Privacy Policy

This Privacy Policy explains how the Bluri group processes personal data. We apply the EU General Data Protection Regulation (GDPR 2016/679), the Andorran Qualified Data Protection Act (Llei 29/2021) and the Spanish LOPDGDD, depending on the entity and your location.

1. Controllers

The data controller is the Bluri Andorran operating entity or the Spanish operating entity, according to your contracting entity. When an accountancy firm uses the Service to process its clients’ data, the firm is the controller and we act as processor on its documented instructions. Exact legal names, registered addresses and representatives will be stated here on completion of legal review.

2. Data we process

• Account data — name, email, phone, password hash, locale, role.
• Business / tax data — company name, tax IDs (NRT / NIF / NIE), addresses.
• Uploaded content — documents, invoices, accounting and KYC/AML records you submit.
• Billing data — usage metering and payment metadata (card data is handled by our payment processor, not stored by us).
• Technical data — IP, device/browser, audit logs, security events.

3. Purposes and legal bases

• Providing the Service — performance of the contract (GDPR Art. 6(1)(b)).
• AI document processing — contract performance; you control which documents are submitted.
• Legal & AML/KYC compliance — legal obligation (Art. 6(1)(c)); AML under Andorran Llei 14/2017 / Spanish Ley 10/2010 where applicable.
• Security, fraud prevention, billing — legitimate interests (Art. 6(1)(f)).
• Service emails — contract; marketing emails only with consent and an unsubscribe link.

4. Processors and recipients

We use vetted sub-processors under data-processing agreements solely to deliver the Service: cloud hosting and database, the AI document- extraction provider, the payment processor, and transactional email. We do not sell personal data and do not use Your Content to train third-party foundation models. The current sub-processor list is available on request and will be published here on legal review.

5. International transfers

Data is processed within the EEA and Andorra (recognised as providing an adequate level of protection). Where a sub-processor processes data outside these areas, transfers are covered by Standard Contractual Clauses or an equivalent safeguard.

6. Retention

We keep personal data for as long as your account is active and thereafter only as required to meet legal, accounting and AML retention obligations (which for accounting and AML records can be several years), after which it is deleted or irreversibly anonymised. Soft-deleted records are purged on a defined schedule.

7. Your rights

Subject to the applicable law you may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interests, and withdraw consent at any time. You may also lodge a complaint with the Andorran Data Protection Agency (APDA) or the Spanish AEPD. Where an accountancy firm is the controller of the data, direct your request to that firm; we will assist them.

8. Security

We apply technical and organisational measures including encryption in transit and at rest (AES-256), access controls, audit logging, tenant isolation and least-privilege. No system is perfectly secure; we maintain incident-response procedures and will notify you and the authority of a breach where legally required.

9. Cookies

We use strictly necessary cookies for authentication, security (CSRF/session) and locale/theme preference. We do not use third-party advertising cookies. Any future analytics will be added here with a consent mechanism before activation.

10. Contact & Data Protection

Privacy requests and our Data Protection contact: privacy@bluri.ai (general: info@bluri.ai). See also our Terms of Service.