Privacy Policy

1. Who we are and what this covers

Blue Peak Studio (the “Service”) is operated by Nelson Alvarado, doing business as Blue Peak Studio (“we”, “us”). This policy explains what personal information the Service handles, why, who else handles it for us, how long it is kept, and what choices you have.

There are two kinds of people whose information we handle:

• Agency users: the owner and staff of an insurance agency that has an account.
• Agency clients: the people and businesses named in the emails an agency forwards to the Service. For this information the agency decides what is sent to us and why; we handle it only on the agency’s behalf, as its service provider. If you are a client of an agency and have a question or request about your information, please contact that agency. We will help the agency respond.

2. What we collect

• Account details: email address, a protected (hashed) password, the agency’s name and reply-to address, each person’s role, and the date and version of the terms they accepted.
• Forwarded email: sender, subject, text, and attachments of each email an agency forwards, which may include names, addresses, policy numbers, vehicle and driver details, and other information about the agency’s clients.
• Connected mailboxes: if a member connects an Outlook, Microsoft 365, Gmail, or Google Workspace mailbox, the mailbox address, the folder we read, and an access token from Microsoft or Google, stored encrypted. We read only new mail in that mailbox’s Inbox, starting when the mailbox is connected, and store it like forwarded email. We cannot send, change, or delete anything in the mailbox.
• Waitlist details: if you join the waitlist on our home page, your name, work email, agency name and size, the kind of insurance it mostly writes, roughly how many certificate requests it gets each week, what you chose to tell us about your inbox, and whether you would pay for the Service.
• Drafts and documents: what the software extracted, what staff typed or corrected, saved policy details, the recipient address, and the documents that were sent.
• Activity log: who did what and when (for example who approved a draft). It does not contain the text of emails.
• Billing status: whether the subscription is on trial, active, or ended, and identifiers from our payment processor. Card details are collected and held by Stripe; we never see or store the card number.
• Technical data: the network address of a request, used briefly to limit abuse (stored only as a one-way hash), and operational logs that are written without email text, full email addresses, or secrets.

We do not use analytics or advertising trackers, and we do not buy information about you from anyone.

3. How we use it

• To provide the Service: receive email, prepare drafts, and send approved documents.
• To sign people in, keep each agency’s data separate, and keep a record of actions.
• To bill the subscription and to contact the account owner about the account.
• To contact people on the waitlist about early access and to ask about their agency’s needs. We do not add them to any other mailing list or share the waitlist with anyone.
• To keep the Service secure, prevent abuse, and fix problems.
• To meet legal obligations.

Artificial intelligence. The text of each forwarded email is sent to an AI model, which sorts it and extracts details into a draft. The model cannot send email or take any action; a person approves everything. We do not use your content to train AI models.

We do not sell personal information, and we do not share it for advertising. We use clients’ personal information only to provide the Service to the agency that sent it.

Information from Google. Blue Peak’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use mail read from a connected Gmail mailbox only to show the agency its requests and prepare drafts for its staff to review. Its text is sent to our AI model provider only to pick out the details of each request. We do not use it for advertising, do not sell it, and do not use it to train AI models. No one at Blue Peak reads it, except with the agency’s permission to help it, to investigate abuse or a security problem, or when the law requires it.

4. Companies that process data for us

We use the following service providers. Each receives only what it needs for its task and handles it under its own terms and security commitments.

• Supabase: database, sign-in, and file storage.
• Vercel: hosting of the application.
• Resend: receiving forwarded email and sending approved email.
• Stripe: subscription payments.
• Microsoft and Google: only if a member connects an Outlook or Gmail mailbox, to read that mailbox’s new mail.
• AI model provider: Anthropic. It receives the sender, subject, and text of forwarded emails, not attachments.

These providers may process data in the United States and in other countries where they operate. We may also disclose information when the law requires it, or to a buyer of the business, who would remain bound by this policy.

5. How long we keep it

• Email text, attachments, sent documents, and the contents of drafts are removed automatically 90 days after the email arrived, once its draft has been sent or rejected. A draft that is still waiting for a person is kept until someone approves or rejects it.
• A connected mailbox’s access token is deleted when the mailbox is disconnected, or when the agency is deleted. Disconnecting a Gmail mailbox also withdraws our access at Google. Mail already read from it follows the rules above.
• Waitlist details are kept until the person has been offered access and has decided, or until they ask us to remove them, whichever comes first.
• The record of what happened (sender, subject, recipient, dates, and the activity log) is kept for as long as the agency has an account.
• When an agency is deleted, its emails, drafts, documents, saved policies, activity log, and its members’ accounts are deleted from our systems straight away. Copies may remain for a limited time in our providers’ backups, and Stripe keeps payment records as the law requires.

6. Your choices and rights

• Export. The agency owner can download the agency’s data from Settings.
• Delete. The agency owner can delete the agency and all of its data from Settings.
• Leave the waitlist. Write to us at the address below and we will remove your details.
• Access, correction, deletion, and other requests. Depending on where you live, the law may give you rights to know what information is held about you, to correct it, or to have it deleted, and not to be treated unfairly for asking. Agency users can write to us at the address below. Agency clients should contact their agency, which controls their information; we will assist the agency.

7. Security

Data is encrypted in transit. Each agency’s data is separated from every other agency’s by rules enforced in the database, files are stored privately, and nothing is sent to anyone without a person’s approval. No system is perfectly secure. If we learn of a breach that affects an agency’s data, we will notify the account owner without undue delay.

8. Cookies

We use only the cookies needed to keep you signed in. See the Cookie Notice.

9. Children

The Service is for businesses and is not directed to children. We do not knowingly create accounts for anyone under 18.

10. Changes to this policy

If we change this policy in a way that matters, we will tell account owners by email or in the Service before the change takes effect, and we will update the date at the top.

Contact