This policy explains what Blue Vision AI collects, why, who else sees it, and what you can do about it. The organisation responsible for your data (the “controller”) is [Company legal name], [registered address].
1. The short version
- What you type is sent to an AI company to be answered. That is what the product does. Section 3 lists which ones.
- We do not sell your data, ever.
- We do not train AI models on your conversations.
- We never see or store your card number. It goes straight from your browser to our payment provider.
- You can delete a conversation, or your whole account, yourself.
2. What we collect
| What | Examples | Why we have it |
|---|---|---|
| Account | Name, email address, password (stored hashed, never readable), the theme and accent colour you chose | To have an account at all, to sign you in, and to contact you about it |
| Conversations | The messages you send, the answers you get, folders, saved prompts, personas, files you attach | To answer you, and to let you come back to a conversation later |
| Usage and billing | Which model answered, how many tokens and credits each answer used, your plan, your invoices | To charge you correctly and show you what you spent |
| Payment | The last four digits and card type, the payment provider’s reference | To show you which card was used and to handle refunds. The full card number never reaches our systems — it goes from your browser to the payment provider |
| Technical | IP address, browser type, timestamps, error logs | Security, fraud and abuse prevention, and fixing faults |
| Support | Messages you send us and our replies | To help you, and to know what we have already told you |
Please do not put other people’s personal information, or your own sensitive information, into a message unless you need to. Anything you type is sent to an AI provider to be answered. That includes health details, financial details and anything confidential to an employer or client.
3. Who else sees it
We use other companies to run the Service. Each one gets only what it needs, and only to do the job we use it for.
| Who | What they get | What for |
|---|---|---|
| AI providers — Anthropic, OpenAI, Google, DeepSeek | The message you sent, the earlier messages in that conversation, and any persona or instructions applied to it | To produce the answer. Each is bound by its own terms; we do not permit training on your content. [Re-confirm per provider before launch] |
| Web search provider — [Brave Search, if enabled] | Your search terms only, and only when you turn web search on for a message | To find current information for that answer |
| Payment provider — [name] | Your card details (directly from your browser), your name, your email and the amount | To take payment. They are the ones holding the card, not us |
| Email provider — [name] | Your email address and the message being sent | Sign-in, receipts, and notifications you have not turned off |
| Hosting — [name and region] | Everything, at rest, encrypted | Running the servers and the database |
We may also disclose information if the law requires it, or to protect our rights, our users or the public. If the business is sold, data may transfer with it — you will be told.
We do not sell your data and we do not share it for advertising.
4. Where it goes
The AI providers and the other companies above operate outside [your country / the EEA / the UK], so your data is transferred internationally. Where that requires safeguards, we rely on [standard contractual clauses / adequacy decisions — confirm per supplier].
5. How long we keep it
- Conversations: until you delete them, or until your plan’s history limit is reached — older conversations are deleted automatically after that. The limit is shown on the pricing page.
- Your account: until you close it. When you close it, your conversations and personal details are deleted within [30 days].
- Invoices and payment records: for as long as tax and accounting law requires — typically [6/7 years]. These stay even after an account is closed, because we are required to keep them.
- Technical logs: [90 days].
Deleting a conversation deletes it here. It does not delete anything an AI provider kept under its own retention rules, which are outside our control.
6. Why we are allowed to (lawful bases)
- To perform our contract with you — running the Service, answering your messages, billing you.
- Our legitimate interests — keeping the Service secure, preventing abuse and fraud, and improving it. We do this in ways that do not override your rights.
- Legal obligation — tax records, and responding to lawful requests.
- Your consent — for optional emails, and for anything else we ask you about. You can withdraw it at any time.
7. Your rights
Depending on where you live, you can ask us to: give you a copy of your data; correct it; delete it; restrict or object to how we use it; or send it to another provider. You can also complain to your data protection regulator ([name the regulator for the operating jurisdiction]).
Much of this you can do yourself and immediately: delete a conversation from the conversation list, export one as PDF or Markdown, and close your account from your account pages. For anything else, email [privacy@ email address] and we will reply within [30 days].
8. Cookies
We use cookies that are necessary for the Service to work: keeping you signed in, protecting forms against cross-site request forgery, and remembering your theme and panel layout. We do not use advertising or third-party tracking cookies. [If any analytics tool is added later, it must be listed here and a consent banner added.]
9. Security
Traffic is encrypted in transit. Passwords are stored hashed and are not readable by us or by anyone with access to the database. Secrets held by the platform — provider API keys, mail passwords — are encrypted at rest and never written to logs. Access to production data is limited to staff who need it.
No system is perfectly secure. If a breach affects you and the law requires it, we will tell you and the regulator within the required time.
10. Children
The Service is not for children under [16 / 18]. We do not knowingly collect their data. If you believe a child has an account, contact us and we will delete it.
11. Changes
If we change this policy the date at the top changes. If a change materially affects you we will tell you by email or in the product before it takes effect.
12. Contact
[Company legal name]
[Registered address]
[privacy@ email address]
[Data protection officer or EU/UK representative, if one is
required]
See also the Terms of Service.