Privacy Policy

Last updated: October 12, 2026

Overview

This Privacy Policy explains how Blue Pointe IT ("we", "us", "our") collects, uses, stores, and shares information when you use our website (bluepointeit.com) and the IT consulting, social media management, and email-newsletter services we provide to our clients (collectively, the "Services").

We treat client and end-user data as a responsibility, not an asset. We collect the minimum information required to operate, never sell personal data, and delete it on request.

Information we collect

Information you give us directly

  • Contact details when you fill out a form on our website or contact us by email or phone — typically name, email address, phone number, and the message you send.
  • Account credentials for services we manage on your behalf, only when you explicitly delegate access (e.g., admin passwords stored encrypted in our password manager).

Information we receive from third-party platforms (OAuth)

When you connect a social media account (Facebook, Instagram, Threads, TikTok, YouTube, LinkedIn, X, Google Business Profile, etc.) to our social media management platform, which appears to you as Blue Post Social, the platform shares specific information with us through standard OAuth 2.0 authorization flows. The exact data depends on the platform and the scopes you approve, but typically includes:

  • Your name, profile photo, and the email address associated with the connected account
  • The IDs and metadata of pages, channels, or properties you authorize us to manage
  • A revocable access token that lets us publish content on your behalf
  • Public engagement data on content we publish for you (likes, comments, reshares, view counts) for reporting purposes

We do not request or store the passwords of any third-party accounts. Access is granted through OAuth tokens that you can revoke at any time through the platform's own settings (e.g., Facebook → Settings → Business Integrations).

Information collected automatically

  • Standard server logs (IP address, user agent, timestamp, requested URL) for security and abuse prevention. Retained for 30 days.
  • Cloudflare bot-protection and rate-limiting signals, which may temporarily store fingerprints derived from your request headers.
  • If you visit a page that uses Turnstile or reCAPTCHA, the verification provider receives the data described in their own privacy policy.

Information from email recipients of campaigns we send on a client's behalf

  • Subscriber email address and name, supplied by our client (the sender) from their opt-in list.
  • Bounce, complaint, and unsubscribe events reported by the recipient's mail server or the recipient themselves. These are used solely to maintain list hygiene and honor unsubscribe requests.
  • Open and click telemetry when a recipient interacts with a campaign, used for the sender's analytics.

How we use information

  • To deliver the Services you or our clients have requested — publishing content, sending newsletters, providing IT support.
  • To communicate with you about your account, project, or support request.
  • To detect, prevent, and investigate abuse, fraud, or technical issues.
  • To produce aggregate, non-identifying analytics about how our website and platforms are used.
  • To comply with legal obligations.

We do not use your information, or that of email recipients, for advertising, retargeting, or profiling outside the scope of the Services.

Sharing and disclosure

We share information only with the following categories of third parties, and only as needed to deliver the Services:

  • Infrastructure providers — Cloudflare, Amazon Web Services, Hetzner, GitHub. Subject to their own enterprise privacy and security commitments.
  • Email-delivery providers — AWS Simple Email Service for outbound mail; DeBounce for one-time list hygiene verification.
  • Social media platforms — only the platforms you connect through OAuth, and only to publish and read content you have authorized.
  • Legal recipients — when required by law, subpoena, or court order, after evaluating the request.

We do not sell personal data, do not rent it, do not transfer it to data brokers, and do not share it for cross-context behavioral advertising.

Platform-specific disclosures

Google and YouTube

Blue Post Social uses YouTube API Services to publish videos and read basic channel and video statistics for YouTube channels you connect. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy.

Blue Post Social's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the publishing and reporting features you requested; we do not use it for advertising, do not sell it, and do not use it to train generalized AI or machine-learning models.

You can revoke Blue Post Social's access to your Google account at any time from your Google Account third-party connections page. When access is revoked we stop using the stored token immediately and delete it, together with the channel information we hold, within 7 days, or sooner on request (see Data deletion). Stored YouTube API data that is not refreshed is deleted within 30 days.

Meta (Facebook, Instagram, Threads)

We access Pages, Instagram professional accounts, and Threads profiles only as you authorize through Meta's login dialog, and only to publish content, manage comments and replies, and show engagement insights. Your use of these platforms remains subject to Meta's terms and policies. You can remove Blue Post Social at any time; see Data deletion.

TikTok

We access your TikTok profile information, public video list, and account statistics, and post videos you schedule, only as you authorize through TikTok's login dialog. You can remove Blue Post Social from your TikTok account settings at any time.

LinkedIn

We access LinkedIn Pages you administer, and your basic LinkedIn profile (name and profile picture), only as you authorize through LinkedIn's sign-in dialog, and only to list the Pages you can manage, publish the posts you schedule to them, and show post and Page statistics. We do not use LinkedIn data for advertising, sell it, or combine it with data from other sources to build profiles of LinkedIn members. Your use of LinkedIn remains subject to LinkedIn's terms and policies. You can disconnect a Page in Blue Post Social, or revoke access under LinkedIn's Settings > Data privacy > Permitted services, at any time; see Data deletion.

Data retention

  • Website inquiry forms — retained while the inquiry is active and for up to 24 months afterward for follow-up; deleted on request.
  • Server access logs — 30 days.
  • OAuth tokens — retained while the connection is active. Revoked tokens are removed within 7 days.
  • Email subscriber lists — retained on our client's behalf for as long as the client maintains their account. Returned or deleted at the client's direction when the relationship ends.
  • Bounce/complaint metadata — retained indefinitely to honor unsubscribes and prevent re-mailing addresses that have opted out.

Your rights

Depending on where you live, you may have the right to:

  • Access the personal information we hold about you.
  • Correct inaccurate information.
  • Request deletion of your information (see Data deletion for how to disconnect Facebook, Instagram, or Threads and remove what we hold).
  • Object to certain processing, or restrict it.
  • Receive a copy of your information in a portable format.
  • Withdraw consent at any time (e.g., by revoking the OAuth connection on the originating platform).

To exercise any of these rights, email support@bluepointeit.com. We will respond within 30 days. If we administer the Services on behalf of a client (e.g., you are subscribed to a newsletter sent by one of our clients), we will forward your request to the client and confirm completion to you.

Security

We protect information with industry-standard measures appropriate to its sensitivity. This includes encryption in transit (TLS 1.2+), encryption at rest for credentials and sensitive tokens, network-level access controls on our infrastructure, and least-privilege access for staff. No system is perfectly secure; if a breach occurs that meaningfully affects your information, we will notify you without undue delay and as required by applicable law.

Children

Our Services are intended for businesses and adults. We do not knowingly collect personal information from anyone under 16. If you believe we have done so, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced on this page with a new "Last updated" date and, where appropriate, by direct notice. Continued use of the Services after a change indicates acceptance of the updated policy.

Contact

Questions about this policy, or to exercise any of your rights:

Blue Pointe IT
support@bluepointeit.com
Plymouth, Massachusetts, United States