Privacy Policy

01Who We Are

The identity of the data controller and how to contact us.

1.1 Bluto AI Limited ("Bluto", "we", "us") is the data controller responsible for personal data processed in connection with the Bluto platform and related services (the "Service").

1.2 We are incorporated in England and Wales under company number 16839916. Our registered office is at 20 Red Lion Street, London, England, WC1R 4PS.

1.3 We are registered with the Information Commissioner's Office under registration number ZC040466.

1.4 Capitalised terms used in this Privacy Policy that are not defined here have the same meaning as in our Terms of Service, available at bluto.ai/legal/terms.

1.5 For all privacy-related queries and data subject requests, please contact us at [email protected].

02What Data We Collect

The categories of personal data we collect and where they come from.

2.1 The personal data we collect depends on how you interact with us. We collect data in three ways: directly from you when you provide it, automatically through your use of the Service, and from third-party sources in limited circumstances.

2.2 Data you provide directly. When you register for an account we collect:

• your name and email address
• your company name and, optionally, your job title
• your password, stored in hashed form -- we do not have access to your actual password
• payment billing details, which are processed directly by our payment processor -- see clause 2.5

When you use the Service you may also submit Customer Content -- the financial data, projections, documents, and other materials you create or upload. Customer Content is yours. We process it solely to provide the Service and for no other purpose. You may send documents to us by email, including receipts and invoices forwarded to a Bluto address for processing. These are received by our email infrastructure in the United Kingdom, stored as documents, and treated as Customer Content. Anything contained in a document you forward -- including personal data relating to other people -- is processed on the same basis. You may also send us communications and support requests, which we collect and retain in accordance with clause 07.

2.3 Data we collect automatically. When you access and use the Service we automatically collect:

• technical data -- your IP address, browser type and version, device type, and operating system
• usage data -- the features you access, session durations, navigation paths, time and date of access, and interaction sequences within the platform
• AI interaction metadata -- the structure, length, and category of queries submitted to AI-powered features, and interaction patterns within those features; we do not retain the full text of AI inputs beyond what is necessary to provide the Service

We use this data to operate, maintain, and improve the Service, and to derive aggregated, anonymised insights in accordance with clause 03.

2.4 Data from third-party sources. If you register or sign in using a third-party authentication provider, we receive from that provider:

• your name and email address
• your profile picture, where one is set
• a unique identifier issued by that provider

We do not receive your password for any third-party service. If you no longer wish to use a connected authentication provider, contact us at [email protected] and we will disconnect it.

2.5 Payment data. Payment is processed directly by our payment processor. We do not receive or store your card number. We receive only a billing confirmation including the last four digits of your card, card brand, expiry date, and payment status.

03How We Use Your Data

The purposes for which we process your personal data.

3.1 We use personal data for the following purposes:

• to create and manage your account and provide access to the Service
• to process subscription payments and manage billing
• to operate, maintain, secure, and improve the Service, including through analysis of Usage Data
• to provide and improve AI-powered features within the Service
• to communicate with you about your account, including transactional emails, security alerts, service notices, and billing confirmations
• to respond to support requests and enquiries
• to detect, investigate, and prevent fraud, abuse, and security incidents
• to comply with our legal and regulatory obligations
• to send product updates and marketing communications, where you have given consent or where we have a legitimate interest in doing so

3.2 We do not use the substantive content of Customer Content -- including financial models, pitch decks, cap table data, or business plans -- to train AI or machine learning models without your prior written consent. See our AI Terms at bluto.ai/legal/ai for full details of how AI features process your data.

3.3 We may derive aggregated, anonymised insights from Usage Data across the platform. Such insights do not identify any individual Subscriber or their Customer Content and are used to improve the Service and inform product development.

04Legal Basis for Processing

The legal grounds under UK GDPR on which we process your personal data.

4.1 Under UK GDPR, we are required to identify a lawful basis for each category of processing. We rely on the following bases:

4.1.1 Performance of contract -- where processing is necessary to provide the Service under our Terms of Service. This covers account creation and management, payment processing, and the generation of outputs from data you provide.

4.1.2 Legitimate interests -- where we have a legitimate business interest that is not overridden by your rights. We rely on this basis for improving the Service through Usage Data analysis, fraud prevention and security monitoring, and sending product communications to existing Subscribers. Where we rely on legitimate interests, you have the right to object -- see clause 09.

4.1.3 Legal obligation -- where processing is required to comply with applicable law, including financial record-keeping obligations under HMRC requirements and our obligations under applicable data protection law.

4.1.4 Consent -- where we ask for and rely on your explicit agreement. We rely on consent for marketing communications to prospective users and, where applicable, for cookies that are not strictly necessary, as described in our Cookie Policy at bluto.ai/legal/cookies. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

4.2 Where we process personal data based on legitimate interests, you have the right to object to that processing by contacting us at [email protected].

05Data Sharing

Who we share your personal data with and under what conditions.

5.1 We do not sell personal data to any third party.

5.2 We share personal data only in the circumstances described in this section. All third parties with whom we share personal data are bound by contractual obligations that require them to protect personal data and to process it only in accordance with our instructions.

5.3 Service providers. We engage trusted third-party service providers who process personal data on our behalf in order to deliver the Service. Categories of service providers include:

• cloud infrastructure and hosting providers
• payment processing providers
• email delivery and receiving providers
• AI and document processing providers (see clause 5.4 below)
• error monitoring providers
• security monitoring providers

A current list of sub-processors, including the identity and location of each provider, is published at bluto.ai/legal/subprocessors.

5.4 AI and document processing providers. When you use AI-powered features, your inputs are processed by third-party providers. Documents you submit for automated data extraction -- such as receipts and invoices -- are processed by a document processing provider. Where you contact us for support, your enquiry may be processed with AI assistance in order to help us respond. We assess each provider for compliance with our data protection obligations before engaging them and maintain a data processing agreement with each. Our agreement with our language model provider confirms that inputs are not used to train or improve its models and are not retained once the request has been processed. Each provider, and what it processes, is listed at bluto.ai/legal/subprocessors.

5.5 Legal and regulatory disclosure. We may disclose personal data where required to do so by:

• applicable law or regulation
• a court order, warrant, or legal process served on us
• a regulatory or supervisory authority with jurisdiction over our business
• to protect the rights, safety, or property of Bluto, our Subscribers, or the public, where disclosure is permitted by applicable law

5.6 Business transfers. In the event of a merger, acquisition, or sale of substantially all of our assets, personal data may be transferred to the acquiring entity as part of that transaction. We will notify affected Subscribers by email before their personal data becomes subject to a different privacy policy, and will provide an opportunity to delete their account before the transfer takes effect.

06International Transfers

How we protect your personal data when it is processed outside the UK.

6.1 We host Customer Content and account data on AWS infrastructure located in the United Kingdom. A small number of internal systems supporting our operations run on infrastructure located in Germany; where you contact us for support, the content of your enquiry is processed there. Germany is subject to a United Kingdom adequacy decision, so no additional transfer safeguard is required.

6.2 Some of our service providers, including AI model providers and analytics providers, are located outside the United Kingdom. Where personal data is transferred to a country that does not provide an equivalent level of data protection to the UK, we ensure it is protected by appropriate safeguards.

6.2.1 For transfers to the United States and other countries without an adequacy decision, we rely on Standard Contractual Clauses approved by the relevant supervisory authority, together with the UK Addendum to those clauses where required for UK data transfers.

6.2.2 Where the relevant authority has issued an adequacy decision in respect of a recipient country, we rely on that decision as the transfer mechanism.

6.3 You may request information about the international transfer safeguards we rely on in respect of any specific service provider by contacting us at [email protected].

07Data Retention

How long we keep your personal data and what happens when it is no longer needed.

7.1 We retain personal data for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our standard retention periods are:

• account data: for the duration of your account, plus 7 days following closure to allow for data export, after which it is permanently deleted
• Customer Content: for the duration of your account, plus 7 days following closure to allow for data export, after which it is permanently deleted from active systems
• payment records: seven years from the date of the transaction, as required by applicable financial record-keeping law
• usage and technical logs: retained for between 14 and 90 days depending on the type of log, after which they are deleted
• records of access to our infrastructure: retained indefinitely as an audit trail
• support and communications records: three years from the date of the last communication
• backup copies: automated daily backups are retained for 7 days. After 7 days, backup copies are permanently purged and cannot be recovered

7.2 You may request deletion of your account and associated personal data at any time. We will process such requests within 30 days, subject to any legal obligation to retain certain records.

7.3 Where we are required to retain data beyond the date of your deletion request -- for example, financial transaction records subject to HMRC requirements -- we will restrict processing to the minimum necessary for the relevant legal obligation and will delete the data as soon as that obligation expires.

08Security

The measures we take to protect your personal data.

8.1 We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration, and unlawful disclosure. Our security measures include:

• encryption of all data in transit, with TLS 1.2 as the minimum and virtually all traffic using TLS 1.3
• encryption of all data at rest using AES-256
• multi-factor authentication required for access to production infrastructure
• access privileges granted on the principle of least privilege, with application-level controls separating one account's data from another
• access logging, with automated alerting across the production environment
• periodic security testing, and remediation of identified vulnerabilities according to the risk they present

8.2 Our full Security Policy, including details of our infrastructure security posture and certification status, is available at bluto.ai/legal/security.

8.3 In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach. We will notify affected Subscribers without undue delay where a breach is likely to result in a high risk to their rights and freedoms. Such notification will describe the nature of the breach, its likely consequences, and the steps we are taking to address it.

8.4 No method of electronic transmission or storage is completely secure. While we implement strong security measures, we cannot guarantee absolute security. You also play a role in keeping your account secure. Please use a strong, unique password and do not reuse it on other services. We verify your email address when you register and when you reset your password, by sending a code to your inbox. If you suspect any unauthorised access to your account, contact us immediately at [email protected].

09Your Rights

Your rights under UK GDPR and how to exercise them.

9.1 Under UK GDPR you have the following rights in relation to your personal data:

9.1.1 Right of access. You may request confirmation of whether we process personal data about you and, if so, a copy of that data together with information about how and why we process it.

9.1.2 Right to rectification. You may request that we correct any personal data we hold about you that is inaccurate or incomplete.

9.1.3 Right to erasure. You may request that we delete personal data we hold about you where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent and we have no other lawful basis for processing, or where processing is unlawful.

9.1.4 Right to restriction of processing. You may request that we restrict processing of your personal data in certain circumstances, for example where you contest the accuracy of the data or where you have objected to processing and we are assessing that objection.

9.1.5 Right to data portability. Where processing is based on contract or consent and is carried out by automated means, you may request a copy of personal data you have provided to us in a structured, commonly used, machine-readable format, and may request that we transmit it directly to another controller where technically feasible.

9.1.6 Right to object. You may object to processing of your personal data where we rely on legitimate interests as the lawful basis. You have an absolute right to object to processing for direct marketing purposes at any time, and we will cease such processing immediately upon receipt of your objection.

9.1.7 Right to withdraw consent. Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

9.1.8 Rights in relation to automated decision-making. We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing.

9.2 To exercise any of the above rights, please contact us at [email protected]. We will acknowledge your request within five working days and respond fully within one calendar month of receipt. We may ask you to verify your identity before processing your request.

9.3 If you are not satisfied with how we have handled your personal data or responded to your rights request, you have the right to lodge a complaint with the Information Commissioner's Office:

• Website: ico.org.uk
• Telephone: 0303 123 1113
• Post: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom

We would welcome the opportunity to address your concerns directly before you contact the ICO and encourage you to contact us first at [email protected].

10Updates to This Policy

How and when we update this Privacy Policy.

10.1 We may update this Privacy Policy from time to time to reflect changes in how we operate the Service, changes in applicable law, or changes to our data practices.

10.2 We will notify you of material changes by email to the address associated with your account at least 14 days before the change takes effect. The current version of this Policy will always be published at bluto.ai/legal/privacy, along with the version number and effective date.

10.3 Your continued use of the Service following the effective date of a material change constitutes acceptance of the updated Policy. If you do not accept the changes, you may delete your account before they take effect by contacting us at [email protected].

11Contact Us

How to reach us with privacy queries or data subject requests.

11.1 For all privacy-related queries, data subject rights requests, and complaints, please contact us using the details below.

11.2 Email: [email protected]

11.3 Post: Bluto AI Limited, Data Protection Enquiries, 20 Red Lion Street, London, England, WC1R 4PS.

11.4 We will acknowledge all requests within five working days and respond fully within one calendar month.