Privacy Policy

Effective Date: October 14, 2026

This Privacy Policy explains how Incubug, Inc. d/b/a Bluvia (“Bluvia,” “we,” “our,” or “us”) collects, uses, discloses, stores, and protects information when you visit Bluvia, use the Bluvia WordPress plugin, our websites, software, cloud services, AI-powered features, customer support, and any related products or services (collectively, the “Services“). Your privacy is important to us. We are committed to handling personal information responsibly, transparently, and in accordance with applicable privacy laws. By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy.

1. Scope

This Privacy Policy applies to:

The Bluvia website.
All Bluvia WordPress plugins.
Customer dashboards.
Customer accounts.
AI-powered analysis features.
Customer support communications.
Product updates and newsletters.
Any related online services operated by Bluvia.

This Privacy Policy does not apply to third-party websites, plugins, services, or applications that may integrate with Bluvia.

2. Information We Collect

Depending on how you interact with Bluvia, we may collect the following categories of information.

2.1 Information You Provide

You may provide information including:

Name
Email address
Company name
Billing address
Payment information
Account credentials
Support requests
Communications with our team
Survey responses
Feature requests
Marketing preferences

You are responsible for ensuring the information you provide is accurate and current.

2.2 Account Information

When you create an account, we may collect:

Username
Email address
Encrypted password or authentication credentials
Subscription status
License information
Plan information
Account preferences
Organization or workspace information
API credentials where applicable

2.3 Billing Information

If you purchase a subscription, billing information is processed through our payment providers. Bluvia generally does not store complete customer payment card numbers on our systems. We may retain:

Transaction identifiers
Invoice history
Subscription records
Payment status
Billing contact information
Tax-related information where required by law

2.4 Website Usage Information

When you visit our website, we may automatically collect technical information such as:

IP address
Browser type
Device type
Operating system
Language settings
Referring pages
Pages viewed
Time spent on pages
Session duration
Date and time of access
Clickstream information
Error logs
Diagnostic information

2.5 Product Analytics

When using the Services, we may collect operational information necessary to provide product functionality, improve reliability, troubleshoot issues, and enhance the user experience. Depending on your configuration, this may include:

License activation information
Plugin version
WordPress version
PHP version
Server configuration details
Feature usage statistics
Performance metrics
Diagnostic logs
Error reports
Configuration settings

We strive to limit the collection of operational data to what is reasonably necessary to operate and improve the Services.

2.6 Customer Analytics Data

Bluvia enables customers to analyze visitor behavior on their own websites. Depending on the features you enable, analytics data processed through the Services may include:

Page views
Session activity
Click interactions
Scroll behavior
Conversion events
Experiment participation
Heatmap information
Funnel progression
Session recordings
Event timestamps
Browser characteristics
Device characteristics
Approximate geographic information derived from IP addresses
Referrer information

This information belongs to the customer operating the website using Bluvia. Customers are responsible for ensuring they have appropriate legal authority and privacy disclosures for collecting information from their own website visitors.

2.7 AI Features

Certain subscription plans may include AI-powered functionality designed to help interpret analytics, summarize experiments, identify optimization opportunities, or generate insights. When AI features are used, relevant analytics or configuration data necessary to generate requested insights may be transmitted to trusted AI service providers acting on our behalf. We limit the information shared to what is reasonably necessary to provide the requested functionality and contractually require applicable providers to protect customer information. Our AI providers do not use information we send them to train their models.

2.8 Cookies and Similar Technologies

We use cookies and similar technologies to:

Authenticate users
Maintain login sessions
Remember preferences
Improve website functionality
Analyze usage
Measure product performance
Detect abuse
Protect accounts
Support security features

Additional information is available in our Cookie Policy.

2.9 Advertising Account Data

If you connect a Google Ads or Meta ad account, we receive information from that platform with your permission. Section 6 describes what we receive and how we use it.

3. How We Use Information

We may use information to:

Provide the Services.
Authenticate users.
Manage subscriptions.
Process payments.
Deliver customer support.
Improve product functionality.
Operate A/B testing features.
Generate analytics and reports.
Deliver AI-generated insights requested by users.
Maintain security.
Prevent fraud and abuse.
Detect software defects.
Perform diagnostics.
Respond to legal obligations.
Communicate service announcements.
Send product updates where permitted by law.
Enforce our Terms of Service.
Protect the rights, safety, and property of Bluvia, our customers, and others.

We do not sell personal information in exchange for monetary compensation.

4. How We Share Information

We do not sell your personal information for monetary compensation. We may disclose personal information in the following circumstances:

4.1 Service Providers

We may share information with carefully selected third-party service providers that assist us in operating the Services, including providers of:

Cloud infrastructure and hosting
Content delivery networks (CDNs)
Payment processing
Email delivery
Customer support
Error monitoring
Product analytics
Security monitoring
AI-powered functionality
Professional services such as legal, accounting, and auditing

These providers may process personal information only as necessary to perform services on our behalf and are contractually required to protect such information. Information we receive from Google and Meta is shared only as described in Section 6.

4.2 AI Service Providers

If you use AI-powered features, information necessary to generate requested outputs may be processed by third-party AI providers acting on our behalf. We take reasonable measures to minimize the information transmitted and limit processing to what is necessary to provide the requested functionality. Unless expressly stated otherwise for a particular feature, AI-generated outputs may contain inaccuracies and should be reviewed before making business decisions. Our AI providers do not use information we send them to train their models.

4.3 Business Transfers

If Bluvia is involved in a merger, acquisition, financing, corporate restructuring, bankruptcy, sale of assets, or similar transaction, personal information may be transferred as part of that transaction, subject to applicable legal requirements.

4.4 Legal Requirements

We may disclose information when we reasonably believe disclosure is necessary to:

Comply with applicable law
Respond to lawful governmental requests
Enforce our agreements
Protect our rights or property
Detect or prevent fraud
Investigate security incidents
Protect users or the public from harm

4.5 With Your Direction

We may share information when you instruct us to do so or otherwise provide your consent.

5. Customer Responsibilities

Bluvia provides software that enables customers to collect and analyze visitor data on their own websites.
Customers are responsible for:

Providing legally required privacy notices.
Obtaining consent where required.
Configuring cookies and tracking technologies in compliance with applicable law.
Responding to requests from their own website visitors.
Maintaining appropriate legal bases for processing visitor information.
Disclosing in your store’s privacy and cookie notices that you use ad conversion tracking and share hashed customer information with Google or Meta (if you use our products that support these features).
Complying with Google’s and Meta’s terms for customer data you upload, including Google’s customer data policies and Meta’s Business Tools Terms, if applicable.

Where Bluvia processes visitor information on behalf of customers, Bluvia generally acts as a data processor or service provider, while the customer acts as the data controller or equivalent under applicable law.

6. Google and Meta Advertising Data

This section applies if you connect a Google Ads account or a Meta (Facebook and Instagram) ad account to one of our products. It describes what we receive from Google and Meta, how we use it, and your choices.

6.1 Information We Receive

Google. When you connect, you sign in with Google and grant Bluvia access to your Google Ads accounts. We receive:

A unique identifier for your Google account and your Google account email address, used only to identify the connection and show you which account you are connecting.
The Google Ads accounts you can access, so you can choose which to connect.
For the accounts you connect: the account name, ID, currency and time zone; your campaigns, ad groups, ads, keywords and search terms, with their settings and status; and performance data such as spend, impressions, clicks, conversions and conversion value, including the click identifiers Google assigns to ad clicks.

Meta. When you connect, you grant Bluvia permission to read your ad accounts and, if you turn on conversion sharing or campaign management, to manage them. We receive your Meta user ID and name, the ad accounts you can access, and for the accounts you connect, your campaigns, ad sets and ads with their settings, status and performance data.

6.2 How We Use It

We use this information only to provide the features you see in our plugins, for your own store:

To show your advertising performance and attribute your store’s orders to your ads.
To send the conversions you choose to share back to Google or Meta.
To make the campaign changes you approve or authorize within the limits you set, such as adjusting budgets, pausing campaigns, or creating campaigns and ads.
To generate AI recommendations and ad copy for your account.
To keep your connection working, troubleshoot problems, and protect the security of the Services.

We do not use this information for advertising, we do not sell it, we do not use it to determine creditworthiness or for lending, we do not use it to benefit any other customer, and we do not use it to train AI or machine-learning models.

6.3 Information We Send to Google and Meta

When you turn on conversion sharing, Bluvia sends conversions from your store to the platform you choose: the order ID, value, currency and time; the ad click identifiers from the visit (such as Google’s gclid, gbraid and wbraid, and Meta’s fbclid and the _fbc and _fbp cookies); and, where you enable it, your customer’s email address, phone number, name, city, state, postal code and country. That customer information is hashed with SHA-256 on your store before it leaves your site, so Bluvia and the platforms receive only the hashed values. We do not send IP addresses or browser user agents. When you approve campaign changes or new campaigns, we send those to the platform on your behalf.

6.4 How We Share It

We share information we receive from Google and Meta only:

With the AI provider that generates recommendations and ad copy, which processes it on our behalf and does not use it to train its models.
With the infrastructure providers that host the Services, under confidentiality and security obligations.
With Google or Meta themselves, as described in Section 6.3.
To comply with law, or as part of a merger, acquisition or sale of assets, subject to the same protections described here.

We never transfer it to advertising networks, data brokers, or analytics providers.

6.5 Who at Bluvia Can See It

Bluvia personnel do not view your advertising data except with your permission (for example, when you ask our support team to look at your account), when necessary to investigate a bug, security incident or abuse, or when required by law.

6.6 Storage, Security, and Retention

Access tokens from Google and Meta are encrypted and stored only on Bluvia’s servers. They are never sent to your WordPress site or your browser. We keep hourly and click-level detail for 90 days, daily reporting data and conversion records for 25 months, and hashed customer information for no more than 30 days, then delete it. Your ad account details and campaign settings (names, status and budgets) are kept so your history stays intact, including after you disconnect, until you ask us to delete them (Section 6.7).

6.7 Disconnecting and Deleting Your Data

You can disconnect an account at any time from the Bluvia plugin. When you do, we revoke Bluvia’s access with Google or Meta and delete the stored access tokens. You can also remove Bluvia’s access directly: for Google, at myaccount.google.com/permissions; for Meta, under Settings & privacy → Settings → Business integrations on Facebook. To have your advertising data deleted, email support@bluvia.io and we will delete it within 30 days. See our Data Deletion page.

6.8 Google API Services User Data Policy

Bluvia’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6.9 Your Store's Shoppers

To attribute orders to ads, Bluvia plugins may set one first-party cookie on your store. It records the ad click identifiers and campaign parameters from a shopper’s first and most recent ad visit, expires after 90 days, and is set only after the shopper consents to marketing cookies, or as your store’s consent setting allows. If you let Bluvia manage your Google tag or Meta Pixel, those tags set their own cookies. For this data, Bluvia acts as your service provider and processor (see Section 5).

7. International Data Transfers

Your information may be processed in the United States and other jurisdictions where Bluvia, its affiliates, or service providers operate. These jurisdictions may have privacy laws that differ from those in your country.

Where required by applicable law, we implement appropriate safeguards for international transfers, which may include:

Standard Contractual Clauses approved by relevant authorities.
Contractual commitments with service providers.
Additional organizational and technical safeguards where appropriate.

8. Data Retention

We retain personal information only for as long as reasonably necessary to:

Provide the Services.
Maintain customer accounts.
Fulfill contractual obligations.
Resolve disputes.
Enforce agreements.
Meet legal, accounting, tax, and regulatory requirements.
Improve and secure our Services.

Retention periods vary depending on the nature of the information and applicable legal requirements.
When information is no longer required, we will delete, anonymize, or securely dispose of it unless retention is required by law. Retention periods for Google and Meta advertising data are set out in Section 6.6.

9. Security

We implement administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction.

Examples of these safeguards may include:

Encryption of data in transit using TLS.
Encryption of sensitive data at rest where appropriate.
Role-based access controls.
Authentication mechanisms.
Security monitoring.
Vulnerability management.
Logging and auditing.
Backup and disaster recovery procedures.
Employee confidentiality obligations.

Despite our efforts, no method of transmission or storage can be guaranteed to be completely secure.

10. Your Privacy Rights

Depending on where you live, you may have rights regarding your personal information.

These rights may include:

Access to personal information.
Correction of inaccurate information.
Deletion of personal information.
Restriction of processing.
Objection to processing.
Data portability.
Withdrawal of consent.
Limitation of certain automated decision-making.
The right to lodge a complaint with a supervisory authority.

We may request information necessary to verify your identity before responding to a request.

10.1 California Privacy Rights

If you are a California resident, you may have rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), including the right to:

Know what personal information we collect.
Request deletion of personal information.
Request correction of inaccurate information.
Access categories and sources of personal information.
Understand the purposes for processing.
Learn the categories of third parties receiving information.
Limit certain uses of sensitive personal information where applicable.
Exercise your rights without unlawful discrimination.

We do not knowingly sell personal information or share personal information for cross-context behavioral advertising as those terms are defined under California law.

10.2 European Privacy Rights

Individuals located in the European Economic Area, the United Kingdom, or Switzerland may have rights under applicable privacy laws, including:

Right of access.
Right to rectification.
Right to erasure.
Right to restriction.
Right to object.
Right to data portability.
Right to withdraw consent.
Right to lodge a complaint with a competent supervisory authority.

Requests may be submitted using the contact information provided below.

11. Children's Privacy

The Services are intended for businesses and individuals who are at least the age required to enter into a legally binding agreement in their jurisdiction. We do not knowingly collect personal information directly from children under the age of 13, or a higher minimum age where required by applicable law. If we become aware that we have collected personal information from a child in violation of applicable law, we will take reasonable steps to delete that information. Parents or guardians who believe a child has provided personal information may contact us using the information below.

12. Third-Party Services

The Services may contain links to or integrate with third-party products and services.
These third parties operate under their own privacy policies and terms. We are not responsible for the privacy practices, security, or content of third-party services.
We encourage you to review the privacy policies of any third-party services you use in connection with Bluvia.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our Services, legal requirements, or business practices.
When material changes are made, we will update the “Effective Date” at the top of this Privacy Policy and may provide additional notice where required by law.
Your continued use of the Services after an updated Privacy Policy becomes effective constitutes your acknowledgment of the revised policy.

14. Contact Us

If you have questions, requests, or concerns regarding this Privacy Policy or our privacy practices, please contact us:
Email: support@bluvia.io
Website: https://bluvia.io/

15. Governing Law

This Privacy Policy shall be governed by and interpreted in accordance with the laws of the United States, without regard to conflict of law principles, except where mandatory privacy laws provide otherwise.
Nothing in this Privacy Policy limits any rights that cannot be waived under applicable privacy legislation.

16. Additional State and International Rights

Residents of certain U.S. states and individuals located in jurisdictions with comprehensive privacy legislation may have additional rights under applicable law.
Bluvia will honor applicable legal rights to the extent required by the laws governing the processing of personal information.
Individuals wishing to exercise applicable privacy rights may contact us using the contact information provided above. We will respond within the timeframes required by applicable law.

17. Do Not Track

Some web browsers offer a “Do Not Track” (“DNT”) preference.
Because there is no universally accepted standard for responding to DNT signals, the Services currently do not respond differently when such signals are received unless required by applicable law.
Where legally required, users may manage cookie preferences through available consent mechanisms.

18. Automated Processing

Certain features of the Services, including analytics, experimentation, reporting, and AI-assisted insights, may involve automated processing of information.
These features are intended to assist customers in understanding website performance and do not produce legal or similarly significant decisions about individuals without meaningful human involvement.
Customers remain responsible for reviewing AI-generated recommendations before acting upon them.

19. Security Incident Response

Bluvia maintains administrative, technical, and organizational measures designed to detect, investigate, and respond to security incidents.
If we determine that a security incident involving personal information requires notification under applicable law, we will notify affected customers or individuals within the timeframes required by law.

20. Data Minimization

We endeavor to collect and process only the personal information reasonably necessary to provide, maintain, secure, and improve the Services. Where practical, information may be anonymized, aggregated, or de-identified for analytics, research, product development, security, and operational purposes. This does not apply to information we receive from Google or Meta, which we use only as described in Section 6.

21. Contact for Privacy Requests

Privacy requests may be submitted to:
Email: support@bluvia.io
Please include sufficient information for us to verify your identity and understand the nature of your request before we process it.

22. Severability

If any provision of this Privacy Policy is found to be invalid, illegal, or unenforceable, the remaining provisions shall remain in full force and effect to the maximum extent permitted by law.

23. Entire Privacy Policy

This Privacy Policy constitutes the complete privacy notice governing the collection, use, disclosure, and protection of personal information by Bluvia in connection with the Services, unless supplemented by a separate agreement, Data Processing Agreement, or product-specific privacy notice.