Privacy policy.

We only collect data you actively provide to us. Specifically:

• To operate the service: authenticate your account, store your cases, and deliver outputs.
• To generate the analyses you request: your inputs are sent to our AI sub-processors strictly to produce the case you asked for.
• To contact you about Early Access: if you joined the waitlist, we use your email to update you about the launch and onboarding.
• To improve reliability and security: diagnose errors and prevent abuse.

Our legal bases under GDPR are (i) performance of a contract for users of the service, (ii) your consent for waitlist communications, and (iii) our legitimate interest in keeping the service secure and reliable.

We do not sell your data. To deliver the service we rely on a small number of third-party providers, grouped below by category and purpose. Each provider operates under its own data-processing agreement and security commitments.

Some of these providers are located outside the European Economic Area. Where applicable, transfers are covered by Standard Contractual Clauses or equivalent safeguards.

You have the right to:

• Access a copy of the personal data we hold about you.
• Rectify data that is inaccurate or incomplete.
• Delete your data ("right to be forgotten").
• Port your data to another provider in a machine-readable format.
• Withdraw consent at any time, for example by unsubscribing from waitlist emails.
• Lodge a complaint with your local data-protection authority.

To exercise any of these rights, email legal@blueprintedapp.com. We respond within 30 days.

• Waitlist data is kept until you ask us to delete it, or after 24 months of inactivity, whichever comes first.
• Generated cases and account data are kept for as long as your user account is active. When you delete your account, your cases, versions, workbooks and share links are removed from our stores immediately, and your sign-in record within 30 days at most; backup copies age out on a routine cycle. Observations of hotels' publicly published rates (hotel, coordinates, star rating, city, published rate, month), collected while running cases, are retained after deletion. They contain none of your inputs, assumptions or results and are not linked to you, your account, or any case.
• Uploaded documents are transient processing, not retention: the file is read in memory to extract the structured project inputs you then review, and the file itself is discarded — it is not stored on our systems. What persists are the extracted inputs, as part of your case. A record of what the extraction returned (the fields it read, not the file) is kept for 90 days to check the extraction's quality, then deleted; deleting your account removes it at once.
• Operational logs (errors, security events) are retained only for as long as we need them to operate and secure the service, and are then deleted on a routine cycle.

Data is encrypted in transit (TLS) and at rest at the storage layer of our hosting provider; case files and the database are stored on that provider's infrastructure in the EU. Access to production systems is limited to named individuals under time-boxed access, protected by strong authentication, and revoked when it is no longer needed. We review our security posture regularly and patch dependencies on an ongoing basis.

As BluePrinted is in Early Access, this policy may evolve as we add features. Material changes will be communicated by email to active users and reflected in the "Last updated" date above.

The data controller is Blueprinted Hospitality, S.L., tax ID (NIF) B05754924, reachable at legal@blueprintedapp.com. Its registered office is stated in the Private Beta Notice.