Blurry Privacy Policy

1. PERSONAL INFORMATION WE COLLECT

   1. Information you provide. This includes:
      • Account and Organization information: to create an account, we collect your email address and name. We also collect authentication credentials necessary to secure your account. Other information, such as Organization membership and role, invitations, and sharing or access permissions, is generated or assigned through your use of the Service or by an Organization administrator rather than collected directly from you at registration.
      • Billing information: payment and billing details, which are collected and processed by our payment processor. We do not store full card numbers.
      • Customer Content and Output: files and data you upload, typically scans, imagery, and models of physical spaces and objects, and the Output generated from that material. To the extent Customer Content or Output contains personal information, our handling of it is explained in Section 5.
      • Communications and support: information you provide when you contact us, request support or a demonstration, participate in a consultation, or provide feedback.
   2. Information collected automatically. When you use the Service, we and our analytics providers automatically collect:
      • Usage and log data: such as pages and features viewed, actions taken, API, embed, and shared-link activity, timestamps, and diagnostic, security, and performance data.
      • Device and connection data: such as IP address, browser type, device identifiers, and general settings.
      • Approximate location: we may infer general location from IP address.
      • Cookies and similar technologies: as described in Section 2.
   3. Information from other sources. We may receive personal information from Organization administrators or members who invite you to or manage a workspace and from integrations or services you choose to connect.
   4. Sensitive information. We do not knowingly collect sensitive personal information or special-category data as defined under applicable U.S. state privacy laws or the GDPR.

2. COOKIES, ANALYTICS, AND TRACKING TECHNOLOGIES

   1. Cookies. We use cookies and similar technologies that are necessary to operate and secure the Service (for example, to keep you signed in) and, where permitted or with consent where required by applicable law, to measure and improve the Service.
   2. Analytics. We use PostHog for in-application product analytics, which may include session and interaction recording used for troubleshooting, security, and product improvement, and Google Analytics to understand website traffic. Depending on the feature and configuration, these tools may process device, usage, interaction, and other information displayed or entered in the Service. These providers process information subject to contractual and legal restrictions applicable to their services.
   3. Your choices. You can manage cookies through your browser or device settings and through any preference controls we make available. We do not use personal information for cross-context behavioral advertising, and we do not sell personal information.
   4. Do Not Track and Global Privacy Control. Where required by applicable law, we honor browser-based opt-out preference signals, including the Global Privacy Control (GPC). Because we do not sell personal information or share it for cross-context behavioral advertising, a recognized opt-out signal will be acknowledged but will not change your experience of the Service.

3. HOW WE USE PERSONAL INFORMATION

   1. Purposes. We use personal information to: (a) provide, operate, maintain, and personalize the Service; (b) create and manage accounts, Organizations, invitations, permissions, shared links, and other collaboration features; (c) authenticate users, prevent fraud or abuse, and secure the Service; (d) process payments and manage billing; (e) provide support and respond to inquiries; (f) troubleshoot, analyze, and improve the Service; (g) send service and administrative communications and, where permitted, marketing communications; (h) comply with applicable law, establish or defend legal claims, and enforce our terms; (i) support a corporate transaction; and (j) create aggregated or de-identified data. You may opt out of marketing emails using the unsubscribe link or by contacting us; we may retain limited suppression-list information and continue to send non-marketing service messages.
   2. Automated processing and service improvement. Blurry does not use personal information in Customer Content or Output to train its own general-purpose AI models. If a customer enables an optional third-party processing feature, personal information in the submitted content or resulting output may be processed to provide that feature and, where permitted by the applicable agreement and law, to operate or improve the provider's technology. Rights relating to non-personal Customer Content and Output are governed by the Terms of Service.
   3. No automated decisions. We do not make decisions producing legal or similarly significant effects about individuals based solely on automated processing.

4. HOW WE SHARE PERSONAL INFORMATION

   1. Vendors and processing partners. We disclose personal information to vendors that help us operate, secure, support, and improve the Service. Depending on the context, a recipient may act as our processor, as a subprocessor for Customer Content or Output, or as an independent controller (e.g., payment processing). Key categories include hosting (AWS, Vercel), payments (Stripe), email delivery (Resend), analytics (PostHog, Google Analytics), security, and optional three-dimensional processing providers that receive Customer Content only when the customer enables the applicable feature. Additional subprocessor information is available on request.
   2. Within Organizations. If you use the Service through an Organization, your account information, activity, Customer Content, and Output may be accessible to that Organization's administrators and other authorized members according to their roles, permissions, workspaces, and Scenes. An Organization may manage your account or access to its content.
   3. Sharing you direct. When you share content by link, invitation, embed, integration, or API, the information you choose to share, including any personal information in Customer Content or Output, is disclosed according to the access settings you select. Blurry may process related viewer, device, and access-log information to deliver and secure the shared content. Recipients may further use or disclose shared information outside Blurry's control.
   4. Legal and safety. We may disclose personal information where we reasonably believe disclosure is necessary to comply with applicable law or lawful process, enforce our terms, investigate or prevent fraud or abuse, or protect the rights, property, safety, and security of Blurry, our users, or others.
   5. Business transfers. We may disclose or transfer personal information in connection with an actual or proposed merger, acquisition, financing, reorganization, bankruptcy, or sale of assets. Where a successor's privacy practices materially differ from this Privacy Policy, we will provide notice to affected individuals.
   6. No sale or targeted advertising. We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under U.S. state privacy laws.

5. PERSONAL INFORMATION IN UPLOADED CONTENT AND OUTPUT

   The Service is designed for scanning, modeling, and visualizing physical spaces and objects. Customer Content and Output are not intended to contain personal information, and any personal information captured incidentally (e.g., an individual in the background of a scan) is generally ancillary and would not typically render the individual identifiable without additional information. To the extent Customer Content or Output does contain personal information of identifiable individuals, the customer is responsible for determining the lawful basis for that processing and for providing any required notices or permissions. Blurry processes such information on the customer's behalf in accordance with the applicable agreement and DPA.

6. DATA RETENTION

   We retain personal information only as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce agreements. Account and Organization information is retained while the relationship remains active and for a reasonable period afterward. Transaction records are retained as required for tax, accounting, and compliance purposes. Support records, logs, and analytics are retained for periods necessary for support, security, and improvement. Marketing contact information is retained until you opt out, with limited suppression data kept honoring your choice. Customer Content and Output are generally deleted from active systems within thirty (30) days after the customer instructs deletion or closes the account, subject to legal holds and routine backup cycles.

7. DATA SECURITY

   1. Safeguards. We maintain administrative, technical, and organizational measures designed to protect personal information. Data is hosted primarily in the United States with AWS and may be cached globally through Amazon CloudFront. No method of transmission or storage is completely secure.
   2. Incident notice. If we become aware of a personal-data breach, we will provide notices to affected customers, individuals, or authorities to the extent and within the time required by applicable law and, where relevant, our contractual commitments.

8. CHILDREN'S PRIVACY

   The Service is not directed to children and is intended for users who are at least eighteen (18) years old. We do not knowingly permit children to create accounts. Customer Content or Output is not intended to contain personal information about children; to the extent a customer submits such information, the customer is responsible for any required consent or other lawful basis. If you believe a child has created an account or that personal information about a child has been submitted unlawfully, please contact us and we will take appropriate steps.

9. INTERNATIONAL DATA TRANSFERS AND DATA RESIDENCY

   1. Location of processing. Content is stored primarily in the United States and may be cached globally via content-delivery infrastructure. Country-specific data residency is available only under a custom Enterprise arrangement.
   2. Cross-border transfers. If you access the Service from outside the United States, your personal information may be transferred to and processed in the United States and other countries where we or our providers operate. Where applicable law requires a transfer mechanism, we use recognized safeguards that may include the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful mechanism.

10. THIRD-PARTY LINKS AND SERVICES

    The Service may link to or interoperate with third-party sites and services that we do not control. Their privacy practices are governed by their own policies, and we are not responsible for them.

11. US STATE PRIVACY RIGHTS

    1. Your rights. Depending on where you reside and subject to applicable exceptions, you may have the right to request access to, correction or deletion of, or a portable copy of personal information, and to opt out of certain sales, sharing, targeted advertising, or profiling. Where Blurry processes Customer Content or Output on behalf of a customer, we may direct your request to that customer.
    2. California disclosures. The categories of personal information we collect, the sources, business or commercial purposes, and categories of recipients are described in this Privacy Policy. In the preceding twelve (12) months, depending on how an individual interacted with the Service, we may have collected identifiers; customer records and commercial information; internet or other electronic network activity; and approximate geolocation. We disclose these categories for the purposes described in Section 3 to the corresponding categories of recipients described in Section 4. The retention criteria in Section 6 apply to these categories.
    3. How to exercise rights. You may submit a request by contacting us at hello@useblurry.com. We may take reasonable steps to verify your identity and authority, and we will respond within the period required by applicable law. You may use an authorized agent where permitted. We will not discriminate against you for exercising an applicable privacy right. If applicable law provides a right to appeal a denial, you may appeal by replying to our response.

12. EU, UK, AND SWISS PRIVACY RIGHTS

    1. Controller and representative. For personal information Blurry handles as a controller, Blurry, Inc. is the controller. Blurry Ltd, a wholly owned subsidiary of Blurry, Inc., is Blurry's representative in the European Economic Area, the United Kingdom, and Switzerland and may be contacted at hello@useblurry.com.
    2. Legal bases. Depending on the processing, we rely on: (a) performance of a contract, including to provide the Service; (b) our legitimate interests, including operating, securing, and improving the Service, preventing misuse, and supporting corporate transactions, balanced against individuals' rights; (c) consent, where required (e.g., non-essential cookies or certain marketing), which may be withdrawn at any time; and (d) compliance with legal obligations or the establishment, exercise, or defense of legal claims.
    3. Your GDPR rights. Subject to conditions, you have the right to access, rectify, and erase your personal information, to restrict or object to processing, to data portability, and to withdraw consent. You also have the right to lodge a complaint with your supervisory authority.
    4. International transfers. See Section 9.2.
    5. Content controlled by customers. Where personal information appears in Customer Content or Output, the customer is responsible for that content, and you should direct any data-subject requests to that customer.

13. CHANGES TO THIS POLICY

    We may update this Policy from time to time. We will update the “Last updated” date above and, where required by applicable law, provide additional notice of material changes. If we intend to use personal information for a materially different purpose, we will provide any notice or obtain any consent required by applicable law.

14. HOW TO CONTACT US

    1. Contact. If you have questions about this Policy or our privacy practices, contact us at hello@useblurry.com.
    2. Accessibility. This Privacy Policy is available in an alternative or accessible format upon request. Please contact us at hello@useblurry.com.