Privacy Policy
In short: we collect only what we need to run BlueManager, store it on servers in Johannesburg, South Africa, never sell it, and don't use advertising trackers in the app. The information you keep about your own clients belongs to you; we only look after it for you.
1. Who is responsible
BlueManager is provided by Schalk Pieter van Staden, trading as Project Bluecollar, Pretoria, Gauteng, South Africa. We comply with the Protection of Personal Information Act 4 of 2013 (POPIA).
Information Officer: Schalk Pieter van Staden · [email protected] · 061 593 9447
2. Two kinds of information
- Account information about the businesses that use BlueManager and their users. For this we are the “responsible party”.
- Customer Data: the information a business keeps in BlueManager about its own clients, jobs, quotes and invoices. For this the business is the responsible party and we are its “operator”: we process it only on that business's instructions, to provide the Service. If you are a client of a business that uses BlueManager and want to access or correct your information, please contact that business first; we'll help them respond.
3. What we collect
- When you sign up: company name, type of business, your name, email, mobile number and password (stored only as a secure, one-way hash).
- Company details you add: address, registration and VAT numbers, banking details for your invoices, logo, and your team members' names, usernames, emails and phone numbers.
- Billing: your plan, payment dates, amounts and PayFast payment references. Card details are entered on PayFast's site and never reach us.
- Technical: IP address and basic request logs, kept to keep the Service secure (for example to block repeated wrong passwords) and to fix problems.
- Customer Data that you and your team enter (see section 2).
4. How we use it
- To provide, secure and support BlueManager, including logging in, backups and fixing errors.
- To bill you and send receipts, invoices, trial and payment reminders, and important service notices.
- To answer your questions and support requests.
- To meet legal and tax obligations.
We don't sell personal information, don't use it for advertising, and don't use Customer Data for any purpose of our own.
5. Where it is stored
BlueManager runs on Oracle Cloud Infrastructure servers in Johannesburg, South Africa, with daily backups on the same servers. An additional off-site backup copy is stored on Google Drive, which may be outside South Africa; it is encrypted on our server before it leaves, so Google cannot read it, and only we hold the key. Each company's data is kept in its own separate database. Traffic to the app passes through Cloudflare's network for security and speed, which may handle it on servers outside South Africa while it is in transit; Cloudflare is bound by data-protection terms that give protection comparable to POPIA.
6. Who we share it with
Only with service providers we need to run BlueManager, under confidentiality and security obligations:
- Oracle Cloud Infrastructure — hosting (Johannesburg).
- Cloudflare — secure connection to the app, protection against attacks, and the “not a robot” check on the sign-up form.
- PayFast — subscription payments.
- Google Drive — encrypted off-site backups only (Google cannot read the contents).
- Our email delivery provider — sending sign-up, billing and system emails.
- Providers you choose — if you connect your own mailbox or SMS account, messages you send go through those providers.
- Authorities — only when the law requires it.
7. Cookies
The app uses two small cookies that it needs to work: one keeps you logged in, and one remembers your company ID on that device. We don't use advertising or analytics cookies in the app.
8. How long we keep it
- Account and Customer Data: while your account is open, then 90 days after it closes or stops being paid for (so you can return or download an export), then deleted. We email the account owner 14 days before. Copies in our encrypted backups expire on their own: daily backups within 30 days, and monthly archive copies within 12 months.
- Billing records: 5 years, as required for tax purposes.
- Security logs: up to 12 months, then deleted automatically.
9. Security
We use encrypted connections (HTTPS), securely hashed passwords, separate databases per company, protection against repeated login attempts, two-step login for our admin access, browser security protections and daily backups. No system is perfectly secure; if a breach ever affects your information, we'll notify you and the Information Regulator as POPIA requires.
10. Your rights
You may ask to see the personal information we hold about you, ask us to correct or delete it, object to how we process it, or withdraw consent where we rely on it. Email [email protected]; we'll respond within 30 days. If you're not satisfied, you may complain to the Information Regulator (South Africa): inforegulator.org.za.
11. Changes
If we change this policy in a way that matters, we'll update the date above and email account owners before the change takes effect.