Privacy Policy

This policy explains how Blureon SRL (Tax ID 49374555), acting as data controller, collects and processes personal data in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Romanian law.

Who we are

Blureon SRL is a provider of electronic communications services. Registered office: Str. Pârâului nr. 2B, demisol, Cluj-Napoca, Romania. You can reach us by phone at (0374) 550 147 or through the contact form on this site.

What data we collect

• Contact data — name, company, phone number and email address, submitted through the contact form or provided by phone.
• Spam protection on the forms — the site's forms are checked with Cloudflare Turnstile, which processes your IP address and browser data to tell people from automated programs. The site's server keeps, for at most one hour and in a form that does not contain the IP address, the number of requests sent from the same address.
• Traffic and communications data — required to provide telephony services (numbers dialled, call duration and call type), processed strictly for service delivery and to meet legal obligations.
• Technical data — information about your use of the site, under the conditions described in our cookie policy.

Purposes of processing

• Responding to enquiries and preparing quotations.
• Providing and administering the telecommunications services under contract.
• Meeting legal obligations: tax, regulatory and data retention requirements.
• Network security and prevention of fraudulent use of the services.

Legal basis

We process data on the basis of contract performance or the steps before a contract taken at the company's request (for example, replying to the contact form), your consent where applicable, our legal obligations, and our legitimate interest in providing and securing the services.

How long we keep data

We keep data for as long as necessary for the purposes above and for the periods required by law. As a guide: contact data from enquiries that do not lead to a contract is deleted or anonymised within 12 months of the last interaction; contract data and data required for tax purposes is kept for the duration of the contract and afterwards for the statutory archiving periods; traffic data is kept in line with the retention obligations applicable to providers of electronic communications services. The exact periods that apply to your contract are set out in your contractual documents.

Who we share data with

We do not sell your data. We may disclose it, strictly as far as necessary, to the following categories of recipients: hosting and technical infrastructure providers, including Cloudflare, Inc., which delivers the site and checks the forms, under standard contractual clauses; telecommunications operators with whom we interconnect traffic or to whom porting requests are submitted; accounting and invoicing service providers; legal advisers; and public authorities where the law requires it. All processors act under contracts that include confidentiality and security obligations.

Transfers outside the European Economic Area

The infrastructure our services run on is hosted in Romania. Where a particular service involves a transfer outside the European Economic Area, it takes place only on the basis of a transfer mechanism provided for by the GDPR, and information about that transfer is made available to you on request.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal. You can exercise these rights by contacting us using the details above. You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP).

Security

We apply technical and organisational measures to protect data: encryption of traffic in transit, controlled access to systems, separation of environments, and hosting of the infrastructure in our own data centre.

The Blureon Phone application

Blureon Phone (macOS and Windows; iOS and Android coming soon) is the business telephony application. On the Free package any company or organisation can use it with its own SIP account; on a Blureon PBX, the account is issued by the company's phone system against a code provided by its administrator. The application creates no accounts with Blureon. For call data, the company is the controller and Blureon SRL acts as processor.

• Data processed — the phone account (extension, display name, SIP credentials), stored encrypted on the device; an identifier of the computer, derived from its hardware (not an IMEI or phone number), and the computer's name; the user's SIP extension, tied to the installation during automatic setup; the licence key or the company's token, to check the licence; the application and operating-system versions, for updates; the Apple or Google push token, sent only to Blureon's notification server; call data supplied by the company's phone system (the call history stays on the device); aggregated daily usage and call-quality statistics (no numbers, names or content); crash reports, with an excerpt of the application's technical log; reports submitted by the user, which may contain dialled numbers, a log excerpt and a screenshot; the IP address the reports come from.
• Permissions — microphone during calls only; camera only to read the setup QR code, without storing images; device contacts read locally, not transmitted; notifications for incoming calls.
• Recipients — the company's phone system; Blureon servers in Romania; Apple Inc. and Google LLC solely to deliver call notifications, under their standard contractual clauses. On a mobile phone, call signalling, including the calling number, passes through Blureon's notification server. The company's CRM, where used, is queried directly from the device. The application uses no advertising and no third-party tracking or analytics.
• SMS and WhatsApp — on the Pro and Enterprise packages, messages go directly from the computer to the SMSWapi service, with the company's API key, without passing through Blureon's servers. The key reaches the computer during automatic setup and is kept in the system vault. SMSWapi receives the company's key, the recipient's number, the message text and, where applicable, the phone and SIM card the SMS leaves from or the WhatsApp account used. Conversations stay stored at SMSWapi, in the company's account: the application reads them from there each time and keeps them in memory only while it is open, and on the computer it keeps only the identifiers of messages already read, with no numbers and no text. The daily statistics only count how many messages were sent. For these messages, the company is the controller and SMSWapi is the provider it chose.
• Retention — account and settings until the application is disconnected or removed; statistics, crash reports and user reports for 24 months in device-linked form, then anonymised; call data according to the company's phone system rules and the provider's legal obligations.
• Deletion — "Disconnect this phone" in Settings removes the account and settings from the device; the company's administrator can do the same remotely. Deletion of data held on Blureon servers can be requested through the contact details above.

The application is intended for professional use and is not directed to persons under 16.

The Blureon PBX phone system

Blureon PBX is the phone system a company installs on its own server. Calls, recordings, voicemail, the phone book and the users' data stay on that server, and the company is their controller. The phone system talks to Blureon's servers only for the licence, updates, diagnostics and the call notifications of the Blureon Phone mobile app.

• Data sent — the licence key and an installation identifier; the phone system's version and address (domain name); the number of extensions, queues, numbers, trunks, users and simultaneous calls, and the uptime; for each company hosted on the phone system, an identifier without a name, its number of extensions and the storage it uses; the company's Blureon Phone licences, with the device and platform of each; the usage of the AI features (quantity and cost); the phone system's error reports, with the error's technical context; reports submitted by the administrator, which may contain a log excerpt; the progress of installations and updates; the IP address the requests come from. For Blureon Phone on mobile, call signalling, including the calling number, passes through Blureon's notification server.
• Error reports — they travel on two paths, both to Blureon servers: to the Blureon portal, which can be switched off in the phone system's web interface (Error reports and suggestions), and to Blureon's development server, on by default and, for now, switched off only in the server settings. Passwords and keys are removed from the reports, but they may contain technical data: addresses, identifiers and, sometimes, a phone number from the error message.
• AI features — the recording or the text of a call goes directly from the phone system to the AI provider chosen by the company (for example OpenAI, Anthropic, ElevenLabs or Deepgram), with the company's key, not through Blureon's servers; transcription can also run locally, on the phone system. With the voice agent, the call audio goes in real time from the phone system to OpenAI. For this data, the company is the controller and chooses the AI provider, including as regards any transfer outside the European Economic Area. Blureon receives only the usage (quantity and cost), never the recording or the text.
• What is not sent to Blureon — the content of calls, recordings, transcripts, voicemail and the company's phone book. A log excerpt or an error's context may, by chance, contain a phone number.
• Other data — otherwise, the phone system sends data only to what the company configures: its telephony carriers, its email server, its SMS and WhatsApp gateways, its webhooks and integrations, for example Odoo.
• Demo accounts — a test phone system started by Blureon is a demo account on Blureon's own phone system, so its data sits on Blureon's servers. It runs for 14 days by default (at most 90), stops by itself at the end and is deleted after another 14 days (at most 90), unless it becomes a customer account. SMS and WhatsApp run in test mode, and emails stay in the log only.
• Purpose and legal basis — checking the licence, delivering updates, applying the purchased package and troubleshooting, on the basis of the contract and of our legitimate interest in keeping the phone system working and secure.
• Recipients — Blureon's servers in Romania. The data is not used for advertising and is not passed to third parties for analysis.
• Retention — licence data for the life of the licence and then as the law requires; error reports, administrator reports and installation progress for 24 months in full, then without the IP address, the log excerpt and the error's context.

Changes

We may update this policy. The current version is always published on this page, together with the date it was last updated.