell us which provider you are objecting to and what your concern is. We will look at whether the work can be done another way, and we will answer you. If we cannot resolve it, you can tell us you want to end the affected Service, and we will handle that under our Purchasing Terms and, where you have one, your Data Processing Addendum.
8. When this list was last reviewed
A list like this is only useful if it is current, so we review it on a schedule as well as whenever something changes. We review this page at least once every three months, and again whenever a provider is added, replaced or removed. Blugency owns that review, and the address for any question about it is support@blugency.co. The date this page was last updated is shown with the version number at the top of the page, and that date is the date of the last review.
Contact
Questions about this list, requests to be notified of changes, and objections to a provider:
Email: support@blugency.co
Post: Blugency LLC, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, United States
For a privacy request, including access, correction or deletion, follow the process in our Privacy Policy, which tells you what to include and how long we take to respond.