Privacy Policy

Last updated: 20 October 2026

Blueweft is operated by Marc Rasmussen, who is responsible for the personal information processed by the hosted Service. This policy describes how Blueweft handles information when you use its website, architecture workspace, and connected features. A self-hosted deployment is managed by its own operator; contact that administrator about its hosting and data practices.

1. Information we process

• Account and session information: account identifiers, sign-in information, and essential cookies that keep your account or browser workspace connected. When an identity provider is used, it processes sign-in information under its own privacy notice.
• Workspace content: the architectures, diagrams, documents, project history, repository references, and other material you save or submit. Projects may be stored on the server, with browser storage used for drafts, recovery, and preferences.
• AI and integration requests: prompts, conversation context, selected architecture content, and images or documents you submit to a feature. Connected agents can access the workspace information authorized by their connection.
• Technical information: network and request information, such as IP addresses, browser information, and errors, needed to deliver and protect the Service. Hosting infrastructure may record operational logs.
• Optional analytics: with your permission, Google Analytics processes visits, browser and device information, and predefined feature events, such as diagram creation or downloads.

2. Why information is used

We use information to provide the features you request, save and restore work, authenticate access, respond to support requests, and maintain the Service. Where data protection law requires a legal basis, providing requested services relies on performance of a contract; proportionate security and operational processing relies on legitimate interests in maintaining a reliable service; optional analytics relies on consent; and legally required processing relies on the relevant legal obligation.

You can decline analytics and still use the workspace. Without information necessary for sign-in, storage, or an integration request, the corresponding feature may not work.

3. Cookies and browser storage

Essential cookies identify sessions and browser workspaces. Browser storage also holds preferences, your analytics choice, and local drafts or recovery information. Clearing browser storage can remove local work or disconnect access to a browser workspace; export important work first.

Google Analytics loads only after analytics consent on the hosted Blueweft domain. Its first-party analytics cookies are configured to expire after 180 days without automatic renewal. Advertising personalization and Google Signals are disabled. Blueweft’s analytics integration sends fixed page labels and predefined event fields, excluding project names, diagrams, form entries, URL queries, fragments, and referrers.

Use Privacy settings on the homepage or in the workspace to change your choice. Declining stops this integration from sending further events and removes its first-party analytics cookies. Withdrawing consent does not undo earlier processing. You can also manage stored data using your browser settings.

4. AI providers and other recipients

When you request an AI feature, the information needed for that request is sent to the configured provider, which may include OpenAI or Anthropic. Avoid including passwords, API keys, or personal or confidential information you are not authorized to share. Provider retention and use depend on that provider’s terms and the configured account; this policy does not promise that third-party services never retain request data.

Hosting providers process information necessary to operate the Service. Identity providers process sign-in information when enabled. Google processes optional analytics after consent. Connected applications and agents receive information required for the actions you authorize. Information may also be disclosed where legally required or necessary to address abuse or protect legal rights.

These providers may process information outside your country, including outside the European Economic Area. Applicable safeguards and processing locations depend on the provider and deployment arrangements; contact the operator for details before submitting information with residency restrictions.

5. Retention and deletion

Saved projects and snapshots persist so that work can be reopened and recovered; they do not automatically disappear when you close a tab or sign out. Browser drafts and preferences remain until replaced or cleared. Session and analytics cookies have their own expiry periods. Server records, operational logs, and backups follow the operator’s retention arrangements; deletion from an active project does not necessarily remove earlier snapshots or backup copies immediately.

Use available project controls to manage your work. Contact the operator to request account or personal-data deletion, including information about retained snapshots and backups. Legal obligations or the establishment, exercise, or defense of legal claims may require some records to be retained.

6. Your choices and rights

Depending on applicable law, you may request access, correction, erasure, restriction of processing, or portability of your personal data, and object to processing based on legitimate interests. You may withdraw analytics consent at any time through Privacy settings. We may need to verify your identity to protect your information when handling a request.

You may also complain to your local data protection supervisory authority. These rights are subject to applicable legal conditions and exceptions.

7. Security

The Service uses access controls and protected session cookies, and keeps configured AI-provider credentials on the server. No system can guarantee absolute security. Protect your account, review integration permissions, and avoid submitting unnecessary sensitive information.

8. Contact and updates

For questions or privacy requests, contact Marc Rasmussen at mr@marcrasmussen.dk. For a self-hosted deployment, contact your deployment administrator.

We will update this page when practices change and revise the date above. Material changes will be communicated where required by applicable law.