Privacy Policy

Blasight is a financial management platform developed and operated by Bladenox Solutions, based in Brazil. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use Blasight.

If you have questions, contact us at contact@blasight.com.

Data Protection Officer (Encarregado de Dados under LGPD): Eduardo Freitas — contact@bladenox.com. This is the designated point of contact for data protection inquiries and requests from users and regulatory authorities.

We collect the following categories of data:

• Account data: email address, password (hashed), organization name.
• Financial data: transactions, budgets, subscriptions, cost centers, forecasts, and activity logs you generate on the platform. This data belongs to you and your organization.
• Usage data: pages visited, features used, actions performed, and plan usage metrics (transactions consumed, budgets created, etc.) — collected to operate the service and enforce plan limits.
• Analytics data: aggregated, anonymized usage statistics via Google Analytics — only if you consent.
• Technical data: IP address, browser type, and session cookies required for authentication.

We process your data on the following legal bases: (a) performance of a contract — to provide the service you signed up for; (b) legitimate interest — to improve the platform and send marketing to existing users; (c) consent — for analytics cookies and any processing you explicitly opt in to; (d) legal obligation — where retention or disclosure is required by law.

• To provide and operate the Blasight platform. (Legal basis: contract)
• To authenticate you and secure your account (including optional two-factor authentication). (Legal basis: contract)
• To enforce plan limits (transactions per month, budgets, cost centers, subscriptions, and team members). (Legal basis: contract)
• To send transactional emails (e.g. password reset). (Legal basis: contract)
• To improve the platform through aggregated, anonymized analytics (only with your consent). (Legal basis: consent)
• To send you commercial emails about Blasight products, features, and updates from Bladenox Solutions. You may opt out at any time via the unsubscribe link in any marketing email. (Legal basis: legitimate interest — existing customer relationship)
• We do not sell your data. We do not use your financial data for advertising.

Your data is stored on Supabase infrastructure (PostgreSQL), hosted on secure cloud servers. We apply row-level security, encrypted connections (TLS), and access controls to protect your data. Financial data is accessible only to members of your organization.

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant data protection authority (ANPD in Brazil, or the applicable supervisory authority in the EU) within the timeframes required by law, and will inform affected users without undue delay.

We use the following cookies:

• Essential cookies: required for authentication, session management, and interface preferences (such as language). Cannot be disabled.
• Analytics cookies (Google Analytics): used to understand platform usage. Only set with your explicit consent. IP addresses are anonymized.

You can withdraw your consent at any time by clearing your browser cookies.

Under LGPD (Brazil), GDPR (EU), and CCPA (California), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your account and data.
• Export your data in a portable format.
• Withdraw consent for analytics at any time.

To exercise any of these rights, contact privacy@bladenox.com.

Blasight uses the following third-party services, some of which are based outside Brazil (United States). For international transfers of personal data, we rely on contractual safeguards with our processors. For EU users, transfers are covered by Standard Contractual Clauses (SCCs) where required under GDPR. By using Blasight, you acknowledge that your data may be processed in the countries where our service providers operate:

• Supabase — database and authentication infrastructure.
• Vercel — application hosting.
• Google Analytics — usage analytics (consent-gated).
• Zoho Mail — transactional email delivery.
• Stripe — payment processing. Your payment details (card number, billing address) are collected and stored directly by Stripe and never touch our servers. Stripe's privacy policy applies to payment data — see stripe.com/privacy. stripe.com/privacy.
• OpenAI (ChatGPT) — AI CFO feature (prompts and financial summaries are processed; OpenAI's data usage policy applies — see openai.com/policies/privacy-policy).

We retain your data for as long as your account is active. If you delete your account, your data is deleted within 30 days, except where retention is required by law.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-app notice. Continued use of Blasight after changes constitutes acceptance of the updated policy.

This Privacy Policy is governed by Brazilian law (LGPD — Lei nº 13.709/2018). For users in the EU, GDPR also applies. For users in California, CCPA also applies.