Privacy Policy

BLUKASTOR LLC

Effective Date: September 5, 2026

This policy updates and replaces the prior Blukastor privacy policy last updated September 14, 2021.

1. Introduction and Scope

BLUKASTOR LLC (“Blukastor,” “we,” “us,” or “our”) operates Blukastor and the Blukastor Flow technology platform (collectively, the “Blukastor Platform”). The Blukastor Platform may be made available through websites, messaging channels such as WhatsApp, automated workflows, artificial-intelligence-enabled agents, interfaces used by business customers, and related services.

This Privacy Policy explains how we collect, use, retain, disclose, and protect personal information when you interact directly with Blukastor, use the Blukastor Platform, communicate with us, receive services from Experts through the Platform, or interact with a business customer that uses Blukastor Flow where this Policy applies to Blukastor’s processing.

This Policy is a notice about our privacy practices. It is not intended to convert every processing activity into consent. Where applicable law requires consent, we will seek it in the appropriate context. Other processing may be based on providing requested services, our legitimate business interests, compliance with law, protection of users and the Platform, or other lawful grounds.

2. Definitions and Our Role

“Personal Information” or “Personal Data” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to an identifiable individual, as defined by applicable law.

“Business Customer” or “Tenant” means an organization that uses Blukastor Flow to provide its own services or experiences to its customers or end users. “Expert” means a person who may assist in providing a service through or in connection with the Platform, and may include authorized internal personnel or independent external service providers.

Blukastor’s privacy role depends on the context. When we determine why and how Personal Information is processed for our own purposes, Blukastor may act as a controller or business. When we process Personal Information on documented instructions of a Business Customer, Blukastor may act as that customer’s processor or service provider. A Business Customer may have its own privacy notice governing its relationship with its end users. If you interact with a Business Customer through Blukastor Flow, you should also review that customer’s privacy notice.

3. Information We Collect

Depending on how you use the Platform, we may collect the following categories of information:

  • Identity and contact information, such as name, email address, telephone number, account identifiers, and other contact details you provide.
  • Account and profile information, such as account settings, preferences, role, organization, profile information, and authentication-related data.
  • Communications and User Content, including messages, chat content, prompts, responses, feedback, ratings, images, audio, documents, files, forms, and other content you choose to submit.
  • Service and interaction information, such as the service requested, workflow status, appointments or actions, Expert assignments, support interactions, ratings and reviews, and other operational records.
  • Transaction and payment-related information, such as amounts, transaction status, fees, refunds, payouts, billing references, and payment-provider identifiers. Payment-card and bank-account data may be collected directly by payment providers rather than stored by Blukastor.
  • Technical and Usage Data, such as IP address, browser or device type, operating system, timestamps, pages or features used, diagnostic events, security logs, and similar information generated through use of the Platform.
  • Information you provide voluntarily in the course of a service, which may include information about your circumstances, business, or request that is necessary to provide the requested service.

We do not use precise GPS location tracking as a general feature of the current virtual-service model. Technical information such as IP address may permit an approximate location to be inferred, and you may voluntarily provide location information when it is relevant to a service.

4. Information We Receive From Business Customers and Third Parties

We may receive Personal Information from Business Customers, Experts, communications providers, payment providers, authentication providers, and other services that a user or Business Customer connects to or uses with the Platform. The information we receive depends on the integration, the service requested, the permissions granted, and the applicable relationship.

When a Business Customer provides or makes Personal Information available to Blukastor for processing on its behalf, that Business Customer is responsible for providing required notices, obtaining required permissions or consents, and otherwise establishing a lawful basis for its instructions, except to the extent applicable law places a responsibility directly on Blukastor.

5. Artificial Intelligence and Automated Processing

The Blukastor Platform uses artificial intelligence (“AI”), automated agents, rules, models, and workflows to help provide services. These systems may generate or summarize responses, classify requests, retrieve context, route matters, recommend next steps, select or assign workflows or Experts, personalize interactions, execute authorized actions, support quality assurance, and perform other functions within the scope of the service.

Where reasonably appropriate, the user experience may indicate that an interaction is automated or AI-assisted and may indicate when a matter is escalated or transferred to a human Expert.

6. Automated Decisions, Authority, and AI Limitations

AI and automated systems may make decisions or execute actions within the scope, rules, permissions, thresholds, and levels of autonomy configured or authorized for a service. Lower-risk operational functions may be performed automatically. Actions with greater financial, contractual, legal, professional, or other material consequences may be subject to additional controls, confirmation, escalation, or human review when required by the service design, customer configuration, contract, or applicable law.

AI systems are probabilistic and can make mistakes. Outputs, recommendations, classifications, summaries, or actions may be inaccurate, incomplete, outdated, inconsistent, or unexpected. The use of AI does not make an output inherently correct and does not, by itself, convert an automated response into professional advice. Users and Business Customers should apply appropriate judgment and verification based on the nature and risk of the matter. Additional limitations and allocation of responsibility may be set out in applicable Terms of Service or customer agreements.

7. Conversational Memory and Personalization

Continuity of service is a core feature of the Blukastor Platform. We may retain and use relevant information from prior interactions so that AI Agents and authorized Experts can maintain context, personalize service, avoid repeatedly requesting the same information, follow up on prior matters, and provide a more consistent experience. The information retained for memory may include conversation content, summaries, preferences, service history, decisions, and other context reasonably relevant to providing the service.

Memory is subject to applicable retention, access, deletion, security, and tenant-isolation controls described in this Policy.

8. Experts and Human Assistance

Blukastor may use internal or external Experts to provide or assist with services. When a matter is assigned or escalated to an Expert, the Expert may receive the information and prior conversational context reasonably necessary to perform the assigned service. We seek to limit access according to role, assignment, and need.

The term “Expert” does not necessarily mean that Blukastor has independently verified a professional license, credential, or regulatory status. Unless we expressly state otherwise for a particular service, users should not interpret the Expert designation as a certification, endorsement, or guarantee by Blukastor. Services in regulated professional categories may be subject to additional terms, disclosures, or verification requirements.

9. How We Use Information

We may use Personal Information for purposes including:

  • providing, operating, maintaining, and personalizing the Platform and requested services;
  • maintaining conversational context and continuity across interactions;
  • using AI Agents, automation, routing, matching, workflows, and Expert escalation to fulfill service requests;
  • communicating about accounts, services, transactions, support, security, and material service changes;
  • processing and administering subscriptions, Expert services, fees, transactions, refunds, and payouts, as applicable;
  • providing customer support and allowing authorized personnel to troubleshoot, investigate, or resolve issues;
  • monitoring performance, quality, reliability, safety, security, fraud, misuse, and technical issues;
  • analyzing usage and improving the Platform, AI Agents, prompts, workflows, classifications, knowledge systems, and service quality;
  • maintaining records, enforcing agreements, resolving disputes, and complying with legal obligations;
  • sending marketing or promotional communications where permitted by law and subject to applicable opt-out or consent requirements; and
  • other purposes disclosed at the time information is collected or with authorization where required.

10. AI and Service Improvement

We may review and use interactions, feedback, operational outcomes, and related information to evaluate and improve Blukastor’s services, including AI Agents, prompts, workflows, routing, classifications, knowledge systems, quality controls, and user experience. Where appropriate, we may use aggregation, de-identification, minimization, access restrictions, sampling, or other measures to reduce privacy risk.

Improving Blukastor’s services is distinct from allowing an external AI provider to use Personal Information to train that provider’s general-purpose models. We seek to configure and contract with AI and technology providers in a manner appropriate to our business use and data-protection obligations. Our practices may vary by provider and service, and we will not represent that a provider follows a particular training practice unless that representation is supported.

11. Sensitive Information and Data Minimization

Open communication channels may allow users to submit sensitive information. Please do not provide sensitive Personal Information, authentication credentials, passwords, full payment-card numbers, government identification numbers, health information, or other highly sensitive information unless it is reasonably necessary for the service and the relevant workflow specifically requests or permits it.

We seek to minimize the collection and exposure of sensitive information and may use warnings, access restrictions, redaction, filtering, deletion, or other safeguards where appropriate. However, automated detection and security controls are not infallible, and we cannot guarantee that every item of sensitive information submitted by a user will be detected, blocked, or removed automatically. Once Personal Information is received, we handle it subject to applicable law and the safeguards described in this Policy.

12. WhatsApp, Meta, and Other Communication Channels

The Platform may support communications through third-party channels such as WhatsApp. When you use WhatsApp or another third-party communication service, your communications and related metadata may be processed by the provider of that channel as well as by Blukastor and, where applicable, the Business Customer with whom you are communicating. Those third parties operate under their own terms and privacy practices.

Blukastor may use information received through these channels to provide the requested service, maintain conversational context, route or automate communications, support Experts, maintain security, and perform the other purposes described in this Policy.

13. Payments and Transaction Information

Blukastor may offer paid memberships or subscriptions, Expert or mentor services, and payment-enabled workflows. For certain services, Blukastor may receive or facilitate payments through Stripe, administer applicable fees or commissions, and support payouts when the applicable service model calls for them. Certain Business Customers may also use payment-enabled flows supported by the Platform, while other Business Customers may manage payments directly with their own customers. The structure of a payment flow may vary by service and Business Customer.

Stripe is a third-party payment provider currently used by Blukastor for payment-related functions, including memberships and Expert or mentor services. Stripe may collect payment-card, bank-account, identity, tax, or other information directly under its own terms and privacy notice. Blukastor may receive transaction identifiers, amounts, status, fees, commissions, refunds, payout information, and other information needed to administer the applicable transaction or service. We do not intend to store full payment-card numbers on Blukastor systems. Nothing in this Privacy Policy is intended to characterize Blukastor as a merchant of record, money transmitter, regulated payment processor or institution, escrow provider, or any similar regulated payment role.

14. Business Customer and Tenant Data

Business Customers may use Blukastor Flow to communicate with and provide services to their own customers or end users. When Blukastor processes Personal Information on behalf of a Business Customer, we generally use that information to provide the contracted services, follow authorized instructions and workflows, maintain and secure the Platform, provide support, comply with law, and perform other processing permitted by the applicable customer agreement.

Blukastor may separately process information about a Business Customer’s owners, administrators, personnel, billing contacts, and use of Blukastor Flow for Blukastor’s own account administration, billing, security, service improvement, legal compliance, and business operations.

15. Tenant Data Isolation and Cross-Tenant Use

Blukastor is designed to separate Business Customer contexts. We do not use identifiable Personal Information belonging to one Business Customer’s end users to provide another Business Customer with that individual’s customer data or conversational memory. Access to tenant data should be limited according to authorized tenant context, role, and service need.

We may use aggregated or de-identified information for analytics, benchmarking, security, and service improvement where appropriate and where the information is handled in a manner designed not to identify an individual or expose one Business Customer’s identifiable customer information to another.

16. How We Disclose Information

We may disclose Personal Information in the following circumstances:

  • to the Business Customer associated with the service or interaction, consistent with the applicable relationship;
  • to internal personnel and Experts who need information to provide, support, review, or improve the assigned service;
  • to vendors, service providers, subprocessors, and professional advisers that help us operate the Platform or business;
  • to communications, infrastructure, AI, hosting, database, analytics, security, customer-support, and payment providers as needed for their functions;
  • to comply with law, legal process, court orders, or valid requests from public authorities;
  • to protect the rights, safety, security, property, or integrity of Blukastor, our users, Business Customers, Experts, or others;
  • in connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar business transaction, subject to applicable law; and
  • with your direction, consent, or authorization where required or otherwise disclosed at the time of collection.

We do not sell Personal Information for money. We do not use identifiable tenant customer data to provide another tenant with that person’s data or memory. If Blukastor later engages in a practice that applicable law defines as a sale, sharing for cross-context behavioral advertising, or targeted advertising requiring an opt-out, we will provide the notices and choices required by applicable law before relying on this Policy for that practice.

17. Service Providers, Subprocessors, Cookies, and Similar Technologies

We use third parties to support functions such as cloud infrastructure, databases, communications, AI processing, workflow automation, authentication, payments, analytics, monitoring, security, and customer support. We seek to provide them access only as reasonably necessary for their functions and to use contractual, technical, or organizational protections appropriate to the relationship.

Our websites may use cookies and similar technologies for functions such as session management, preferences, security, authentication, and analytics. The technologies actually used may change as the Platform evolves. Where applicable law requires consent or a choice for non-essential cookies, we will provide the relevant controls. We do not include legacy advertising or remarketing practices in this Policy unless they are actually implemented.

18. Data Retention

We retain Personal Information for as long as reasonably necessary for the purposes described in this Policy, including providing services and conversational continuity, maintaining business and transaction records, supporting security and fraud prevention, complying with legal obligations, resolving disputes, and enforcing agreements. Retention may vary by data category, service, customer instructions, legal requirement, and operational need.

We do not adopt the prior policy’s general statement that member information is retained indefinitely. Where Blukastor acts as a processor or service provider, retention and deletion may also be governed by the Business Customer’s instructions and applicable agreement. Deletion from active systems may not immediately remove information from backups, security records, or records that must be retained for legal or legitimate operational reasons.

19. Data Security

We use reasonable administrative, technical, and organizational measures designed to protect Personal Information against unauthorized access, loss, misuse, alteration, or disclosure. Measures may include access controls, authentication, logging, tenant separation, vendor controls, and other safeguards appropriate to the nature of the information and service.

No method of transmission, storage, automated detection, or security control is completely secure or error-free. We therefore cannot guarantee absolute security. Users and Business Customers also play a role in security and should protect credentials, limit unnecessary sensitive information, and promptly report suspected unauthorized access.

20. International Data Transfers

Blukastor is a United States company, and Personal Information may be processed in the United States and other countries where Blukastor, our Business Customers, Experts, or service providers operate. Privacy laws in those locations may differ from those in your jurisdiction. Where required, we use appropriate contractual or other safeguards for international transfers.

21. Your Privacy Rights and Data Deletion

Depending on where you live and the context in which we process your Personal Information, you may have rights to request access, correction, deletion, portability, restriction, objection, withdrawal of consent where processing is based on consent, or other rights provided by applicable law.

You may submit a privacy or deletion request by contacting info@blukastor.com. We may need to verify your identity and authority before completing a request. If Blukastor processes your information solely on behalf of a Business Customer, we may direct the request to that Business Customer or assist it in responding.

Deletion requests are subject to applicable exceptions. We may retain information where reasonably necessary or legally permitted for security, fraud prevention, transaction records, legal compliance, dispute resolution, enforcement, backups, or other permitted purposes. A separate public Data Deletion Instructions page may provide operational steps for submitting and tracking deletion requests.

22. California and Other U.S. State Privacy Rights

Residents of California and certain other U.S. states may have additional privacy rights under applicable law. Depending on the law and our processing, these may include rights to know or access categories or specific pieces of Personal Information, correct inaccurate information, delete information, obtain a portable copy, and opt out of certain sales, sharing, targeted advertising, or profiling activities.

Blukastor does not discriminate against individuals for exercising privacy rights provided by applicable law. We may take reasonable steps to verify a request and may recognize an authorized agent where required. Because our practices and legal obligations can depend on the applicable state law and processing context, we will provide any additional notices or mechanisms required for a specific covered practice.

23. EEA, United Kingdom, and Similar Data Protection Rights

Where the GDPR, UK GDPR, or similar data-protection law applies, Blukastor processes Personal Data under one or more lawful bases appropriate to the activity, which may include performance of a contract or steps requested before entering a contract, legitimate interests, compliance with legal obligations, consent where required, or protection of vital interests in appropriate circumstances.

Subject to applicable law, individuals may have rights of access, rectification, erasure, restriction, objection, data portability, withdrawal of consent, and complaint to a competent supervisory authority. Where applicable law provides rights relating to solely automated decisions producing legal or similarly significant effects, Blukastor will address those rights in the context of the relevant processing.

24. Children and Age Restrictions

The current Blukastor Platform is intended for adults age 18 and older and is not directed to children. We do not knowingly solicit Personal Information from children for use of the current adult service. If we learn that we have collected Personal Information from a child in circumstances where we should not have done so, we will take reasonable steps to delete, restrict, or otherwise address the information as required by applicable law.

Future services designed for minors or families, if any, will be evaluated separately and may be subject to additional notices, permissions, controls, and terms.

25. Third-Party Services and Links

The Platform may contain links to, integrate with, or permit use of third-party websites, applications, communication channels, payment services, or other services that Blukastor does not control. Those third parties may process information under their own terms and privacy notices. We encourage you to review the privacy practices of third-party services you choose to use.

26. Business Transfers

If Blukastor or its assets are involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, Personal Information may be disclosed or transferred as part of that transaction, subject to applicable law and appropriate protections.

27. Changes to This Privacy Policy

We may update this Privacy Policy as the Platform, our practices, or legal requirements change. We will post the updated policy with a revised effective date and, where required, provide additional notice of material changes. We encourage you to review this Policy periodically.

28. Contact Us

For questions about this Privacy Policy, privacy rights, correction requests, or deletion requests, contact:

BLUKASTOR LLC

Email: info@blukastor.com

Website: www.blukastor.com

If a specific Blukastor Flow Business Customer is responsible for your relationship and your request concerns data controlled by that Business Customer, please also contact that Business Customer using the privacy contact information it provides.