Privacy Policy

1. Who we are and what this policy covers

1.1This Privacy Policy explains how Blue Rain Labs Inc. ("Blue Rain Labs", "we", "us") collects, uses, shares and protects personal information when you visit our public website at bluerainlabs.com (the "Site"), send us an enquiry through it, see our advertising on other platforms, or hear from us as a prospective client. It also describes the cookies the Site uses, so there is no separate cookie policy.

1.2The Blue Rain Labs Client Hub at hub.bluerainlabs.com has its own privacy policy, which applies once you or your organization become a client and use it. You can read it at hub.bluerainlabs.com/privacypolicyhub.

1.3Our office is at Unit 147, 1329 Queen Street East, Toronto, Ontario M4L 1C6. We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (Canada) and, where they apply, provincial private-sector privacy laws such as those of British Columbia and Quebec. Our commercial email follows Canada's Anti-Spam Legislation.

2. What we collect

2.1Enquiries. When you send us an enquiry through a form on the Site, we collect what you enter: your name and email address; your company, postal code and the services you are interested in, if you provide them; your message; and whether you ticked the box asking to receive updates from us. We also record the page the form was on and the network (IP) address your submission reached us from, as reported by our hosting provider, together with the date and time. The forms contain one hidden field that only automated software fills in; a submission that fills it is discarded.

2.2Email and phone. If you email or call us, we keep the correspondence and any notes we make of the call.

2.3How you use the Site. Only if you allow analytics or advertising. See Section 4.

2.4Server logs. Our hosting provider records each request to the Site: the IP address it came from, the browser description it sent, the page requested and the time. We use these records only to run and secure the Site. Our own application logs never contain the contents of an enquiry or the address it came from.

2.5What we do not collect. The Site has no accounts, no sign-in and no payment forms, and it stores no personal information in its own database. We do not buy information about visitors, and we do not combine analytics with your enquiry. If you allow advertising, the only link between your enquiry and our advertising is the one described in Section 4.3.

3. How we use it

3.1We use personal information to:

(a)answer your enquiry, prepare a quote or proposal, and follow up with you about it;

(b)send you occasional email about our services, only if you asked for it by ticking the box or otherwise gave us your consent;

(c)understand how the Site is used so we can improve it, only if you allow analytics (Section 4.2);

(d)show you our services and updates on the advertising platforms in Section 5.3, and learn which of our ads lead to visits and enquiries, only if you allow advertising (Section 4.3);

(e)run, secure and troubleshoot the Site, and block automated abuse;

(f)keep a record of the consents you give us, including the IP address and time recorded with an enquiry, as evidence that they were given; and

(g)comply with the law and enforce our agreements.

3.2Consent. By sending an enquiry you consent to the uses in Section 3.1 (a), (e), (f) and (g), which are what answering it requires. Marketing email, analytics and advertising are separate, express consents: the box on the form is unticked, and analytics and advertising stay off until you turn them on in the cookie banner. You can withdraw any of them at any time (Sections 4.5 and 11).

3.3Marketing email. Every commercial email we send identifies us, includes our postal address and lets you unsubscribe with one click. Unsubscribing takes effect within ten business days, and usually straight away.

3.4What we do not do. We do not sell or rent personal information, and we do not share it with other advertisers. We use it for advertising only as Section 4.3 describes, and only with your consent. We do not make decisions about you by automated means.

4. Cookies, analytics and advertising

4.1What the Site sets without asking. Two cookies store the choices you make in the cookie banner, each granted or denied, for 13 months. They are strictly necessary because they store the choices themselves, and they track nothing:

• brl_consent stores your analytics choice. It is set on .bluerainlabs.com, so the same choice applies on the Client Hub, and a choice made there applies here.
• brl_consent_ads stores your advertising choice. It is set on bluerainlabs.com only; the Client Hub neither reads it nor shows advertising.

The Site also keeps one flag in your browser's local storage so that a one-time hint on the technology carousel is not shown again; it holds no personal information and never leaves your browser. The Site sets no other cookies of its own: there is no sign-in and no session.

4.2Google Analytics, only if you allow it. Analytics is off until you allow it in the cookie banner, with Accept all or with the Analytics switch under Let me choose. Until then Google Analytics does not run and nothing is sent to Google Analytics. If you allow it, Google Tag Manager loads Google Analytics, which sets its own cookies (_ga and one beginning _ga_) lasting up to two years, and sends Google:

• the pages you view;
• that you sent an enquiry and which form it was, but never your name, email address or message;
• clicks on our links to the Client Hub, our Google Business Profile and our photographer's website; and
• the device, browser, approximate location and referral information Google Analytics collects automatically.

We never send your name, email address or any identifier of you to Google Analytics. Google keeps this event data for 14 months and then deletes it.

4.3Advertising, only if you allow it. Advertising is off until you allow it in the cookie banner, with Accept all or with the Advertising switch under Let me choose. Until then no advertising platform's code runs on the Site and nothing is sent to any advertising platform. If you allow it:

(a)Google Tag Manager loads the code of each advertising platform listed in Section 5.3. That code sets the platform's own cookies (for Reddit, _rdt_uuid, lasting up to 90 days) and sends the platform the pages you view on the Site; that you sent an enquiry, but never your name, email address or message; the identifier of our ad you clicked to get here, if you did; and your IP address and the device, browser and referral information it collects automatically. If you allow advertising but not analytics, your browser still fetches Google Tag Manager from Google to load that code, but Google Analytics does not run.

(b)When you send an enquiry, our server also tells each platform that an enquiry was sent, with a reference number that stops it being counted twice, your browser description, the identifier the platform's cookie gave your browser, the identifier of our ad you clicked, if you did, and your email address and IP address in a scrambled (hashed) form. The platform can match the hashed forms to an account on its own service, but they do not reveal the addresses themselves. It never receives your name, your message or your email address in readable form.

(c)The platform uses this to show our ads to people who have visited the Site, to tell us how many visits and enquiries came from our ads, and, under its own privacy policy, may link it to your account if you use its service. We receive only totals and reports, never information that identifies you.

The advertising signals in Google Consent Mode (ad storage, ad user data and ad personalization) are always set to denied, whatever you choose: we do not advertise with Google, there is no Google Ads conversion tracking on the Site, and allowing advertising does not give Google Analytics any advertising permission.

4.4Embedded video. One page, Smart Access & Security Cameras, plays a video from YouTube. We use YouTube's privacy-enhanced mode, which YouTube says does not store cookies that track your viewing until you play the video, but your browser fetches the player from YouTube when you open that page, and once you play the video YouTube (Google) may set cookies and collect information under Google's privacy policy. No other page embeds content from another company; our fonts and images are served from our own servers.

4.5Changing your choice. Use the Cookie preferences link at the foot of every page to turn analytics or advertising on or off. Turning either off reloads the page so that the code it allowed stops running. Your analytics choice applies on the Client Hub as well; your advertising choice applies only to the Site. Turning advertising off stops anything new reaching the advertising platforms; information they already received is kept under their own privacy policies, which also explain the advertising settings on your account with them.

5. Who we share it with

5.1Our Client Hub. Your enquiry is sent from the Site's server to the Blue Rain Labs Client Hub, our own client management system, where it is stored and where our staff read it. No automated alert about it is sent to any other service. The Client Hub is ours, not a third party; for enquiries from the Site, this policy governs, and the Client Hub Privacy Policy describes the system's safeguards.

5.2Service providers. We share personal information only with the service providers below, only as needed for the purpose shown, and under contracts that require them to protect it:

• Google Cloud and Firebase (Google LLC, United States): hosting of the Site and of the Client Hub, including the database that holds enquiries and its backups.
• Google Workspace (Google LLC, United States): our email, including our replies to you.
• Google Analytics (Google LLC, United States): measuring how the Site is used, only with your consent.
• YouTube (Google LLC, United States): the embedded video described in Section 4.4.

5.3Advertising platforms. Only if you allow advertising, we share the information described in Section 4.3 with the advertising platforms below. Each uses it to run and measure our ads and also under its own privacy policy, which applies to what it receives:

• Reddit (Reddit, Inc., United States): showing our ads on Reddit and measuring them. Reddit's privacy policy is at reddit.com/policies/privacy-policy.

These are the only advertising platforms we use. Before we add one, we will publish a new version of this policy, and we will ask for your advertising choice again before the new platform receives anything about you.

5.4When the law requires it. We disclose personal information when the law requires it, for example under a court order, warrant or subpoena, and only what is required.

5.5Business transfer. If our business is sold, merged or reorganized, personal information may pass to the successor, which must protect it as this policy describes.

6. Where your information is stored

6.1The Site and the Client Hub run on Google Cloud in the United States, and the providers and platforms in Section 5 also process information there. We do not store your information in Canada, and we do not claim to.

6.2Information stored or processed outside Canada is subject to the laws of the country where it is held, and may be accessed by that country's courts, law enforcement and national security authorities.

6.3We develop and test the Site with test data only. Your information is not copied into our development environment.

7. How long we keep it

7.1We keep personal information only as long as we need it for the purposes in this policy or the law requires, then delete it:

• Enquiries: 3 years after our last contact with you. If you become a client, the records of your enquiry become part of your client file and the Client Hub Privacy Policy's retention periods apply.
• Email and call notes: 3 years after the last message in the conversation.
• Marketing consent records: while you are on our list and for 3 years after you unsubscribe, as evidence of the consent.
• Server logs: 30 days.
• Google Analytics event data: 14 months.
• The brl_consent and brl_consent_ads cookies: 13 months, whether you allowed or declined, after which we ask again.
• Advertising platforms: their cookies last as Section 4.3 states, and they keep what they receive under their own retention policies.

7.2Backups. Enquiries live in the Client Hub's database, which is backed up daily; backups are kept for 98 days, and the database can be restored to any point in the last 7 days. Deleted information remains in backups until they expire, so it is fully removed within 98 days of its deletion. We use backups only to recover our systems, not to bring back information that was deleted on purpose.

7.3Service providers. Google keeps the information it holds under its own retention policies and legal obligations.

8. How we protect it

8.1We protect personal information with safeguards appropriate to its sensitivity, including:

(a)encryption in transit, and encryption at rest in the database that holds enquiries;

(b)checking and cleaning every enquiry on our server before it is stored, so that nothing you type is run as code;

(c)sending each enquiry from our server to the Client Hub over an authenticated connection, never from your browser to a third party;

(d)a hidden form field that catches automated submissions;

(e)keeping no personal information in the Site's own database, and denying the browser any direct access to it; and

(f)limiting access to enquiries to the staff who need it, with development and testing done on test data only.

8.2No system is perfectly secure. If you think your information has been mishandled, tell us at privacy@bluerainlabs.com.

9. Security breaches

9.1If a breach of our security safeguards involves personal information we hold, we contain it, assess whether it creates a real risk of significant harm to anyone, and if it does, report it to the Office of the Privacy Commissioner of Canada and to any provincial commissioner where the law requires, and notify the people affected as soon as feasible.

9.2We keep a record of every breach, whether or not it had to be reported, for at least 24 months.

10. Artificial intelligence

10.1When we contact a business that is not yet a client, we may use AI assistants (Anthropic's Claude and xAI's Grok) to research publicly available information about the business and to help draft our message. We give these tools only business contact details and publicly available information, never information from our clients' accounts.

10.2The Site itself does not use AI to process anything you submit. If that changes, we will update this policy before the change takes effect.

11. Your rights and choices

11.1You may:

(a)ask what personal information we hold about you, how we use it and who we have disclosed it to, and get a copy;

(b)ask us to correct it;

(c)withdraw consent: unsubscribe from our email using the link in any message or by writing to us, and turn analytics or advertising off at any time (Section 4.5); and

(d)ask us to delete your enquiry and correspondence, which we will do unless the law requires us to keep them.

11.2How to ask. Write to privacy@bluerainlabs.com or to the address in Section 1.3. We will confirm your identity before disclosing or changing anything, and we respond within 30 days, or tell you within that time if the law allows us more. There is no charge.

11.3Quebec residents have additional rights under Quebec law, including to receive personal information they provided to us in a structured, commonly used technological format.

11.4Complaints. Please contact our Privacy Officer first (Section 15). You may also complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or to your provincial privacy commissioner.

12. Links to other sites

12.1The Site links to the Client Hub, our Google Business Profile, our Instagram and LinkedIn pages, and the website of the photographer credited in the footer. Those sites have their own privacy policies, which apply once you follow the link.

13. Children

13.1The Site is for businesses and is not directed at children. We do not knowingly collect personal information from children. If you believe a child has sent us an enquiry, tell us and we will delete it.

14. Changes to this policy

14.1We may update this policy. Each version shows its version number and effective date, and we keep a copy of every version.

14.2For a significant change we will post a notice on the Site at least 30 days before it takes effect. If a change needs your consent, we will ask for it.

15. Contact and Privacy Officer

15.1Our Privacy Officer, Aaron Wright, is accountable for our compliance with this policy. Contact the Privacy Officer at privacy@bluerainlabs.com or by post at the address in Section 1.3.

15.2For anything else, use the contact form or email privacy@bluerainlabs.com.