This Privacy Policy explains how LA Media Group (“LA Media Group,” “we,” “us”) collects, uses, and protects information in connection with Bluu (the “Service”), a white-label marketing and client-management platform we provide to businesses (“Clients”).
We use information to operate and improve the Service, authenticate users, send transactional messages, process usage billing, provide support, and keep the platform secure. We do not sell personal information.
If you connect a Google account, we request only these permissions:
openid and https://www.googleapis.com/auth/userinfo.email — to identify which Google account is connected and show you that address in the dashboard, so you can tell which account is linked before you rely on it.https://www.googleapis.com/auth/calendar.events — to create calendar events and Google Meet links for appointments booked through the Service. We only write events. We do not read, list or import the events already in your calendar, and we never see your existing schedule.https://www.googleapis.com/auth/business.manage — to list the Google Business Profile locations you manage so you can choose one, read the reviews left on it, and post a reply you have written in the dashboard. We never create, edit or delete a location.https://www.googleapis.com/auth/analytics.readonly — to display your own Google Analytics (GA4) traffic inside your dashboard. It is read only, and it is the narrowest Analytics scope Google offers. We never change your Analytics configuration.Google data is used only to provide the feature you connected it for: putting a booked appointment on your calendar, showing and replying to your reviews, and displaying your own website traffic. We do not use it for advertising, for lending decisions, for profiling, or for any purpose other than the user-facing features described above.
We do not sell, rent or transfer Google user data to third parties, data brokers or advertisers. The only parties that process it are our own infrastructure providers acting on our instructions under contract, solely to run the Service: our hosting provider (Vercel) and our database and file storage provider (Supabase). A reply you choose to publish is sent back to Google to appear on your own listing.
No data received from Google APIs is used with, or transferred to, any artificial intelligence or machine-learning system.We do not use it to develop, improve or train any AI or ML model, our own or anyone else’s, and we do not pass it to a third-party AI service. The Service does include AI features, and they operate only on information created inside Bluu or taken from your own public website: your business profile, your services, your locations and your website page summaries. Replies to reviews are written by you or filled from a template you wrote; they are not generated from Google data by a model.
OAuth tokens are stored server-side in a table with row-level security enabled and no client-readable policy, so they are reachable only by our server and never by a browser. All traffic is encrypted in transit. Access is controlled per user and per business, and each Client’s data is isolated at the database row level from every other Client’s.
We keep Google data only while the connection is active. Disconnecting removes our access and deletes the stored tokens and the review data we pulled from that listing. Calendar events we created stay in your calendar, because they belong to you. You can disconnect at any time in Appointments → Settings (Calendar), Reviews → Settings (Business Profile) or Analytics → Sources (Analytics), revoke our access directly at myaccount.google.com/permissions, or ask us to delete everything using our Deleting your data page. Deletion requests are actioned within 30 days.
Bluu’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.
If you connect a Facebook Page, we request pages_show_list (to let you choose which Page), pages_read_engagement and pages_read_user_content (to read that Page’s reviews and recommendations), and pages_manage_engagement (so a reply you write in the dashboard is posted to the Page). We store the resulting access tokens encrypted on our servers and use them only to perform these actions on your behalf.
We read only your Page’s reviews and recommendations and the reviewer’s public name and picture as shown on the review. We do not access your personal Facebook profile, your friends, your messages, or your ad accounts. We do not use Meta data for advertising, we do not sell or transfer it, and we do not use it to train machine-learning models.
You can disconnect at any time in Reviews → Settings → Disconnect: which removes our access and deletes the review data we pulled from that Page. You can also remove our access from Facebook Settings → Business Integrations. Disconnecting changes nothing on Facebook itself, your Page and its reviews stay exactly as they are, because they belong to you and to the people who wrote them.
We share information only with service providers that help us operate the Service (such as hosting, database, email, SMS, and payment processors), and when required by law. These providers process data on our behalf under contract.
We retain information for as long as an account is active or as needed to provide the Service, then delete or anonymize it. We use industry-standard measures including encryption in transit, access controls, and row-level data isolation between Clients.
You may access, correct, export, or delete your information, and disconnect any third-party integration, from within the dashboard or by contacting us. Full instructions, including what we delete and how long it takes, are on our Deleting your data page.
Questions about this policy? Email info@lamediagrp.com.