1. Who is responsible
BluTek Media LLC, based in Florida, United States, is responsible for personal information we collect to operate the BluKavantUI website, accounts, licensing and support. This policy covers those services. It does not replace the privacy policies of third-party services or of applications customers build using our components.
Use our privacy contact form for questions or requests. You do not need a BluKavantUI account to contact us.
2. Information we collect
- Account details: your name, email address and phone number, business name if provided, password hash, email-verification status and account security records. We do not store your password as plain text.
- OutSystems installation requests: the package and release you request, destination environment, encrypted Activation Code, processing status, delivery files and audit history. Authorized administrators use the code to request IPP processing from OutSystems. Request notifications go to our monitored business inbox without the Activation Code.
- Orders and licenses: your organization and application details, developer count, license scope, order and subscription identifiers, payment status, invoice information and license records.
- Payment information: our payment provider collects payment details. We may receive billing details, tax information and limited payment-method information such as card brand, expiry and last four digits. Full payment-card numbers and security codes are handled by the payment provider, rather than stored in our account database.
- Messages: your name, email, request category, optional order reference and the message you submit, together with follow-up correspondence.
- Technical information: IP addresses, browser or device information, requested URLs, timestamps, errors and security events in server or service logs. Abuse controls may use keyed hashes of IP addresses and email addresses.
3. How and why we use information
We use information to create and secure accounts, verify email addresses, recover account access, fulfill orders, issue licenses, manage billing and renewals, deliver service emails, answer requests, prevent abuse and meet legal or accounting obligations.
Where a legal basis is required, we rely on performing our contract with you or taking requested steps before a contract; our legitimate interests in operating, securing and supporting the service; legal obligations; and consent where we ask for it. You can withdraw consent for a consent-based activity without affecting processing that already occurred or processing based on another lawful basis. Service and security messages are necessary to operate your account and are separate from marketing.
4. License status checks
Standard Pro components send a license ID, a SHA-256 fingerprint of the customer key and a random request challenge to our license service. The service returns a signed activation or revocation response. The runtime does not send the full license key, application records, application source, end-user account details or component usage data in that request. Network requests expose technical information such as the connecting IP address to our hosting service; abuse controls use a keyed IP hash.
The application browser caches the signed result and the last observed time in local storage for activation and outage handling. Clearing that storage requires a fresh OutSystems activation. The checks protect license entitlements and administer refunds and revocations. Signed Enterprise offline entitlements do not make these outbound status requests. See the Terms of Service for the seven-day standard OutSystems activation window and firewall requirements.
5. Cookies, browser storage and demos
We use an essential session cookie to maintain sign-in, secure forms and associate temporary demo uploads with your session. Browser storage can remember appearance preferences, demo content and example settings. Clearing site data removes locally saved preferences and demo work and may sign you out.
Some examples keep entered data in your browser; other actions send requests to our server or an explicitly linked service. In the form attachment demo, uploaded files and metadata are stored temporarily on our server, restricted to the originating session and scheduled to expire after two hours. Demo uploads are not a permanent storage service. Avoid using real customer, confidential or sensitive information in demonstrations.
We do not currently use third-party advertising trackers or third-party audience analytics on this website. Payment forms, externally hosted examples, media and linked services may process technical information under their own policies when loaded or used. We will update this policy if these practices change and request consent where required.
6. Service providers and disclosures
We use DigitalOcean for hosting and encrypted off-server backups, Amazon Web Services SES for transactional and contact email, and payment providers for checkout and billing. Contact-form submissions are delivered to our monitored business inbox. For installation requests, we submit the destination Activation Code and native package to OutSystems for IPP processing at your request. These providers process information needed to perform their services.
Optional Community donations are processed by Stripe; see Stripe’s Privacy Policy. Pro purchases are processed by Paddle, which handles transaction data as merchant of record under Paddle’s Privacy Policy. Payment details are entered in the relevant provider’s secure checkout.
We may disclose information when reasonably necessary to comply with law, respond to valid legal requests, protect rights or security, or complete a business transfer subject to appropriate confidentiality protections. We do not sell personal information or share it for cross-context behavioral advertising.
7. Retention and security
We keep personal information for as long as reasonably needed for the purposes described here, including providing your account and continuing license access, resolving support requests or disputes, preventing fraud, and meeting applicable recordkeeping duties. Retention depends on the type of record and the reason it is needed. Deleting an account does not necessarily delete records we must retain for those purposes.
Queued email payloads are encrypted and removed from the queue after successful sending or expiration; delivered correspondence remains in our business email records as needed for support and recordkeeping. Deleted data may remain in protected backups until those backups expire under our rotation schedule.
We use measures including encrypted connections, password hashing, access controls and encrypted backups. No storage or transmission method is completely secure. Keep your account credentials private and report suspected security problems through our contact form.
8. International processing
We operate from the United States. Our hosting, email, payment and other service providers may process information in the United States and other countries with privacy laws different from those where you live. Applicable legal requirements for international transfers still apply. Contact us if you need details about a particular provider or transfer.
9. Your choices and privacy rights
Depending on the law that applies to you, you may have rights to access, correct, delete or receive a portable copy of personal information, restrict or object to processing, and withdraw consent where processing relies on consent. You may also have a right to complain to your local privacy regulator. We will not discriminate against you for exercising applicable privacy rights.
Submit a request using the privacy contact form. We may need to verify your identity and authority before disclosing or changing information, and legal exceptions may apply. Do not send identity documents, passwords or complete payment details in the initial message. We will explain any necessary verification and respond within applicable legal time limits. You may also contact a payment provider directly for information it controls.
10. Children and policy changes
Our services are intended for adult developers and organizations and are not directed to children under 16. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.
We may update this policy when our services or practices change. We will publish the revised date and provide additional notice of material changes where required. Contact BluTek Media LLC with questions.