Privacy Policy

BluBerri Press Content House (Pty) Ltd | Version 1.5 | Effective date: 29 July 2026

1. Introduction

BluBerri Press Content House (Pty) Ltd (Registration No. 2026/169849/07), trading as BluBerri Press ("BluBerri", "we", "us", "our"), is committed to protecting your personal information in accordance with the Protection of Personal Information Act, 4 of 2013 ("POPIA") and other applicable South African legislation.

This Privacy Policy explains what personal information we collect, why, how we use and protect it, who we share it with, and your rights as a data subject. It applies to all personal information collected through bluberripress.com, the client Dashboard, the /try demo, and all other interactions with BluBerri.

2. Who is responsible for your information?

BluBerri is the Responsible Party for personal information collected through the Service.

Information Officer: Theon Jansen van Rensburg (Director)
Information Regulator registration number: 2026-061370
Email: hello@bluberripress.com
Registered address: 24 Gregory Avenue, Melrose North, Johannesburg, Gauteng, 2196
Website: bluberripress.com

3. Personal information we collect

3.1 Information you provide directly

Contact and account details: your name, business name, and email address, collected at signup and onboarding.
Brand Profile information: business description, website URL, Instagram handle, product details, target audience, visual references, and content preferences submitted during onboarding.
Uploaded materials: product photographs, brand logos, and reference images you upload. These may include lifestyle or on-body images showing identifiable people — see section 11.
Communications: messages, emails, and support requests you send us.

3.2 Information collected through the /try demo

When you use the /try demo we collect your email address, the product photograph you upload, the output format you select, and an optional short description of your product. We use this information to generate your demo result — the purpose for which you submitted it. If you also tick the separate, optional marketing checkbox, you give express opt-in consent for us to contact you about BluBerri's paid Service. You can unsubscribe at any time, and you can get your demo without opting in to marketing.

3.3 Payment information

We do not store your credit or debit card details. Payment processing is handled entirely by PayFast (PayFast (Pty) Ltd, registered in South Africa). We receive transaction confirmation and basic billing information (amount, date, status) from PayFast. We do not have access to your full card number, CVV, or banking credentials.

3.4 Technical information

When you use our website or Dashboard we may automatically collect technical information including IP address, browser and device type, pages visited, and session duration, used for security, performance monitoring, and improving the Service.

4. Why we collect and use your personal information

To provide the Service: generating your weekly Content, managing your Brand Profile, presenting your Weekly Brief, and making Content available in your Dashboard.
To manage your account: subscription, billing, and payment processing.
To communicate with you: Brief notifications, delivery confirmations, billing receipts, and service updates.
Direct marketing — only with your consent: we send marketing about BluBerri only to people who have expressly opted in (for example the optional /try marketing tick). Every marketing email contains an unsubscribe link.
To improve the Service: usage analysis, diagnostics, and feature development.
To comply with legal obligations: tax, regulatory, and record-keeping requirements.
To protect our rights: detecting and preventing fraud, misuse, or breach of our terms.

5. Lawful basis for processing

Performance of a contract: processing necessary to provide the Service you subscribed to, including sharing with the operators in section 6.
Pre-contractual steps / legitimate interest: generating your /try demo result, which you request by submitting the form.
Consent: marketing and follow-up communications, given by express, separate opt-in. You may withdraw consent at any time without affecting the Service.
Legitimate interest: security monitoring, fraud prevention, and service improvement, where our interests do not override your rights.
Legal obligation: tax, financial record-keeping, and regulatory compliance.

We do not sell your personal information. We share it only as necessary to operate the Service, with the following operators (POPIA sections 20–21), under written data processing agreements.

6.1 Operators (sub-processors)

Supabase — database hosting and file storage (Brand Profiles, uploaded materials, generated Content, account data). Servers located in the European Union.
Clerk — user authentication (login credentials, session tokens). United States.
OpenAI (GPT Image) — AI image generation. Receives approved Brief specifications, brand context, and uploaded product photographs used as generation references. Does not receive your contact details. United States.
Anthropic (Claude API) — powers our content planning and caption systems. Receives brand context and brief data; no contact details. United States.
Higgsfield — AI video generation. Receives video brief specifications; no contact details. We are finalising our data processing agreement with this provider.
PayFast (PayFast (Pty) Ltd) — payment processing. South Africa (payment data does not leave the Republic).
Resend — transactional and (with consent) marketing email. Receives your email address and name. United States.
Google Workspace — internal email and file sharing; may hold copies of client correspondence. United States.
Vercel — website and Dashboard hosting, including first-party site analytics. United States / global CDN.
Cloudflare — DNS and CDN. United States / global.

6.2 Cross-border transfers (POPIA section 72)

Some operators process personal information outside South Africa, in the United States and the European Union as set out above. We transfer personal information outside the Republic only where permitted by section 72 of POPIA, relying on: (a) binding written agreements with each operator (data processing agreements incorporating appropriate contractual safeguards, including standard contractual clauses where offered) that uphold principles substantially similar to POPIA's conditions for lawful processing; and (b) where applicable, the transfer being necessary for the performance of our contract with you.

6.3 Legal disclosure

We may disclose personal information where required by law, court order, or regulatory authority, or where necessary to protect BluBerri's legal rights.

7. How long we keep your information

Account, billing, contract and payment records (including Terms-acceptance logs): duration of your subscription plus 5 years after termination (tax and record-keeping requirements).
Brand Profile: duration of subscription plus 5 years post-termination.
Uploaded reference materials: duration of subscription plus 12 months post-termination, then deleted.
Generated content files: duration of subscription plus 6 months post-termination (re-download buffer), then deleted.
/try demo photo: not stored by BluBerri. Your photo is transmitted to our AI providers to generate your sample (see section 6.1) and is not retained on our systems.
/try demo result image: deleted within 30 days of generation.
/try email address, format selection, and product description: 12 months from submission, then deleted unless you become a client.
Technical and usage logs: 90 days, then deleted or anonymised.

8. How we protect your information

We implement reasonable technical and organisational measures (POPIA section 19), including: HTTPS/TLS encryption on all traffic; row-level security in our database so each client can access only their own data; private storage buckets with access via short-lived signed URLs only; authentication and session management through Clerk; and access controls limiting personal-information access to authorised team members. Despite these measures, no system is completely secure. If you become aware of a suspected security incident involving your data, contact us immediately at hello@bluberripress.com.

8.1 Security breach notification

If a security compromise involves your personal information, BluBerri will notify you and the Information Regulator as soon as reasonably possible after becoming aware of it, in accordance with section 22 of POPIA.

9. Your rights as a data subject

Under POPIA you have the right to: access your personal information; request correction of inaccurate or outdated information; request deletion, subject to legal retention obligations; object to processing based on legitimate interest; withdraw consent at any time where processing is based on consent; opt out of direct marketing at any time; and complain to the Information Regulator.

How to exercise your rights: email the Information Officer at hello@bluberripress.com with "Data subject request" in the subject line. To protect your information, we will verify your identity before acting. Formal access requests are handled under our PAIA Manual (bluberripress.com/paia) using PAIA Form 2, available from the Information Regulator's website or from us on request. We respond as soon as reasonably possible; access requests are answered within 30 days as required by PAIA. There is no charge for objection, correction, or marketing opt-out requests.

Information Regulator (South Africa): https://inforegulator.org.za/ · inforeg@justice.gov.za

10. Cookies

Our website and Dashboard use:

Strictly necessary cookies — authentication and session cookies (set via our authentication provider, Clerk) that keep you signed in and keep the site working. Always on; the Dashboard cannot function without them.
First-party analytics cookies — Vercel Analytics, to understand how the site is used (for example, which pages are visited) so we can improve it. We use first-party analytics only.

We do not use cookies for third-party advertising or cross-site tracking. You can control cookies in your browser settings; disabling strictly necessary cookies may stop the Dashboard from working.

11. Special personal information, children, and images of other people

The Service is not directed at persons under 18, and we do not knowingly collect personal information directly from anyone under 18. If you believe a minor has submitted personal information to us, contact hello@bluberripress.com and we will delete it.

Separately, images you upload (for example lifestyle or on-body product photos) may show identifiable people, and — for brands selling children's products — may show children. Where that is the case:

You must only upload images you have the right to use, and you must have the consent of any identifiable person shown (for a child, the consent of a parent or guardian) to that image being used in AI-assisted content generation as described in this Policy. We require you to confirm this at onboarding.
We process such images only to generate your content, share them only with the operators named in section 6.1 for that purpose, and apply the retention periods in section 7.
We do not use facial recognition or extract biometric identifiers from uploaded images.

12. Changes to this Privacy Policy

We may update this Policy to reflect changes in our practices, legal requirements, or the Service. For material changes we will notify you by email at least 14 days before the updated Policy takes effect. The current version is always at bluberripress.com/privacy; each version carries a version number and effective date, and superseded versions are archived and available on request.

13. Contact and complaints

BluBerri Press Content House (Pty) Ltd · Attention: Information Officer · hello@bluberripress.com · bluberripress.com · Registered address: 24 Gregory Avenue, Melrose North, Johannesburg, Gauteng, 2196

You may also lodge a complaint directly with the Information Regulator (South Africa): https://inforegulator.org.za/ · inforeg@justice.gov.za