Privacy Policy

This Privacy Policy describes how BLEUM, Inc. ("BLEUM," "we," "us," or "our") collects, uses, shares, and protects information in connection with our voice automation platform and related services (the "Service"). By using the Service, you agree to the practices described in this policy.

1. Introduction

BLEUM is a B2B voice automation platform. We process data on behalf of our business customers ("Customers") who use our platform to manage voice interactions with their end users ("Callers"). This Privacy Policy covers data we collect from Customers, their authorized users, website visitors, and Callers.

We are committed to protecting the privacy and security of all information we process, and we comply with applicable data protection laws including GDPR, CCPA/CPRA, and CAN-SPAM.

2. Information We Collect

2.1 Account Information

When you create an account, we collect: name, email address, organization name, and payment information (processed by Stripe). We may also collect your company website, phone number, and job title.

2.2 Service Usage Data

We automatically collect information about how you use the Service, including: call logs and metadata (duration, timestamps, phone numbers), voice recordings and transcripts (as configured by you), procedure configurations and knowledge base content, and platform usage analytics (pages visited, features used).

2.3 Caller Data

When Callers interact with your BLEUM-powered voice system, we process: phone number (caller ID), voice recordings (if enabled by you), call transcripts, and any information the Caller provides during the call.

2.4 Technical Data

We collect standard technical data including: IP address, browser type and version, device information, and log data (access times, error logs).

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process voice calls and generate transcripts
• Improve our AI models and voice recognition accuracy
• Send transactional emails (account confirmations, payment receipts, security alerts)
• Send commercial emails (trial reminders, usage notifications, product updates)
• Provide customer support
• Detect and prevent fraud and abuse
• Comply with legal obligations

We do not use your call recordings or transcripts to train AI models for other customers. Your data is used solely to provide the Service to you.

4. Information Sharing & Service Providers

We do not sell your personal information. We share data only with service providers who help us operate the Service:

Provider	Purpose	Data Shared
Twilio	Telephony infrastructure	Phone numbers, call audio
Deepgram	Speech-to-text transcription	Call audio streams
ElevenLabs	Text-to-speech (Premium Voice)	Response text
OpenAI	AI language processing, TTS	Conversation context
Groq	AI language processing	Conversation context
Stripe	Payment processing	Billing info, email
AWS	Cloud infrastructure, storage	All service data (encrypted)
Google Workspace	Email delivery (SMTP)	Email addresses, email content

We may also share information when required by law, to protect our rights, or in connection with a merger or acquisition (with advance notice to affected users).

5. Data Retention

We retain data for the minimum period necessary to provide the Service and comply with legal requirements:

Data Type	Default Retention	Configurable?
Call recordings	90 days	Yes (1-90 days)
Call transcripts	1 year	Yes (1-365 days)
Account data	Duration of account + 30 days	No
Billing records	7 years (legal requirement)	No
Audit logs	2 years	No
Support communications	3 years	No

You can configure recording and transcript retention periods in your account settings. After cancellation, all customer data is retained for 30 days to allow for reactivation, then permanently deleted.

6. Data Security

We implement industry-standard security measures to protect your data:

• Encryption in transit (TLS 1.2+) for all data transmission
• Encryption at rest (AES-256) for stored data
• SOC 2 aligned security controls
• Role-based access control with Keycloak authentication
• Regular security audits and vulnerability assessments
• Multi-region AWS infrastructure with automated backups

For more details about our security practices, visit our Security page.

7. Your Rights & Choices

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your personal data
• Export: Request a portable copy of your data (available in account settings)
• Opt-out: Unsubscribe from non-essential email communications
• Do Not Sell: Request that we do not sell your personal information (we don't sell data, but you can record this preference)

You can exercise many of these rights directly from your account Settings page. For additional requests, contact [email protected].

8. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: You can request details about the categories and specific pieces of personal information we collect
• Right to Delete: You can request deletion of your personal information
• Right to Opt-Out of Sale: We do not sell personal information. You can record your "Do Not Sell" preference in your account settings
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights
• Right to Limit Use of Sensitive Data: You can request that we limit our use of sensitive personal information

Categories of personal information we collect: Identifiers (name, email, IP address), commercial information (subscription history, payment records), internet activity (usage logs, analytics), and audio data (call recordings, if enabled).

To exercise your CCPA rights, contact [email protected] or use the privacy controls in your account settings.

9. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA) or United Kingdom, the following additional provisions apply:

9.1 Legal Basis for Processing

• Contract: Processing necessary to provide the Service to you
• Legitimate Interest: Analytics, fraud prevention, service improvement
• Consent: Marketing communications, optional analytics
• Legal Obligation: Tax records, compliance reporting

9.2 Data Transfers

Your data is processed in the United States. We rely on Standard Contractual Clauses (SCCs) for international data transfers. EU customers can request EU-region data processing.

9.3 Additional Rights

In addition to the rights listed in Section 7, GDPR provides: the right to restrict processing, the right to object to processing, the right to data portability, and the right to lodge a complaint with your local Data Protection Authority.

9.4 Data Processing Agreement

Enterprise customers may request a Data Processing Agreement (DPA) by contacting [email protected].

10. Email Communications & Unsubscribe

We send two types of emails:

10.1 Transactional Emails (Always Sent)

These are essential to your account and cannot be unsubscribed from:

• Password resets and security alerts
• Payment receipts and billing notices
• Account approval and setup confirmations
• Account deletion confirmations

10.2 Commercial Emails (Unsubscribe Available)

These are non-essential communications that you can opt out of:

• Trial reminders and onboarding tips
• Usage notifications and warnings
• Product updates and feature announcements
• Subscription lifecycle notifications

10.3 How to Unsubscribe

Every commercial email includes an unsubscribe link in the footer. Clicking it takes you to a confirmation page where you can opt out immediately — no login required. You can also resubscribe at any time using the link on the confirmation page. We honor all opt-out requests immediately.

11. Cookies & Tracking

We use cookies and similar technologies for:

• Essential cookies: Authentication, session management, security (required)
• Analytics cookies: Understanding how the Service is used (can be disabled in settings)

We do not use third-party advertising cookies or tracking pixels. Note that disabling certain cookies may affect Service functionality.

12. Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us at [email protected].

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 30 days before taking effect. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

14. Contact Information

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us: