Privacy Policy
Effective Date: June 23, 2026
BlueReef AI ("BlueReef," "we," "us," or "our") operates the bluereefai.com website and the BlueReef platform. This Privacy Policy describes how we collect, use, store, and protect your information — including data accessed through Google API integrations — when you use our services.
1. Information We Collect
Account Information
When you register, we collect your name, email address, company name, job title, and authentication credentials.
Google API Data
With your explicit authorization via OAuth, we may access the following Google data, depending on which integrations you connect and which actions you approve:
- Gmail read data: Email messages, message bodies, metadata (sender, recipient, subject, timestamps), sent-mail context, and thread information — used to detect customer replies, scheduling requests, cancellations, reschedules, and deal-related communication history.
- Gmail send access: Used only to send outbound emails that you approve in BlueReef, such as follow-up emails, meeting recaps, and reschedule confirmations. We do not use Gmail access to delete messages, change labels, archive messages, or mark messages as read.
- Google Calendar: Calendar events, attendees, meeting times, event metadata, and calendar settings such as time zone — used to prepare for sales meetings, reconcile meeting changes, and create or update sales meeting invitations after user approval.
- Google Drive and Slides: Files and presentations that BlueReef creates or opens through the app — used to create, store, and update user-approved artifacts such as meeting prep documents, recap materials, and slide decks. BlueReef uses file-scoped Drive access and does not request broad access to every file in your Drive.
- Profile Information: Basic profile data (name, email, profile photo) for account setup and display.
Usage Data
We collect information about how you interact with the platform, including pages visited, features used, and performance metrics.
CRM & Integration Data
When you connect third-party CRMs (e.g., Salesforce, HubSpot), we access deal records, contact information, and pipeline data as authorized by you.
2. How We Use Your Information
We use the information we collect to:
- Provide and operate the BlueReef platform, including AI agent deal management, call prep, coaching, and pipeline analytics
- Generate meeting prep sheets, coaching debriefs, and deal plans based on your communications and calendar
- Read relevant Gmail and Calendar context to detect customer replies, scheduling changes, cancellations, and commitments that affect sales workflows
- Draft outbound emails and create or update calendar events only after user review and approval
- Create and update app-generated Google Drive or Slides artifacts, such as meeting prep documents and internal slide decks
- Sync data bi-directionally with your CRM
- Deliver morning briefings and pipeline reports
- Improve and develop new features based on aggregated, anonymized usage patterns
- Provide customer support and respond to inquiries
- Comply with legal obligations
We do not use your data for advertising, marketing to third parties, or any purpose unrelated to providing the BlueReef platform.
3. Google API Services User Data Policy Compliance
BlueReef AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Limited Use Disclosure
In accordance with Google's Limited Use requirements, we commit to the following:
- 1.We only use Google user data to provide and improve user-facing features that are visible and prominent in the BlueReef platform — specifically deal management, call prep, coaching, and pipeline analytics.
- 2.We do not transfer Google user data to third parties except as necessary to provide or improve user-facing BlueReef features with your consent, for security purposes, to comply with applicable laws, or as part of a merger, acquisition, or sale of assets after obtaining explicit prior consent from affected users where required by Google's Limited Use requirements.
- 3.We do not use Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising.
- 4.We do not sell Google user data, use it to determine creditworthiness or lending eligibility, or transfer it to advertising platforms, data brokers, or information resellers.
- 5.We do not allow humans to read Google user data unless (a) we have the user's affirmative agreement for specific content (e.g., for technical support), (b) it is necessary for security purposes such as investigating abuse, (c) it is necessary to comply with applicable law, or (d) the data is aggregated and anonymized for internal operations.
4. Data Storage & Security
We implement industry-standard security measures including:
- Encryption at rest for production databases and storage using industry-standard cloud security controls
- Encryption in transit using TLS 1.2 or higher for network traffic
- Workspace isolation — tenant data is logically separated and never shared between workspaces
- Role-based access controls with the principle of least privilege
- Audit logging — every agent action is logged with timestamps
- Regular security assessments and vulnerability testing
For more details on our security practices, visit our Security page.
5. Data Retention & Deletion
We retain your data for as long as your account is active or as needed to provide services. Specifically:
- Account data is retained until you delete your account or request deletion
- Google API data is retained only as long as necessary to provide the features you authorized. OAuth tokens and stored Google-derived content are deleted within 30 days of OAuth revocation or account deletion unless a longer period is required by law
- Drafts, artifacts, and deal history derived from Google data are retained while your workspace is active so BlueReef can preserve sales context, commitments, and audit history. You may request deletion of this derived content at any time
- Usage logs are retained for up to 12 months for security and improvement purposes
You can request deletion of your data at any time by emailing privacy@bluereefai.com or through your account settings. When you revoke Google OAuth access, BlueReef stops new Google API access for that integration and queues stored OAuth tokens and associated Google-derived integration data for permanent deletion within 30 days, subject to legal or security retention obligations.
6. Third-Party Data Sharing
We do not sell your data to any third party.
We may share data with third parties only in the following circumstances:
- Service providersthat help us operate the platform (e.g., cloud hosting, AI model providers, email delivery, logging, and security monitoring) — bound by data processing agreements and allowed to process Google user data only to provide or improve BlueReef's user-facing features, security, or support
- Your CRM and connected integrations — only data you explicitly authorize us to sync
- AI processing providers — only where needed to generate the user-facing plans, drafts, summaries, and artifacts you request or approve inside BlueReef. We do not permit providers to use Google user data for advertising or for training generalized models.
- Legal compliance — when required by law, subpoena, or court order
- Business transfers — in connection with a merger, acquisition, or sale of assets, after explicit prior consent from affected users where required for Google user data
7. Your Rights
You have the right to:
- Access — request a copy of the personal data we hold about you
- Correction — request that we correct inaccurate data
- Deletion — request that we delete your data
- Portability — request your data in a structured, machine-readable format
- Revoke OAuth access — disconnect Google integrations at any time through your account settings or through your Google Account permissions
- Opt out — of non-essential communications
To exercise any of these rights, contact privacy@bluereefai.com. We respond to all requests within 30 days.
8. California Privacy Rights (CCPA)
If you are a California resident, you have the right to know what personal information we collect, request its deletion, and opt out of its sale. We do not sell personal information. To exercise your rights, contact privacy@bluereefai.com.
9. European Privacy Rights (GDPR)
If you are in the European Economic Area, our legal basis for processing your data is: (a) your consent when you authorize OAuth integrations, (b) contractual necessity to provide the services you requested, and (c) our legitimate interest in improving the platform. You have the right to withdraw consent, lodge a complaint with a supervisory authority, and exercise all rights listed in Section 7 above.
10. Cookies
We use essential cookies to maintain your session and authentication state. We use analytics cookies to understand how users interact with the platform. You can control cookie preferences through your browser settings.
11. Children's Privacy
BlueReef AI is designed for business use and is not directed at individuals under the age of 16. We do not knowingly collect personal information from children. If we learn that we have collected data from a child under 16, we will delete it promptly.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and, where appropriate, by email or in-product notice. If we materially change how BlueReef accesses, uses, stores, or shares Google user data, we will update this policy and request any consent required before using Google user data for the new purpose. Your continued use of the platform after changes take effect constitutes acceptance of the updated policy.
13. Contact Us
If you have questions about this Privacy Policy or our data practices, contact us at: