Privacy Policy

1. Overview & Accountability

BlueParadise is operated from Toronto, Ontario, Canada. This Privacy Policy explains what personal information we collect, why we use it, when it is shared, and the choices available to users, signers, and card recipients.

BlueParadise is accountable for personal information under its control and does not sell personal information.

2. Information We Collect

Depending on how you use BlueParadise, we may collect:

• Account information: name, email address, password hash, account dates, and authentication status
• Card content: recipient and sender names, occasion details, prompts, generated text and artwork, colour and style choices, delivery notes, and scheduled delivery information
• Signer content: signer name, message, emoji, and selected GIF or media
• Recipient information: email addresses entered by card creators for invitations or delivery
• Birthday calendar information: names, relationship labels, birthday dates, reminder choices, and timezone
• Uploaded images: optional recipient photos added by a card creator
• Technical and security information: IP address, browser and device details, timestamps, session cookies, login and password-reset attempts, error logs, and anti-abuse results
• Signature media: validated handwritten stroke coordinates and optional voice recordings you choose to attach. Microphone access begins only after you press Record and grant permission; recordings are uploaded when you submit your signature. Shared card links allow playback by anyone who receives the link.
• Business campaigns: organiser account, company branding, recipient names and emails, personalised card copy, campaign quote, delivery status and sender-specific email opt-outs.
• VIP permissions: feature-specific grants, expiry dates, administrator references and grant reasons.
• Purchase records: account and card references, product, amount, currency, payment environment, PayPal order/capture references, payment and refund status, timestamps, and receipt delivery status. We do not store payment-card numbers, card security codes, bank account details or PayPal passwords.
• Usage information: page and card views, feature interactions, referral information, and general analytics data

We receive information directly from you, from another person who creates or shares a card with you, and automatically when you use the service.

3. Why We Use Information

We use personal information to:

• Create and manage accounts, authenticate users, and reset passwords
• Create, save, customize, sign, publish, share, schedule, and deliver cards
• Generate AI-assisted artwork, wording, and creative suggestions
• Display card content to people who receive the relevant link
• Send transactional emails requested by a user, such as card delivery and password-reset messages
• Provide support, troubleshoot errors, measure performance, and improve BlueParadise
• Detect spam, fraud, abuse, unauthorized access, and other security threats
• Verify payments, unlock purchased features, provide receipts and transaction summaries, reconcile refunds, and investigate payment issues
• Comply with legal obligations and enforce our Terms

We collect, use, and disclose only the information reasonably needed for these purposes, with consent or another lawful basis where applicable.

4. AI Processing

If an authorized user chooses AI Animate through a paid pass or feature-specific VIP access, the selected artwork image and a motion instruction are sent to Google Veo to create a short video. This animation request does not include account details, delivery email addresses, signatures, or an optional recipient portrait. Completed animation files may be saved and shown to people with the card link.

Card prompts, occasion details, selected preferences, and other relevant content may be sent to Google Gemini to generate artwork or copy. Do not include confidential, highly sensitive, or regulated information in an AI prompt.

Generated output is returned to BlueParadise and may be saved with the card. Third-party AI processing is also subject to the provider’s applicable terms and privacy practices.

5. Card Links & Visibility

Signing, preview, and final-card links are designed to be shared. Anyone who receives a working link may be able to view the related card and, where enabled, add a signature. Treat these links like invitations and share them only with the intended group.

Card creators and signers should avoid adding information they would not want other link holders to see.

Tracked signing invitations store the name and email supplied by the organizer, delivery status, opt-out status, and whether the personal link was used to sign. Only the card owner can view the invitation list. Email footers let invitees stop further emails for that card; a message already being sent may still arrive.

Saved templates keep design settings and selected artwork, which may contain details embedded in an image. Private thank-you notes are visible to the card owner and the browser session that submitted them. People with a finalized card link can submit thank-you replies; identities on public replies are not verified.

6. Cookies & Analytics

BlueParadise uses essential session cookies to keep users signed in and operate account features. We also use Matomo analytics hosted at stats.bpnet.ca to understand site use and performance. Final-card views are counted with a privacy-preserving hashed visitor token and deduplicated per card and day.

You can restrict cookies through your browser, but blocking essential cookies may prevent sign-in and other account functions from working.

7. Service Providers & Disclosure

We may disclose limited information to service providers that help operate BlueParadise, including:

• Google Gemini and Veo for AI-generated copy, artwork and animation
• PayPal for checkout, payment verification and refund reconciliation. The payment request includes the amount, currency, product description, purchase reference and seller details; it does not include card artwork, signatures or the recipient portrait. PayPal collects payment and buyer information directly under its Privacy Statement.
• Google Fonts to load the decorative typefaces used on cards
• Cloudflare Turnstile for bot and abuse prevention
• GIF and media-search providers, including GIPHY and KLIPY, when those features are used
• Hosting, database, analytics, and email-delivery providers

We may also disclose information when required by law, to protect users or the service, to investigate misuse, or as part of a business transfer subject to appropriate protections.

Some providers may process information outside Canada, where it may be subject to the laws of the country in which it is processed.

8. Security

We use reasonable administrative and technical safeguards appropriate to the information we hold. These include hashed passwords, protected session cookies, time-limited single-use password-reset tokens, anti-bot checks, rate limiting, and encrypted connections where supported.

No online service can guarantee absolute security. If a breach creates a real risk of significant harm, we will notify affected individuals and regulators as required by applicable law.

9. Retention

Unattached voice uploads expire after 24 hours and are removed by the scheduled maintenance task. Attached recordings remain with the card. Before signing closes, contributors can remove their own recording through their private edit link. Business email preference links let recipients stop future business card emails from that sender.

We keep personal information only as long as reasonably needed to provide the service, maintain security and business records, meet legal obligations, resolve disputes, and enforce agreements.

Purchase and refund records may be retained after account or card deletion where needed for accounting, fraud prevention, disputes or legal obligations. Access to transaction summaries is limited to the purchasing account and authorized administrators. Payment diagnostics retain selected error codes and references rather than raw provider responses or credentials.

Password-reset links expire after one hour and become unusable after a successful reset. Card content may remain available until it is deleted or a deletion request is completed, subject to backups and legal requirements.

10. Your Choices & Rights

Subject to applicable law, you may ask to access, correct, or delete personal information BlueParadise holds about you, withdraw consent for optional uses, or ask how information has been used or disclosed.

Some information may need to be retained for security, legal, fraud-prevention, or record-keeping purposes. We may need to verify your identity before completing a request.

11. Information About Other People

If you provide another person’s name, email, photo, message, or other personal information, you confirm that you are authorized to do so and that your use is appropriate for the card and recipient.

12. Children’s Privacy

BlueParadise is not directed to children who are not legally able to consent to the collection and use of their information. A parent or guardian should supervise use by a minor where required by law.

13. Changes to This Policy

We may update this Policy when our service or legal obligations change. The “Last updated” date identifies the current version. Material changes will be communicated through the service where reasonably practical.

14. Privacy Contact & Complaints

For privacy questions, access or correction requests, deletion requests, or complaints, email hello@blueparadise.ca and include “Privacy Request” in the subject line.

If we cannot resolve a privacy concern, you may contact the Office of the Privacy Commissioner of Canada.