Privacy Policy

1. What Information Do We Collect?

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, or otherwise when you contact us. This may include: names, phone numbers, email addresses, billing addresses, and contact preferences. Payment Data: All payment data is stored by Peach Payments. We do not store payment card details.

2. How Do We Process Your Information?

We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We also run automated checks for impersonation and phishing, as described in section 7.

3. When and With Whom Do We Share Your Information?

We may share information in specific situations when directly requested by you. We will never share Google User Data with any third-party. We may share certain personal information with the Department of Labour for UIF processing when triggered by you. We share the information listed in section 7 with Anthropic, PBC (the Claude AI service, in the United States), which assesses it on our behalf, and post the outcome of each check to Slack, our internal staff messaging service. Both are outside South Africa. See section 7.

4. How Long Do We Keep Your Information?

We will only keep your personal information for as long as it is necessary for the purposes set out in this privacy notice. No purpose in this notice will require us to keep your personal information for longer than three (3) months past the termination of the user's account. The exception is restriction records: checks that found a breach, restrictions, their reviews and lifts, and the names, email addresses and phone numbers used to recognise a restricted person who returns are kept for as long as they are needed to keep restricted users from returning, which may be indefinitely. See section 7.

5. How Do We Keep Your Information Safe?

We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of any personal information we process. However, no electronic transmission over the Internet can be guaranteed to be 100% secure.

6. Do We Collect Information from Minors?

We do not knowingly collect data from or market to children under 18 years of age.

7. Automated Checks for Impersonation and Phishing

We automatically check certain information and content to protect the people who receive email sent through Bluubin, and our Services, from impersonation and phishing, and to enforce section 5 of our Terms and Conditions.

What we check: (1) when you sign up for a free trial: the trading name, the email address used to sign up, and facts about the phone number given (whether it is local or international, its country code, its length, and whether that country is in the SADC region). We do not send the phone number itself; (2) when a company is added to an existing account: its trading name and registered name, and the email address and phone-number facts of the user adding it; (3) for a company that is not yet exempt: (a) when its company details are changed: the trading name, registered name, address, contact email address and contact phone-number facts, the logo image when a new logo is uploaded, the previous value of whatever changed, and the email address of the user making the change; (b) when an email template is saved: the new text, the text it replaces and the web-address domains in it, with the company's trading name and the email addresses of the company and of the user saving it; and (c) when an email is sent whose text the user typed or changed for that one email, including the reason given when an employee's expense claim is declined (which is emailed to the employee): that text and, where there is one, the saved template it replaced, with the same company and user details.

A company becomes exempt from the checks in point (3) automatically once it is 30 days old, or earlier if our support team exempts it. Companies that already existed when these checks were introduced are exempt.

Who handles the information: Anthropic, PBC (the Claude AI service, in the United States) receives the information listed above to assess it, acting on our behalf under Anthropic's commercial terms. The outcome of a check (the company's name and number, the account number, the result and the reasons found) is posted to Slack, our internal staff messaging service, which is hosted outside South Africa. Within our own systems, we also compare the names, email addresses and phone numbers given at signup, or set by a change, with those of accounts we have restricted.

What happens: while a check runs (normally a few seconds, at most about a minute and a half), the company's users may be shown a waiting page, and email the company sends through Bluubin is held. If a check finds a breach of section 5 of our Terms, the account, company or user concerned is restricted automatically, without a person reviewing it first. Its users lose access and see a page explaining how to contact us, email the company sends through Bluubin is held, and our support team reviews the restriction. The person restricted is told the kind of breach found (for example, impersonating a bank, or asking recipients for passwords), but not how the check scored it. Our support team can lift a restriction, and releases or discards held email. They can also restrict an account, company or user by hand.

If you are restricted by a check, you can contact us using the details under Contact Us below to make representations, and a person will review the restriction. See also section 6 of our Terms and Conditions.

How long we keep it: checks that found nothing, and checks that could not be completed, are deleted with the information sent for them 30 days after the check finished. Checks that found a breach, restrictions, their reviews and lifts, and the names, email addresses and phone numbers used to recognise a restricted person who returns are kept for as long as they are needed to keep restricted users from returning, which may be indefinitely.

Your right to object: you can object to these checks by contacting us. Because the checks protect the people who receive email sent through Bluubin, we cannot offer a free trial without them. We may exempt a company after reviewing an objection.

Contact Us

If you have questions or comments about this notice, email us at [email protected].