Privacy Policy

This Privacy Policy explains how Modern Business Solutions Ltd, a company incorporated in the Cayman Islands (operating as BlueLedger; "we", "us", or "our"), collects, uses, shares, and safeguards personal data when you use the BlueLedger platform, websites, and related services (the "Service").

For the purposes of the Cayman Islands Data Protection Act (2021 Revision) (the "DPA") and other applicable data protection laws, we act as a data controller with respect to personal data about your account, billing, and interactions with our marketing; and as a data processor with respect to personal data that you or your organization upload into the Service as Customer Data (for example, your customers' and vendors' contact details). Your organization is the data controller of such Customer Data.

We collect the following categories of personal data:

We do not knowingly collect personal data from children under 18. If you believe we have, contact us and we will delete it.

Under the DPA, we must rely on a lawful basis for each use of personal data. Our bases are:

We do not use your personal data for automated decision-making that produces legal or similarly significant effects without human review. Receipt OCR, transaction categorization, and similar suggestions are informational and subject to your review before posting.

We share personal data only as described in this policy:

• Sub-processors. We use vetted service providers to operate the Service (cloud hosting, email delivery, payment processing, authentication, AI receipt OCR, customer support tooling, and analytics). They process personal data only on our documented instructions and under contractual confidentiality and security obligations. Current sub-processors are listed at Section 9 below.
• Within your organization. Other team members you invite can see Customer Data and activity within your organization according to the role-based access you configure.
• Legal and regulatory. We may disclose personal data where required by law, court order, regulatory request, or to protect our rights, safety, or property, or those of our users or the public.
• Corporate transactions. In the event of a merger, acquisition, financing, or sale of assets, personal data may be transferred to the successor or acquirer, subject to equivalent protections.
• With your consent or on your instruction. For example, when you enable an integration with a third-party product.

We do not sell personal data. We do not share personal data with third parties for their own marketing without your explicit consent.

The Service is operated globally and personal data may be transferred to, stored in, and processed in countries other than the Cayman Islands, including the United States, the European Union, and the United Kingdom. When we transfer personal data out of the Cayman Islands, we ensure an adequate level of protection consistent with Schedule 4 of the DPA, for example by:

• Transferring to jurisdictions recognized by the Cayman Islands Ombudsman as offering adequate protection;
• Entering into contractual safeguards (such as standard contractual clauses modelled on GDPR SCCs) with sub-processors;
• Relying on your explicit consent, on contractual necessity, or on another derogation permitted by the DPA.

You can request a copy of the safeguards we use by emailing privacy@blueledger.io.

We retain personal data only as long as necessary for the purposes described in this policy, or as required by law. Typical retention periods are:

On verified deletion requests, we will erase personal data without undue delay, subject to limited retention for legal, regulatory, or legitimate interest reasons (which we will describe on request).

If you are a data subject whose personal data we process, you have the following rights under the DPA:

• The right to be informed — to know how your data is used (this policy).
• The right of access — to obtain confirmation of processing and a copy of your personal data.
• The right to rectification — to have inaccurate data corrected.
• The right to erasure — to request deletion where processing has no lawful basis, consent is withdrawn, or the data is no longer needed.
• The right to stop or restrict processing — including for direct marketing, on request (we will comply within 21 days).
• The right to data portability — to receive your data in a structured, commonly used, machine-readable format (CSV exports are available in-app).
• The right to object to automated decisions — to request human review of any significant decision made solely by automated means.
• The right to complain — to the Cayman Islands Ombudsman (see Section 11).

To exercise any right, email privacy@blueledger.io. We may need to verify your identity before acting on a request. We will respond without undue delay and, where the DPA imposes a specific timeframe, within that period.

Where we act as a processor of Customer Data on behalf of your organization, requests should normally be directed to that organization (the controller), which can then instruct us.

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction, including:

• Encryption in transit (TLS) and at rest for sensitive data stores;
• Salted and hashed passwords (bcrypt);
• HttpOnly, Secure, SameSite cookies for session authentication;
• Role-based access control (RBAC) within each organization;
• Tenant isolation of Customer Data at the application layer;
• Least-privilege access for engineering and support staff, with logging;
• Regular backups, patching, and monitoring for anomalous activity;
• Periodic review of sub-processors' security posture.

No system is perfectly secure. You are responsible for using strong, unique passwords, enabling multi-factor authentication where available, and keeping your devices secure.

We currently use (or may use) the following categories of sub-processors. We update this list when material changes occur.

In accordance with the DPA, we will notify the Cayman Islands Ombudsman of any personal data breach that is reasonably likely to result in damage, distress, or significant harm to an individual within 5 days of becoming aware of it, and will notify affected individuals without undue delay where legally required. We maintain internal procedures for detecting, escalating, and responding to security incidents.

If you have a concern about our handling of your personal data, please contact us first at privacy@blueledger.io. If you are not satisfied, you have the right to lodge a complaint with the Cayman Islands supervisory authority:

If you are located elsewhere, you may also contact your local data protection authority.

We use a small number of cookies, strictly for:

• Authentication — httpOnly session and refresh cookies, without which the Service cannot function.
• Security — CSRF and rate-limit tokens.
• Preferences — remembering your selected organization.

We do not use advertising cookies and we do not share personal data with ad networks. You can disable cookies in your browser, but the Service will not function without essential cookies.

We may update this Privacy Policy from time to time. If the changes are material, we will notify you via email or through the Service before the changes take effect. We encourage you to review this policy periodically. The "Effective date" at the top reflects the current version.

For any question about this policy or our privacy practices: