Privacy Policy
Last updated: 1 November 2026
Who we are
Bluelupin Technologies Private Limited ("Bluelupin", "we") runs bluelupin.com. Our registered office is A-13/3, 402, Tower-I, Highway Towers, Sector-62, Noida 201301, Uttar Pradesh, India. Under India's Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described here.
Questions about your personal data go to our privacy contact, Ashish Srivastava, at privacy@bluelupin.com.
What we collect and why
| When | What we collect | Why |
|---|---|---|
| Contact and enquiry forms | Name, email, phone (optional), company, your message, the page you came from | To reply and discuss your project |
| Blitz enquiry form | Name, email, phone (optional), business name, plan, your message, the campaign link you used | To reply and scope your Blitz project |
| DPDP readiness review form | Name, work email, phone, organization, type of organization, number of records you hold, city, your consent choices, the campaign link you used | To reply, check eligibility and arrange your review |
| Optional "DPDP updates" box | Your email | To send occasional DPDP updates, only if you tick the box |
| Sample scope and NDA requests | Name, email, company, details you enter | To send the document you asked for |
| Job applications | Name, contact details, CV and anything you attach | To assess your application |
| Website visits (only if you accept analytics cookies) | Pages viewed, device and browser type, approximate location, how you arrived | To understand how the site is used and improve it |
We collect only what the form asks for. Do not send us data about other people, such as member or donor lists, through our forms.
DPDP readiness reviews
The review is a screen-share call. You show us your live systems; we take notes on how they work. We do not copy, download or store your members', donors' or beneficiaries' personal data. We sign an NDA if you ask.
Consent
We use your details for the purpose shown on each form. Where we ask for consent, for example the DPDP updates box or analytics cookies, you can withdraw it at any time: use the unsubscribe link in any update email, choose in the site footer, or write to privacy@bluelupin.com. Withdrawing consent does not affect what we did before.
Cookies and analytics
We use Google Analytics to understand how people use the site. It sets cookies only after you click Accept in the cookie banner. If you click Reject, Google Analytics still counts the visit without cookies and without identifying you. You can change your choice at any time from in the footer. The site also uses your browser's storage to remember your cookie choice.
Who processes data for us
We use these service providers to run the site and handle your requests. They process data on our instructions:
- Lovable and Cloudflare: website hosting. Lovable also counts visits (page, referrer, browser) with a 30-minute session ID on every visit, as part of hosting
- Supabase: processing form submissions (forms are not stored in a database)
- SendGrid (Twilio): sending form emails and replies
- Google: Google Analytics and our business email
- Calendly: booking calls, if you choose to book one
- Strapi on our own server (cms.bluelupin.com): job listings
Some of these providers process data outside India. The DPDP Act allows this except to countries the Government of India restricts; we will stop any transfer the government restricts.
We do not sell your personal data, and we share it only with these providers or when the law requires.
How long we keep it
- Enquiries and review requests: 24 months after our last contact with you
- DPDP review notes and reports: 24 months after the readout
- Job applications: 12 months after the role closes, unless you agree to longer
- NDAs: for the life of the agreement
- DPDP updates list: until you unsubscribe
- Google Analytics: event data for 2 months, user data for 14 months
After that we delete the data. Before deleting data because its purpose has ended, we will tell you at least 48 hours in advance where the DPDP Rules require it.
How we protect it
Access to form emails is limited to the people who handle them. The site uses HTTPS, and our providers encrypt data in transit. Form submissions go straight to email; we do not keep a copy in a website database.
If a breach affects your personal data, we will tell you and the Data Protection Board of India as the DPDP Rules require.
Your rights
You can ask us to:
- tell you what personal data we hold about you and how we use it
- correct or update it
- delete it, where we no longer need it or you withdraw consent
- name someone to exercise these rights for you if you die or cannot act yourself
Write to privacy@bluelupin.com. We reply within 30 days.
If you are not satisfied with our answer, write to us again with "Grievance" in the subject and we will review it. If it is still not resolved, you can complain to the Data Protection Board of India.
Children
The site is not meant for children under 18, and we do not knowingly collect their data. If we learn we have, we will delete it.
Links to other sites
Links to other websites lead to sites with their own privacy policies. We are not responsible for them.
Changes to this policy
When we change this policy, we update the date at the top. For a material change that affects how we use data you gave us, we will tell you by email where we can.
Contact
Privacy contact: Ashish Srivastava, privacy@bluelupin.com
Bluelupin Technologies Private Limited, A-13/3, 402, Tower-I, Highway Towers, Sector-62, Noida 201301, Uttar Pradesh, India