Privacy Policy

1Scope, and the two roles we play

This policy explains what BlueWave Technology, Inc. collects, why, and what we do with it. It covers two different situations, and it matters which one you are in.

• You visit our Site, ask for a tour, or do business with us. Here BlueWave decides what to collect and why. Sections 2 to 6 are about you.
• Your organization uses CaseTrace, or you are a person a CaseTrace customer has documented a record about. Here the customer organization is the operator of record and decides what enters the system. BlueWave processes that data on the customer's instructions under its subscription. Section 7 is about that, and it is the section to read if you want to know what CaseTrace does and does not do with information about people.

BlueWave does not sell personal information and does not use it for advertising.

2Information we collect from visitors

Browsing. Our Site does not use advertising cookies, analytics trackers or third-party tracking pixels. When you load a page, our hosting provider receives the ordinary technical information any web server receives: your IP address, browser type, the page requested and the time. We use it to serve the page and keep the Site secure, and we do not build profiles from it.

The password gate. Parts of bluewavetech.io sit behind a site password while material is in review. Entering it sets a single cookie so you are not asked again during your visit. It holds no personal information.

Contacting us. If you email us, we receive what you send, including your address, and we keep it to respond and to keep a record of the conversation.

3Information we collect when you request a private tour

The tour request form asks for your name, company or agency, work email, phone number, the edition you want to see, and your business address, which the form completes with Google Maps Platform as you type. We use this to decide whether to grant access, to send you the tour link, and to follow up about CaseTrace.

When you watch the tour, you type your name to accept the viewing terms. We record the name you typed, the time, and a fingerprint of the exact terms you accepted. Your name and the date are rendered onto the video while it plays, and each play is logged against your link. Access ends after seven days or twenty-five plays.

We keep tour requests and viewing records so we can honor the access limits, follow up with you, and show, if it ever matters, who accepted what.

4Information we collect when your organization becomes a customer

Onboarding collects what a subscription needs: the legal entity name and any trade name, its website and phone, the billing address, the administrator's name, title, email and phone, the authorized signer's name, title and email, the service sites to be covered, the edition and term chosen, and the acknowledgements accepted along the way. The onboarding record also keeps the time zone and screen size of the browser used, the referring page, and an audit trail of each step.

Payment. We use Stripe to collect payment methods and process charges. Card and bank details are entered on Stripe's pages and are held by Stripe; BlueWave does not store full card or bank credentials.

Agreements. We use Dropbox Sign to send and collect signatures on the contract documents. Dropbox Sign records the signer's email, the time, IP address and browser of each signature, and a cryptographic hash of the signed packet. We keep the executed packet and that audit trail.

Shipping. If your subscription includes a CaseTrace Edge Device, we share the delivery contact and site address with our shipping provider to produce a label and track the parcel.

Portal accounts. Each customer administrator manages their organization's users. We hold the name, email and role of each user so the portal can sign them in and enforce their permissions, and we log sign-in events and role changes.

5How we use information, and how we share it

We use the information above to run the Site, respond to you, evaluate and grant tour access, set up and support subscriptions, bill and collect payment, ship and recover equipment, keep records we are required to keep, protect the Site and our customers from misuse, and comply with law.

We share it only with the service providers who help us do those things, each bound to use it only for that purpose:

• Netlify hosts the Site and runs its forms and functions
• Supabase hosts the databases behind onboarding and the customer portals
• Cloudflare serves the customer portals
• Stripe processes payments
• Dropbox Sign handles electronic signatures
• Resend delivers our transactional email
• Shippo produces shipping labels and tracking for equipment
• Google Maps Platform completes addresses on the tour form

These providers host in data centers primarily in the United States. We will also disclose information when the law requires it, to enforce our terms, to protect the rights, property or safety of BlueWave, our customers or others, and as part of a merger, reorganization or sale of the business, in which case the successor takes on this policy.

Beyond that, we do not share personal information with anyone.

6How long we keep it

• Tour requests and viewing records are kept for as long as we are in contact with you about CaseTrace and for a reasonable period afterwards for our records.
• Onboarding, subscription, billing and signature records are kept for the life of the subscription and for the period afterwards that tax, accounting and contract law require.
• Server and security logs are kept for a short, rolling period.
• Email is kept for as long as the conversation is useful to either side.

Records inside CaseTrace itself follow the retention schedule in Section 7, which is different and shorter.

7Data inside CaseTrace

CaseTrace is a documentation and evidence platform. Customers use it to document incidents that occur in their environment, to preserve the media and facts that belong to that record, and to hand a sealed record to the people authorized to act on it. The customer organization is the operator of record for everything it puts into the system; BlueWave processes it on the customer's instructions and under the customer's subscription. If you believe a CaseTrace customer holds a record about you, the customer is the party to contact, and we will help them respond.

Here is how the system treats information about people, as set out in the CaseTrace System Scope Acknowledgement each customer accepts:

• No general population processing. The system does not analyze, enroll or index the general public and keeps no general population database. Processing happens only on a predicate: a documented incident, media an authorized user submits, or a verification an authorized user initiates. There is no continuous scanning of people entering a space.
• Similarity Results are not identifications. Where the system compares media, the output is a computational similarity that a human reviews and confirms or rejects. It does not identify anyone, confirm identity, or establish wrongdoing.
• Not a consumer reporting or screening service. BlueWave is not a consumer reporting agency under the Fair Credit Reporting Act, and customers may not use system output to decide eligibility for employment, housing, credit, insurance or any similar purpose.
• Retention is short and tied to the record. An incident record, its media and any derived artifacts are kept for 30 days from creation and then purged. Where a customer issues a lawful trespass notice and attaches it to a record, that record is kept for 12 months from the notice. A record under a legal hold is not purged. After a purge the system retains only that a record existed, its classification, its date and which organization held it, which contains no personal information and cannot rebuild the record.
• Sealed evidence. Records are packaged into integrity-protected Encrypted Evidence Bundles held under the customer's own account. BlueWave does not initiate contact with law enforcement on a customer's behalf and does not transmit records to any authority absent the customer's action or valid legal process.
• The CaseTrace Global Network is opt-in. A participating customer receives a signal that a record exists elsewhere in the network as a count and a classification. No names, addresses, member identities or personal information cross the network boundary.
• Everything is logged. Record creation, attestation, similarity results and their review, disclosure events, purges, holds, sign-ins and role changes are all logged and non-editable.

Customers are responsible for the notices, signage and consents their own operations require, and for the laws that apply to their environment. As of the effective date, CaseTrace functions involving identity artifacts or face-based similarity are not offered for service sites in Illinois or Washington.

8Security

We maintain commercially reasonable administrative, technical and physical safeguards appropriate to the Site and the services. Traffic to the Site and the portals is encrypted in transit, access to production systems is limited to authorized BlueWave staff, and the highest administrative role in CaseTrace is reserved to BlueWave and is never granted to a customer. No system is immune from every security event; if one affects your information we will tell you as the law requires.

9Your choices and rights

You may ask us what personal information we hold about you, ask us to correct it, ask us to delete it, or object to a use of it, by writing to the address below. We will verify that you are who you say you are and respond within the time the law allows, and we will not treat you differently for asking. Depending on where you live you may have additional rights under state privacy law, and you may have the right to complain to a regulator.

If your request concerns a record held by a CaseTrace customer, we will forward it to that customer, who is the party able to act on it, and help them do so.

You can stop receiving our follow-up email at any time by replying and saying so.

10Children

The Site and our services are for organizations and the adults who work for them. We do not knowingly collect information from anyone under 18, and if we learn we have, we will delete it.

11Where we operate

BlueWave is a United States company and processes information in the United States. If you use the Site from elsewhere, you understand your information will be handled here, where the law may differ from your own.

12Changes to this policy

When we change this policy we will update the effective date at the top. If a change materially affects how we handle information we already hold about you, we will tell you before it takes effect. Prior versions are available on request.