Bluu Privacy Policy

Last updated: November 13, 2026

This Privacy Policy explains how LA Media Group LLC ("LA Media Group", "we", "us" or "our"), of 3134 Peachtree Cir, Davie, FL 33328, collects, uses, shares and protects personal information in connection with Bluu. It covers:

• our websites, usebluu.com and bluucrm.com (which forwards to usebluu.com), including the chat on them and our book-a-call page;
• the Bluu dashboard at bluu.lamediagrp.com, with its apps, add-ons and tools; and
• the emails and other messages we send you.

Words such as "Customer Data" and "Team Members" have the meanings given in our Terms of Service.

1. The two roles we play

When we decide how information is used. For information about visitors to our websites, people who chat with us or book a call, and the businesses and Team Members who sign up for Bluu, we decide how the information is used. This policy explains how.

When we hold information for a business. Businesses that use Bluu ("our customers") put information about their own customers into it: contacts, messages, chats, bookings, form answers, reviews, payment details and more. We process that information on their behalf and following their instructions, under our Data Processing Addendum. The business decides what happens to it, and the business's own privacy policy applies. If a business that uses Bluu holds information about you, see Section 13.

2. Information we collect

Information you give us

• Signup and account: your name, business name, email address, phone number, password, billing address and business details such as your address, hours, services and website, plus the names and email addresses of Team Members you invite.
• Payment: Stripe, our payment processor, collects your card details. We receive only limited information from Stripe, such as the card brand, last four digits, expiry date, billing ZIP code, payment status and a fingerprint Stripe creates so the same card can be recognized again. We never see or store your full card number.
• Chat on our websites: your name, an email address or phone number (the chat asks for these before it starts) and everything you write.
• Booking a call: your name, email address, phone number, business details, your answers to any questions and the time you choose.
• Support and correspondence: what you send us by email or through the dashboard, and any files you attach.
• Feedback and surveys: your answers, if you choose to give them.

Information collected automatically

• Device and usage information: IP address, browser and device type, operating system, pages viewed, links clicked, time spent, the website that referred you, and approximate location (city or region) worked out from your IP address.
• Advertising and campaign information: the ad or campaign that brought you to our site, such as campaign tags in the link and the click identifiers that Meta and Google add to their ads.
• Cookies, pixels and similar technologies: see Section 6 and our Cookie Policy.
• Dashboard activity: sign-ins, features used, settings changed, errors and security logs.

Information from other sources

• Stripe: payment status and fraud screening results.
• Meta and Google: reports about how our ads perform, which are mostly aggregated.
• Accounts you connect to Bluu: see Sections 8 and 9.
• Your public website: when you ask Bluu to read your website, we collect the business information published on it, such as your services, hours, contact details and summaries of your pages, to fill in your Business Profile and inform your AI chat.

3. How we use information

We use personal information to:

• provide Bluu: create and run your account, take payments, provide the features you use, connect the accounts you link and send you account emails;
• answer you: through the chat on our websites (including its AI assistant), by email and on calls you book;
• run free trials and offers, including our rule of one trial per business and per card;
• keep Bluu safe: prevent fraud, spam and messaging abuse that could harm our customers, carriers or email providers, and protect our systems;
• improve Bluu: understand how it's used, fix problems and build new features;
• market Bluu: send you emails about Bluu (you can opt out at any time), and measure and improve our advertising, including showing our ads to people who have visited our websites (Section 6);
• meet legal duties: comply with the law, enforce our terms and protect our rights and the rights of others; and
• do anything else you ask or agree to.

We don't make decisions that have legal or similarly significant effects on you based solely on automated processing.

4. The chat on our websites, and AI

• The chat on usebluu.com is answered by an AI assistant, and our team may also read conversations and reply.
• Your conversation is recorded and stored, and your messages are sent to our AI provider so it can write replies. The AI provider processes them for us and is not allowed to use them to train its models.
• The details you give in the chat, and the conversation itself, become a lead in our own Bluu account so our team can follow up.
• The AI can make mistakes. Its answers are not professional advice and are not a binding offer. Our pricing page and our Terms of Service decide the prices and terms that apply.
• Please don't share sensitive information in the chat, such as health details, card numbers or passwords.
• When you open the chat or start a conversation, the chat tells our analytics and advertising tools that it happened. It doesn't tell them anything you wrote.

5. How we share information

We don't sell personal information for money. We share it only as follows.

• Service providers that work for us under contract and may use the information only to provide their services to us. By category, these are: hosting providers; database and file storage providers; email delivery providers; SMS and phone providers; AI providers; our payment processor (Stripe); analytics providers; scheduling and customer support tools; security and fraud prevention providers; and publishing providers that help us post your content and business information to the platforms and directories you choose.
• Advertising partners, Meta and Google, through the pixels and tags on our websites, and through Meta's Conversions API. When you start a free trial or make a payment, our server tells Meta that the event happened, with a protected (hashed) version of your email address, your IP address, your browser details and the ad click identifier, so Meta can measure and improve our ads. We never send your phone number to advertising partners. Under some state laws this counts as "selling" or "sharing" personal information, or as "targeted advertising". Section 14 explains how to opt out.
• Platforms you connect. When you connect Google, Meta, Stripe or another account, we exchange information with that platform as needed for the feature you switched on, for example to post a review reply you wrote or create a calendar event.
• Your own team. Team Members see the information in your account according to the roles you give them.
• Professional advisers, such as lawyers, accountants and auditors, who must keep it confidential.
• Legal and safety reasons: to comply with the law, a subpoena or a court order; to protect the rights, safety and property of our customers, the public or us; to investigate fraud or abuse; and to work with carriers and platforms to stop messaging abuse.
• Business transfers: if we are involved in a merger, acquisition, financing, sale of assets or bankruptcy, information may transfer to the new owner, who must protect it as this policy describes.
• With your consent or at your direction.

Mobile information. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All of the categories of sharing above exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

6. Cookies, analytics and advertising

We use cookies and similar technologies on our websites and in the dashboard:

• strictly necessary ones that keep you signed in, protect against fraud and remember your privacy choices;
• functional ones, such as the browser storage the chat uses to remember your conversation;
• analytics, through Google Analytics, to understand how our websites are used; and
• advertising, through the Meta Pixel and Google Ads tags, to measure our ads and show them to people who have visited our websites.

Our Cookie Policy lists them and explains your choices. You can turn off analytics and advertising cookies with the Your Privacy Choices link at the bottom of every page on usebluu.com.

Global Privacy Control. We honor the Global Privacy Control ("GPC") signal as a request to opt out of the sale or sharing of your personal information and of targeted advertising, for the browser that sends it. When we detect it, we don't load the Meta or Google advertising tags for you, and we don't send Conversions API events about you.

Do Not Track. There is no agreed standard for "Do Not Track" browser signals, so we don't respond to them. We do honor GPC.

7. Information businesses put into Bluu

When a business uses Bluu, we hold the information it puts in on its behalf and follow its instructions, under our Data Processing Addendum.

• We don't sell this information, we don't use it to market to the people in it, we don't use it for our own advertising, and we don't use it to train AI models.
• Our service providers process it for us, by the categories listed in Section 5.
• When a business uses AI chat or other AI tools, the information needed to answer is sent to our AI provider to produce the response.
• Email marketing and texts. A business that sends marketing email or texts through Bluu decides who hears from it and is responsible for having their agreement. We hold the records for that business, including the address or number, what the person agreed to and where and when they agreed, and whether an email was delivered, opened or clicked. We keep those records of agreement for at least five years, even after the business leaves Bluu, because the business may need to prove that it had consent. Somebody who unsubscribes stops getting that business's marketing emails straight away, and we keep their address on a do-not-send list so they are not emailed again. Somebody who replies STOP to a business's texts stops getting texts from that business.
• Payments. When a business takes payments through its own connected Stripe account, Stripe processes the payment. We receive payment details such as the amount, the status and the payer's name and email address.

8. Google user data

This section explains how Bluu accesses, uses, shares, protects, keeps and deletes information it receives from Google when you connect a Google account.

What we access

If you connect a Google account, we request only these permissions, each for a specific feature:

• openid and https://www.googleapis.com/auth/userinfo.email: to identify which Google account is connected and show you its address in the dashboard, so you can tell which account is linked before you rely on it.
• https://www.googleapis.com/auth/calendar.events: to create calendar events, with Google Meet links where needed, for appointments booked through Bluu, and to update or remove those same events if the appointment changes. We only work with the events Bluu creates. We do not read, list or import the events already in your calendar, and we never see your existing schedule.
• https://www.googleapis.com/auth/business.manage: to list the Google Business Profile locations you manage so you can choose one, read the reviews left on it, and post a reply you have written in the dashboard. We never create, edit or delete a location.
• https://www.googleapis.com/auth/analytics.readonly: to display your own Google Analytics (GA4) traffic inside your dashboard. It is read only, it is the narrowest Analytics permission Google offers, and we never change your Analytics configuration.
• https://www.googleapis.com/auth/adwords: to display your own Google Ads results, such as spend, clicks and conversions, inside your dashboard. We use it for reporting only. We never create, change, pause or remove campaigns, ads, budgets or settings.

How we use it

Google data is used only to provide the feature you connected it for: putting a booked appointment on your calendar, showing and replying to your reviews, and displaying your own website traffic and ad results. We do not use it for advertising, for lending decisions, for profiling, or for any purpose other than these user-facing features.

What we share, and with whom

We do not sell, rent or transfer Google user data to third parties, data brokers or advertisers. The only parties that process it are our own infrastructure providers, acting on our instructions under contract, solely to run Bluu: our hosting provider and our database and file storage provider. A reply you choose to publish is sent back to Google to appear on your own listing.

Artificial intelligence and machine learning

No data received from Google APIs is used with, or transferred to, any artificial intelligence or machine learning system. We do not use it to develop, improve or train any AI or machine learning model, our own or anyone else's, and we do not pass it to a third-party AI service. Bluu does include AI features, and they work only on information created inside Bluu or taken from your own public website: your business profile, your services, your locations and summaries of your website's pages. Replies to reviews are written by you or filled from a template you wrote. They are not generated from Google data by a model.

How we protect it

OAuth tokens are stored on our servers in a place no browser can read, and all traffic is encrypted in transit. Access is controlled per user and per business, and each business's data is kept separate from every other business's at the database row level.

How long we keep it, and how to delete it

We keep Google data only while the connection is active. Disconnecting removes our access and deletes the stored tokens and the review data we pulled from that listing. Calendar events we created stay in your calendar, because they belong to you. You can disconnect at any time in Bluu under Settings > Connectors, or in the app's own settings: Appointments > Settings (Calendar), Reviews > Settings (Business Profile) or Analytics > Sources (Analytics and Ads). You can also revoke our access directly at myaccount.google.com/permissions, or ask us to delete everything as Section 12 explains. Deletion requests are actioned within 30 days.

Limited Use

Bluu's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

9. Meta (Facebook and Instagram) data

If you connect a Facebook Page or Instagram account, we request only the permissions the features you switch on need:

• Choosing your Page: pages_show_list, and business_management to list the Pages you manage through a Meta business portfolio.
• Reviews and recommendations: pages_read_engagement and pages_read_user_content, to read your Page's reviews and recommendations, and pages_manage_engagement, so that a reply you write in Bluu is posted to your Page.
• Lead Ads: leads_retrieval, to receive the leads people submit through your Lead Ads forms, and pages_manage_metadata, so your Page sends them to Bluu as they arrive. Meta also requires you to give Bluu access in Lead Access Manager on your Page.
• Ad results: ads_read, to show your Facebook and Instagram ad results in Bluu's Analytics. It is read only. We never create, change or pause ads, and we never spend money from your ad account.
• Posting: when you connect Facebook or Instagram to publish posts, the connection is made through our social media publishing provider and is used only to publish the posts you create or schedule and to show their results and comments in Bluu.

We store the resulting access tokens securely on our servers and use them only to perform these actions on your behalf.

We read only what those features need: your Page's reviews and recommendations, with the reviewer's public name and picture as shown on the review; the leads submitted through your forms; your ad results; and the names of your Pages. We do not access your personal Facebook profile beyond the name and ID of the person who connects, your friends or your personal messages. We do not use Meta data for advertising, we do not sell it, we share it only with the providers that run Bluu for us or as you direct, and we do not use it to train AI or machine learning models.

You can disconnect at any time in Bluu under Settings > Connectors, or in the app's own settings, for example Reviews > Settings > Disconnect. That removes our access and deletes the review data we pulled from that Page. You can also remove our access from Facebook Settings > Business Integrations. Disconnecting changes nothing on Facebook itself: your Page and its reviews stay exactly as they are, because they belong to you and to the people who wrote them. Leads already delivered to Bluu stay in your contacts until you delete them. Section 12 explains how to ask us to delete everything.

10. How long we keep information

Information	How long we keep it
Your account, profile and team information	While your account is open. After it ends, 30 days so you can restart, then deleted within the following 30 days
Information businesses put into Bluu (Customer Data)	While the account is open. After it ends, 30 days, then deleted within the following 30 days, or sooner on request
Records of consent and unsubscribes for messages sent through Bluu	At least 5 years after the record is made, even if the business leaves Bluu
Billing and payment records	7 years after the transaction
Records needed for our one-trial rule (business name, email address and the card fingerprint from Stripe)	Up to 3 years after the account ends
Chats on our websites, booked calls and other sales conversations with people who don't become customers	Up to 3 years after our last contact
Support emails and other correspondence	Up to 3 years after our last contact
Security and server logs	Up to 12 months
Google Analytics data	Up to 14 months
Google and Meta data from connected accounts	While the connection is active, as Sections 8 and 9 explain
Cookies	As listed in our Cookie Policy
Backups	Deleted information may remain in our encrypted backups for up to 7 days
Files you upload	Deleted immediately and permanently when deleted, with no backup copy

We may keep information longer where the law requires it, or where we reasonably need it to resolve a dispute, enforce our agreements or prevent fraud.

11. How we protect information

We use measures designed to protect personal information, including:

• encryption of all traffic in transit, and encryption of stored data by our database provider;
• separation of each business's data from every other business's at the database row level;
• access tokens for connected accounts stored on our servers, where no browser can read them;
• card payments handled entirely by Stripe, so card numbers never reach our systems;
• encrypted daily backups;
• access to production systems limited to the few people who need it; and
• regular security testing.

No system is perfectly secure, and we can't guarantee that information will never be accessed without permission. If a security incident affects your personal information, we will tell you as the law requires.

12. Your choices, and deleting your data

Your account. You can see and update your account information in the dashboard, and you can disconnect any connected account at any time under Settings > Connectors.

Marketing emails. Every marketing email we send has an unsubscribe link. Account emails, such as receipts and security alerts, continue while your account is open.

Cookies and advertising. Use the Your Privacy Choices link on usebluu.com, turn on Global Privacy Control in your browser, or use the other choices in our Cookie Policy.

Deleting your data. You can ask us to delete your data at any time, and we will.

• How to ask: email info@lamediagrp.com from the email address on your account, with the subject Data deletion request. Tell us the name of your business and whether you want everything deleted (your whole account and all of its content) or only a connected account disconnected, such as the data we hold from your Facebook Page or Google Business Profile, leaving the rest of your dashboard as it is.
• We confirm first: we confirm every request in writing before acting on it, so nothing is deleted by mistake.
• When: we action requests within 30 days, and normally within a few business days. We email you when it's done.
• Do it yourself: you can disconnect a connected account straight away, without contacting anyone, under Settings > Connectors or in the app's own settings. That removes our access and the data we pulled from it.
• What we keep: a minimal billing and transaction record where the law requires it, which contains no marketing content, no customer lists and nothing from any connected Facebook or Google account; and, if your business sent marketing emails or texts through Bluu, the records of who agreed to or unsubscribed from them, for at least five years, because they are the evidence of consent and they stop people who unsubscribed from being contacted again.
• Backups: our database is backed up once a day, and backups are kept for about a week, encrypted. A copy of deleted information may remain in a backup for up to 7 days before it is gone for good.
• Uploaded files: files you upload are deleted immediately and permanently. They aren't part of the database backup, so once deleted there is no copy to recover.

These instructions also appear on our dashboard's Deleting your data page.

13. If a business that uses Bluu holds your information

If you're not a Bluu customer yourself but a business that uses Bluu holds your details, for example because you booked an appointment, filled in a form, left a review, sent a chat message or received a text or email from them, that business decides what happens to your information, and we hold it on its behalf.

Contact that business directly to see, correct or delete your information, or to stop its messages. You can always reply STOP to a text or use the unsubscribe link in an email. If you can't reach the business, email info@lamediagrp.com and we will pass your request on and follow up until it is dealt with.

14. Your US state privacy rights

Residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island, and of other states with similar laws, have rights over their personal information. Which rights you have depends on where you live, and some state laws cover only information about you as an individual consumer, not as a business contact. To keep things simple, we honor the requests below from residents of every US state where we reasonably can.

Your rights

• Know and access: ask what personal information we hold about you, how we got it, why we use it and who we share it with, and get a copy, including in a portable format.
• Correct: ask us to correct inaccurate information.
• Delete: ask us to delete your information, subject to the exceptions the law allows, such as records we must keep.
• Opt out of selling, sharing and targeted advertising: ask us to stop using your information for targeted advertising and to stop disclosing it to advertising partners in ways the law treats as a sale or sharing.
• Opt out of profiling: we don't use personal information for profiling that leads to decisions with legal or similarly significant effects.
• Limit sensitive information: the only sensitive personal information we collect is your account sign-in details, which we use only to let you sign in and keep your account secure. We don't use sensitive personal information to infer anything about you.
• List of recipients: where your state gives you the right, ask for a list of the third parties, or categories of third parties, we have disclosed your personal information to.
• Equal treatment: we won't treat you differently for using any of these rights.
• Appeal: ask us to reconsider if we decline your request.

How to use your rights

• Email info@lamediagrp.com with the subject Privacy request, saying which right you want to use and which state you live in.
• To opt out of selling, sharing or targeted advertising, use the Your Privacy Choices link at the bottom of every page on usebluu.com, turn on Global Privacy Control in your browser, or email us.
• Verification: we check your identity by matching what you tell us with the information we hold. If you have an account, please write from the email address on it. We may ask for more information where we need it to protect you. You don't need to verify an opt-out.
• Authorized agents: someone you authorize may make a request for you. We may ask for your signed permission and may confirm the request directly with you.
• Timing: we confirm we've received a request within 10 business days and respond within 45 days. If we need more time, we will tell you and may take up to 45 more days. We act on opt-outs as soon as we can, and within 15 business days.
• Cost: requests are free. We may decline requests that are clearly unfounded or excessive, and we will tell you why.
• Appeals: if we decline your request, email info@lamediagrp.com with the subject Privacy appeal. We will respond in writing within 45 days. If we deny your appeal, our response will explain how to contact your state's attorney general.

If your request is about information a business holds in Bluu, see Section 13. We will pass it to that business.

More for California residents

Notice at collection. In the past 12 months we have collected the following categories of personal information. We collect it from the sources in Section 2, use it for the purposes in Section 3 and keep it for the periods in Section 10.

Category	Examples	Disclosed for business purposes to	Sold or shared with
Identifiers	Name, email address, phone number, postal address, IP address, online identifiers	Service providers; Stripe	Meta and Google: online identifiers, IP address and hashed email address
Customer records	Name, address, phone number, limited payment card details	Service providers; Stripe	Not sold or shared
Commercial information	Your plan, purchases, payment history, trial and offer status	Service providers; Stripe	Meta: that you started a trial or made a payment, and its value
Internet and network activity	Pages viewed, links clicked, dashboard usage, interactions with our ads	Service providers	Meta and Google
Approximate location	City or region worked out from your IP address	Service providers	Meta and Google, through your IP address
Electronic communications	Chat messages, emails and support requests	Service providers, including AI providers	Not sold or shared
Professional information	Business name and your role	Service providers	Not sold or shared
Sensitive personal information	Account sign-in details	Hosting and database providers	Not sold or shared

We don't create profiles of you. Our advertising partners may draw their own conclusions under their own privacy policies. We don't sell or share the personal information of anyone we know to be under 16.

Shine the Light. We don't disclose personal information to third parties for their own direct marketing purposes.

De-identified information. Where we hold de-identified information, we keep it in de-identified form and don't try to re-identify it.

Nevada residents

We don't sell covered information as Nevada law defines it. You can still send an opt-out request to info@lamediagrp.com.

15. Children

Bluu and our websites are not for children. Bluu is for businesses, and the people who use it must be at least 18. We don't knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, email info@lamediagrp.com and we will delete it.

16. Visitors from outside the United States

We are based in the United States, and we store and process information in the United States. Bluu is offered to businesses located in the United States. If you visit our websites from another country, your information will be processed in the United States, where privacy laws may differ from those where you live. You can contact us about your information wherever you are.

17. Links to other websites

Our websites and Bluu link to websites and services run by others, such as Google, Meta and Stripe. Their privacy policies, not this one, apply to them.

18. Changes to this policy

We may update this policy. If we make a material change, we will tell account holders by email or in the dashboard before it takes effect, and the date at the top always shows when it last changed.

19. Contact us

LA Media Group LLC 3134 Peachtree Cir, Davie, FL 33328 Email: info@lamediagrp.com

You can also book a call with us on usebluu.com.