Privacy policy

BLYPP.CO - Information Services ("Blypp", "we", "us"), a sole proprietorship registered in the Philippines, operates the Blypp live chat + AI customer support platform at blypp.co. We are the data controller for the personal data described below.

From merchants (people who sign up to use Blypp): name, email, password hash, organization name, billing and contact details for manual invoicing, and any data you provide while configuring the product (welcome messages, KB articles, brand colors, etc.).

From visitors on merchants' sites who chat through the widget: messages typed into the chat, optional name/email/phone provided in the pre-chat form, the page URL they were on, an anonymous visitor ID stored in their browser's localStorage, IP address (for spam + ban enforcement), and approximate location derived from IP.

• To deliver the service (route messages, run the AI, persist conversations).
• To bill merchants and prevent abuse.
• To send transactional email (account, billing, invites, escalations).
• To improve the product (aggregate, anonymized usage analytics).
• To comply with legal obligations.

We do not sell personal data, and we do not train AI models on your or your visitors' conversations.

Sub-processors who help us deliver the service:

• Supabase: database + auth (Sydney region by default).
• Self-managed VPS: we host the application on our own virtual private server.
• Google Cloud (Gemini): AI model inference for chat + email replies.
• Resend: transactional email.

Each sub-processor has its own DPA. We use them only to provide the service and they don't process your data for their own purposes.

When a visitor chats with a Blypp widget on a merchant's site, the merchant is the controller of that conversation; we are the processor. Each merchant's privacy notice should also disclose Blypp as a sub-processor.

If a merchant chooses to connect their Google (Gmail) account, Blypp requests permission to read and send email in that mailbox and to read the account's email address. The Google API scopes used are gmail.modify, gmail.send, and userinfo.email. This connection is optional and used only to operate the merchant's shared support inbox.

What we access: incoming and existing messages in the connected mailbox, and the ability to send replies from it.

Why: to sync the merchant's support email into the Blypp inbox, let the AI triage messages and draft replies, and send the replies the merchant or their authorized AI assistant approves. We request only the access needed to run that inbox.

Storage: email content synced into Blypp is stored in our database (Sydney, encrypted at rest and in transit) under the merchant's organization and follows the same retention as other conversation data. OAuth tokens are stored encrypted and used only to call the Gmail API on the merchant's behalf.

AI + sharing: to triage and draft replies, email content is sent to Google Gemini for inference. Per Google's paid Gemini API terms it is not used to train or improve Google's models, and we never enable any training option. We do not sell this data, and we never use it for advertising.

Limited Use: Blypp's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Concretely: we use Google user data only to provide and improve the support-inbox features the merchant connected it for; we do not transfer it to others except as needed to provide those features, comply with law, or as part of a merger or acquisition with notice to the merchant; we do not use it for advertising; and no human reads it except with the merchant's consent, for security or abuse investigations, to comply with law, or on aggregated / anonymized data.

Revoking access: a merchant can disconnect Gmail at any time in Settings → Integrations, or revoke Blypp's access directly at myaccount.google.com. On disconnect we stop accessing the mailbox; any email already synced into Blypp is deleted on request per "Your rights" below.

Chat messages are sent to Google Gemini for inference. Per Google's Gemini API terms, prompts and responses sent through their paid API tier are not used to improve their models. We never enable any opt-in training option.

Data is stored in the Supabase Sydney region (AWS ap-southeast-2). This is where the data is hosted; Blypp itself is operated from the Philippines. Encrypted at rest (AES-256) and in transit (TLS 1.2+).

Retention: account data is kept while your account is active and for 90 days after deletion. Conversation transcripts are retained for as long as the merchant's plan allows (default 12 months on Pro, 30 days on Free).

Under the Philippine Data Privacy Act of 2012 (and the GDPR / CCPA where they apply to you), you can request: a copy of your data, correction of incorrect data, deletion, restriction of processing, objection to processing, and data portability. Email [email protected] and we will respond within 30 days.

Blypp is not intended for users under 16. We do not knowingly collect data from children. If you believe we have, contact [email protected] and we will delete it.

We will email merchants at least 30 days before any material change to this policy.

Privacy questions: [email protected]. Mailing address on the contact page.