How we handle your data
Short version: we run Google Analytics to see what's working on this site, and we keep the messages you send through the contact form. We don't run ads, we don't sell data, and we don't share anything beyond what's described below. Last updated 2026-05-12.
What we collect
Two things, and only when they apply.
Site analytics (Google Analytics 4)
Anonymized usage data: pages viewed, time on page, referring site, approximate location (country/region, not address), device type, and browser. In jurisdictions that require prior consent (EU, UK, Switzerland), this is only collected after you click Accept on the consent prompt. Elsewhere, it loads by default and you can opt out via Manage cookies in the footer.
Contact form submissions
When you send a message through the contact form, we receive your name, email address, and the content of the message. This is sent over email to the BlueprintKey inbox and stored there until the conversation ends or we no longer need it.
Why we're allowed to collect it
Different rules for different jurisdictions. We apply the strictest of them when in doubt.
EU / UK / Switzerland
Analytics: your prior consent (GDPR Art. 6(1)(a) and ePrivacy). Contact form: your consent and our legitimate interest in responding to inquiries (Art. 6(1)(a) and (f)).
Brazil (LGPD) and Quebec (Law 25)
Same as the EU model — analytics requires prior consent. Visitors from Brazil and Quebec see the same opt-in banner as European visitors and Google Analytics does not load until consent is given.
United States and elsewhere
Analytics runs by default; you can opt out at any time via Manage cookies, by clicking Reject in the banner, or by enabling Global Privacy Control in your browser. Contact form data is processed because you sent it to us to start a conversation.
How long we keep it
We keep data only as long as we need it for the purpose described, then delete it. Concrete numbers below.
Analytics
Event-level data is retained for 14 months in Google Analytics, after which it is aggregated. Aggregate, anonymized reports persist longer. You can request that we exclude your IP from analytics at any time.
Contact form messages
Email exchanges stay in our inbox while the conversation is active. After the inquiry closes, we keep them for up to 24 months for follow-up and tax/record-keeping purposes, then delete them. You can ask us to delete sooner at any time.
Server logs
Standard web-server access logs (IP addresses, request paths, timestamps) are retained for up to 30 days for operational security and then rotated out.
Who we share data with
We do not sell your personal information. We do not share it for cross-context behavioral advertising. We do not run advertising on this site. The only third parties involved are the service providers we use to run the site — listed below — and they process data only on our behalf.
Google (Analytics)
Analytics data is processed by Google in the United States. Google acts as a data processor under standard contractual clauses (SCCs) for EEA/UK transfers. Google signals (cross-device identification using signed-in Google accounts) is turned off.
Resend (email delivery)
Contact form submissions and the confirmation email you receive are delivered through Resend, an email infrastructure provider based in the United States.
Amazon Web Services (hosting)
The site itself is hosted on AWS in the United States. Standard server logs may include IP addresses for a short period, used only for operational security.
Your rights
If you're in the EU, UK, Switzerland, Brazil, Quebec, California (or many other US states), the law gives you specific rights. We honor them globally regardless of where you are.
Know, access, correct
Ask us what personal data we hold about you and ask us to correct anything that's wrong. Email privacy@blueprintkey.com and we'll respond within 45 days (the deadline most laws require).
Delete
Ask us to delete your personal data. You can submit a deletion request two ways: by email to privacy@blueprintkey.com, or by postal mail to BlueprintKey LLC, 455 Market St, Ste 1940 #972592, San Francisco, CA 94105. We'll confirm within 45 days.
Withdraw consent / opt out of analytics
Open Manage cookies in the footer and switch your choice — analytics stops collecting immediately. You can also click Reject in the banner the first time you visit.
Global Privacy Control (GPC)
If your browser sends the Sec-GPC signal — Firefox, Brave, and several privacy extensions support this — we treat it as an automatic opt-out of analytics. You don't need to click anything; we read the signal on every request and confirm in the footer that we honored it. California (CCPA/CPRA), Colorado, Connecticut, and several other US states specifically require this.
Object, restrict, or port
Tell us to stop processing your data for a specific purpose, or ask for a copy in a portable format. Email us and we'll work it out.
Complain to a regulator
If we don't resolve your concern, EU/UK/EEA residents can file with their national data protection authority; California residents can complain to the California Privacy Protection Agency; Brazilian residents can complain to the ANPD.
Children
This site is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has sent us information through the contact form, email privacy@blueprintkey.com and we'll delete it.
Contact us
Questions, requests, or anything else: email privacy@blueprintkey.com, or write to BlueprintKey LLC, 455 Market St, Ste 1940 #972592, San Francisco, CA 94105. We aim to respond within 5 business days, and always within the 45-day statutory deadline.