Privacy Policy

• Account data — name, email address, password hash, phone, role (contractor, supplier or both), and preferences.
• Business & verification data — legal entity name, DBA, tax ID (e.g. EIN), license number, state and expiry, business address, website, contact person, and any documents you upload for verification.
• Commercial data — projects, material lists, quantities, units, catalogs, prices, stock levels, quotes, orders, awarded amounts, ratings and reviews.
• Location data — jobsite and warehouse addresses, plus coordinates derived from them, used to compute delivery radius matches. We do not collect continuous device GPS.
• Files — spreadsheets, PDFs and other documents you upload, and text extracted from them to build material and catalog lines.
• Technical data — IP address, browser and device information, timestamps, pages viewed, and error diagnostics.
• Communications — email delivery metadata (sent, delivered, bounced, unsubscribed) and support messages.

• To create and secure your account and authenticate you.
• To operate the core marketplace: publish RFQs, match suppliers by category and delivery radius, deliver quotes, generate orders.
• To verify businesses and reduce fraud, impersonation and abuse.
• To send transactional email you need — confirmations, password resets, RFQ invitations, quote and order notifications.
• To provide support, debug failures and monitor availability and performance.
• To produce aggregated, de-identified statistics about marketplace activity. These never identify you or expose your pricing.
• To comply with legal, tax and accounting obligations, and to enforce our Terms.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

Where GDPR or UK GDPR applies, we rely on: performance of a contract (running your account and transactions), legitimate interests (security, fraud prevention, product improvement), legal obligation (tax, records, lawful requests), and consent where we ask for it (for example optional marketing). You may withdraw consent at any time.

• Suppliers you invite to an RFQ can see the project material list, quantities, units, notes and the delivery city or jobsite address needed to quote and deliver.
• Contractors can see published supplier profiles: business name, description, categories, service area, city/state, ratings, response metrics and verification status.
• When you award a quote, the counterparty receives the contact and address details needed to fulfill the order.
• Verification documents and tax IDs are never shown to other users. They are visible only to authorized Bluezupply reviewers.
• Other suppliers cannot see competing quotes or prices.

We use vetted processors bound by contract to use data only on our instructions: cloud hosting, managed database, authentication and file storage; Google Maps Platform for address autocomplete and geocoding; a transactional email provider; and error monitoring and analytics. We also disclose data when legally required, to protect rights and safety, or in connection with a merger or acquisition (with notice).

Our infrastructure and providers may process data in the United States and other countries. Where required, transfers rely on Standard Contractual Clauses or other lawful transfer mechanisms.

• Account, project, quote and order records: for the life of your account and afterwards as needed for legal, tax, accounting and dispute purposes.
• Verification documents: retained while your verification is active and for the period required by anti-fraud and record-keeping obligations, then deleted.
• Email delivery logs and suppression lists: kept as needed to protect deliverability.
• Technical logs: short retention, typically weeks to months.

Data is encrypted in transit (TLS) and at rest by our infrastructure provider. Access is restricted by row-level security policies so users reach only their own records, uploaded documents live in private storage requiring authorization, and administrative functions are role-gated. Passwords are hashed and never visible to us. No system is perfectly secure; report a suspected issue to the address below.

Depending on where you live, you may request access to your data, correction, deletion, a portable copy, restriction or objection to certain processing, and withdrawal of consent. Residents of California and similar jurisdictions may also request disclosure of categories collected and shared, and are protected from discrimination for exercising these rights. Email privacy@bluezupply.com and we will respond within the period required by law. We may need to verify your identity first, and some records must be retained for legal reasons even after a deletion request.

Transactional email — confirmations, password resets, RFQ invitations, quote and order notifications — is part of the service and cannot be turned off while your account is active. Any non-essential email includes an unsubscribe link, and unsubscribes are honored through our suppression list.

We use strictly necessary cookies and local storage to keep you signed in and secure your session, and limited product analytics to understand feature usage. We do not use advertising or cross-site tracking cookies. Blocking essential cookies will prevent sign-in.

We use automated matching (category and delivery-radius distance calculations) and AI-assisted extraction to turn uploaded files into material and catalog lines. These are aids, not decisions about you: results are always shown for your review and can be edited or deleted, and no automated decision with legal effect is made about you.

We may update this Policy. Material changes will be announced by email or in-product notice before they take effect, and the effective date above will change.

Privacy questions or requests: privacy@bluezupply.com. Security reports: security@bluezupply.com.