Privacy Policy
Last updated: October 16, 2026
Bluegrass CRM is a customer and job management service provided by Bluegrass Software, a small software business in Kentucky ("Bluegrass", "we", "us"). Contractors and service businesses ("customers") use it to keep track of their clients, jobs, schedules, payments, costs, notes, photos and documents. This policy explains what information the service handles, why, and the choices people have.
Two kinds of people
- Users — the people a customer invites to work in Bluegrass CRM (owners and staff). We have a direct relationship with them.
- Our customers' clients — the homeowners and businesses a customer records in the CRM. We hold that information for the customer, who decides what is recorded and how it is used. If you are one of a customer's clients, please contact that business about your information; we will help them answer you.
Google user data
Bluegrass CRM uses Google only for Sign in with Google. This section describes exactly what we do with information we receive from Google.
- What we access: when you sign in, Google shares your name, e-mail address, Google account ID and profile picture link (the standard "openid", "email" and "profile" permissions). We do not request or receive access to your Gmail, Google Drive, Calendar, contacts or any other Google data, and we never see your Google password.
- How we use it: only to confirm who you are, match you to the company that invited you, keep you signed in, and show your name to your co-workers inside the app (for example, as the author of a note).
- What we store: your e-mail address, display name, an internal sign-in ID and the time you last signed in. We do not store your profile picture. Our sign-in provider (Supabase) keeps a sign-in record for each Google account that signs in, including the Google account ID.
- Sharing: we do not sell Google user data, use it for advertising, or share it with anyone except the service providers listed below that run the app for us, or when the law requires it. We do not use Google user data to train artificial intelligence or machine learning models.
- Keeping and deleting it: we keep it while you have access to a company in Bluegrass CRM. To have it deleted, ask your company's owner to remove you and contact us at the address below; you can also remove Bluegrass CRM's access at any time at myaccount.google.com/connections.
- Bluegrass CRM's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
What we collect
When you sign in
Sign-in uses Sign in with Google only. We receive your Google account's e-mail address, name and account identifier — nothing else from your Google account, and never your Google password. We store your e-mail, display name, that identifier, the companies you belong to and your role in each, and when you last signed in. Our sign-in provider (Supabase) keeps a record of every Google account that completes sign-in, including accounts that are not invited and are turned away.
What customers enter
Customers and their users enter client names, phone numbers, e-mail addresses and street addresses; job details, schedules, prices and services; payments received (amounts and dates only — no card or bank details); job costs; notes; and files and photos they upload. Photos are re-saved when uploaded and all hidden photo information (including GPS location and camera details) is removed. Customers should not enter sensitive information the service does not ask for, such as Social Security numbers, bank or card numbers, or medical information.
Security and activity records
To keep accounts and data safe and to show customers who changed what, we keep an activity log of actions in the service (who, what, when) with the IP address and a request identifier, and a record of refused sign-in attempts (the e-mail address tried and the IP address). Our hosting providers keep technical logs (for example, the pages requested and errors). The text of notes is never written to the activity log.
Cookies and browser storage
We use one essential cookie to keep you signed in. Your browser also stores display preferences (such as light or dark theme). We do not use analytics, advertising or tracking cookies or scripts.
How we use information
- To run the service: sign you in, show each company only its own records, and do what users ask (for example, record a payment or create an estimate).
- To keep the service secure, investigate problems and prevent misuse.
- To support customers when they ask for help.
- To send the notifications a customer turns on (for example, an e-mail about a new note), once e-mail is enabled for that customer.
We do not sell information, and we do not use it for advertising.
Who handles information for us
We use a small number of service providers to run Bluegrass CRM:
- Supabase — database, sign-in and file storage.
- Render — runs the application.
- Google — Sign in with Google.
- Backblaze — off-site backups, which are encrypted before they leave our systems.
- Postmark — sending e-mail, only once e-mail is enabled; it then receives the recipient and the message.
We may also share information if the law requires it, to protect people or the service, or as part of a sale or reorganization of our business (with this policy continuing to apply).
Who can see a company's information
Each company's records are kept separate from every other company's. Within a company, the company's owners and admins decide who is invited and what each person may see (for example, only owners and admins see money figures). A small number of Bluegrass staff can access the system to operate and support it; when one of us joins a company to help, that company sees us in its Users list and the visit is recorded in its activity log.
How long we keep it
We keep a company's information while it uses the service. Users can delete most records in the app; payment history is kept as a financial record and corrected with entries rather than deleted. When a company leaves, its information is deleted on request, and copies in our encrypted backups are removed as those backups expire. Activity records are kept for security and accountability.
Security
We use reasonable measures to protect information, including encrypted connections, separation of each company's data in the application and the database, role-based access, invitation-only accounts, an activity log, and encrypted off-site backups. No system is perfectly secure, and we cannot guarantee that information will never be accessed without permission. If we learn of a security incident affecting a customer's information, we will tell that customer.
Your choices
- Users can update their display name, and a company's owners and admins can remove a user's access at any time.
- To ask what information we hold about you, or to correct or delete it, contact us below. If your information was entered by a business that uses Bluegrass CRM, we will work with that business on your request.
Children
Bluegrass CRM is a business tool and is not directed at children under 13. We do not knowingly collect their information.
Changes
If we change this policy, we will update the date above, and we will tell customers about important changes before they take effect.
Contact
Bluegrass Software, Kentucky, USA — grayson123007@gmail.com