Privacy Policy

1. Who we are and what this policy covers

1.1 This Privacy Policy explains how Blue Rain Labs Inc. ("Blue Rain Labs", "we", "us") collects, uses, shares and protects personal information when you visit ursaweb.com (the "Site"), create or use a URSA account, or use the URSA desktop application and its plugins (the "Application"). It also describes the cookies the Site uses, so there is no separate cookie policy.

1.2 URSA (User Refined Studio Automation) is a product of Blue Rain Labs Inc. The Blue Rain Labs website and the Blue Rain Labs Client Hub have their own privacy policies, at bluerainlabs.com/privacypolicy and hub.bluerainlabs.com/privacypolicyhub.

1.3 This policy also covers the newsletter sign-up at ursavfx.dev, which is the URSA page until the Site launches.

1.4 Our office is at Unit 147, 1329 Queen Street East, Toronto, Ontario M4L 1C6. We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (Canada) and, where they apply, provincial private-sector privacy laws such as those of British Columbia and Quebec. Our commercial email follows Canada's Anti-Spam Legislation. Where they apply, we also follow the European Union and United Kingdom General Data Protection Regulations and United States privacy laws.

1.5 The URSA End User Licence Agreement and the Terms of Use set the rules for using URSA. This policy governs how we handle personal information.

1.6 URSA accounts are open to people worldwide. Sections 3.6, 6.5, 11.4 and 11.5 add information for people in the European Economic Area, the United Kingdom, Switzerland and the United States.

2. What we collect

2.1 Your account. When you create a URSA account we collect your email address and your name. You sign in with a password or with Google. Passwords are handled by Firebase Authentication, and we never see or store your password in readable form. If you sign in with Google, Google tells us your email address, your name and the address of your profile picture, which Firebase Authentication keeps with your sign-in record. We use only your email address and name.

2.2 Optional profile answers. You may tell us what you make and your team size. Both questions are optional.

2.3 Your marketing choice. We record whether you ticked the box asking to receive email about URSA, and when. The box reads: "Send me email from Blue Rain Labs Inc. about URSA releases and updates. You can unsubscribe at any time." Beneath it we give our mailing address (Section 1.4) and privacy@bluerainlabs.com. With your choice we record the version of this policy in force, so we can show the wording you saw.

2.4 Sessions. We keep a record of each browser and desktop session that is signed in to your account, so you can see and end them from your account page. Session records do not store your IP address. A desktop session ends after 90 days without use.

2.5 Entitlements. We record which plugins your account is allowed to install. Today every account receives the free Launcher.

2.6 The Application. Sign-in happens in your browser on the Site, never inside the Application. The Application stores a sign-in token in the Windows Credential Manager on your device. It sends our servers that token, its version number to check for new releases, and requests for your plugin list, your entitlement token and plugin downloads. It does not send us your project files, your settings or the software you launch.

2.7 Diagnostic logs. The Application keeps diagnostic logs on your device. They are designed to exclude personal information. They are sent to us only when you choose Report a problem, together with what you write in the report.

2.8 Account email. We send verification, password reset and service messages to your email address. We keep a count of the messages sent to each account to prevent abuse, and our email provider records whether each message was delivered.

2.9 Email and support. If you email us, we keep the correspondence.

2.10 Newsletter sign-ups. If you signed up at ursavfx.dev, we hold your email address, the date and time you consented, and where you signed up. At launch these records move into the URSA account system.

2.11 How you use the Site. Only if you accept Analytics or Advertising in the cookie banner. See Section 4.

2.12 How you found us. If you arrive at the Site from a link that carries campaign details (the source, medium, campaign and content of an ad, a QR code or an email), the Site keeps them in your browser's session storage until you finish signing up or close the tab, and then stores them once with your account. We do this for every visitor, whatever you chose in the cookie banner, because it never leaves our own systems: it is never sent to an analytics or advertising provider.

2.13 Server logs. Our hosting provider records each request to the Site and to the services the Application calls: the IP address it came from, the browser or application description it sent, the address requested and the time. We use these records only to run and secure URSA.

2.14 What we do not collect. URSA takes no payments, so we hold no payment information. The Application has no usage tracking and no advertising. We do not buy information about you, and we do not combine analytics or advertising data with your account.

3. How we use it

3.1 We use personal information to:

• create and run your account, and sign you in on the Site and in the Application;
• check what your account is entitled to, and deliver the Application and those plugins;
• send you account and service email: verification, password reset, and security and service notices;
• send you occasional email about URSA, only if you asked for it by ticking the box or otherwise gave us your consent;
• understand who uses URSA, from the optional profile answers, so we can improve it;
• understand how the Site is used, only if you accept Analytics, and measure our ads and show you URSA ads elsewhere, only if you accept Advertising (Section 4);
• count, across all accounts, how people move from sign-up to using the Application, so we can improve URSA. We do this in aggregate from account records and from the record of the Application's requests to our servers;
• investigate a problem you report;
• run, secure and troubleshoot URSA, and block automated abuse;
• keep a record of the consents you give us, as evidence that they were given; and
• comply with the law and enforce our agreements.

3.2 Consent. By creating an account you consent to the uses that providing it requires. Marketing email, Analytics and Advertising are separate, express consents: the box is unticked and the cookie banner unanswered until you choose, and you can withdraw any of them at any time (Sections 4.6 and 11). The profile questions can be left blank.

3.3 Marketing email. We do not send marketing email yet. When we do, every message will identify us, include our postal address and let you unsubscribe, and an unsubscribe will take effect within ten business days. You can withdraw your marketing consent at any time on your account page or by writing to us.

3.4 Account email. Verification, password, security and welcome messages, and the notice of a significant change to this policy (Section 14.2), are not marketing. We send them to every account holder whatever their marketing choice, for as long as the account exists. They stop when you delete your account.

3.5 What we do not do. We do not sell or rent personal information, and we do not build a profile of you. Advertising cookies run only if you accept them (Section 4.3), and we never give advertising platforms your name, email address or account identifier. The entitlement check is automatic, but it only confirms what your account is allowed to install.

3.6 Legal bases (EEA, United Kingdom and Switzerland). Where European or United Kingdom data protection law applies, we rely on:

• our contract with you, to run your account, check entitlements, deliver the Application and plugins, and send account email;
• your consent, for marketing email, Analytics and Advertising;
• our legitimate interests, to secure URSA and block abuse, answer your messages, learn from the optional profile answers, count in aggregate how people move from sign-up to using the Application, and keep consent records; and
• our legal obligations, where the law requires us to keep or disclose information.

4. Cookies, analytics and advertising

4.1 What the Site sets without asking. These are strictly necessary, and the cookie banner does not turn them off:

• __session keeps you signed in. It is set when you sign in, lasts 5 days, and the Site's scripts cannot read it.
• ursa_signed_in tells the Site's pages that you are signed in, so they show the right buttons. It lasts as long as your session.
• ursa_consent remembers your cookie choice for 13 months.
• The campaign details in Section 2.12, held in your browser's session storage until you finish signing up or close the tab.

4.2 Analytics, only if you accept. Analytics shows us which pages people use and where they get stuck, so we can make the Site better. We use Google Analytics, and it is off until you accept Analytics in the cookie banner: until then it is not loaded and nothing is sent to Google. If you accept, Google Analytics sets its own cookies (named _ga and _ga_ followed by an identifier, each lasting 13 months) and records the pages you view and the device, browser, approximate location and referral information it collects automatically. We see this only as totals across visitors. We never send your name, email address or account identifier to Google Analytics, and Google Signals, which would add information from Google accounts, is off.

4.3 Advertising, only if you accept. Advertising tells us which of our ads brought you to the Site, so we spend on the ones that work, and lets the platforms below show you URSA ads elsewhere, for example when a new feature you might be interested in comes out. We use Google Ads (including YouTube), the LinkedIn Insight Tag, the Meta Pixel and the Reddit Pixel. None of them is loaded until you accept Advertising in the cookie banner. If you accept, each sets its own cookies, for the periods its own policy sets, and receives the pages you view and the fact that you created an account, which it uses under its own privacy policy. We never send them your name, email address or account identifier.

4.4 Pages that load nothing optional. The page that confirms your email address or resets your password carries a one-time code in its address, and the pages that sign you in to the Application carry the details of that sign-in. Analytics and advertising never load on them, whatever you chose.

4.5 Sign in with Google. If you choose it, your browser connects to Google, which may set its own cookies under Google's privacy policy.

4.6 Changing your choice. Use Cookie preferences at the foot of every page. Turning a category off reloads the page, so nothing from it keeps running.

4.7 The overview video. The video on the home page loads from YouTube's privacy-enhanced domain, youtube-nocookie.com, only when you press play. YouTube's privacy policy applies to it.

4.8 The Application. The Application uses no cookies and has no analytics.

5. Who we share it with

5.1 Our Client Hub. Your account record and your entitlements are copied, read-only, to the Blue Rain Labs Client Hub, our own client management system, so that we can support you. The Client Hub is ours, not a third party. For URSA accounts this policy governs, and the Client Hub Privacy Policy describes that system's safeguards.

5.2 Service providers. We share personal information only with the service providers below, only as needed for the purpose shown, and under contracts that require them to protect it:

• Google Cloud and Firebase (Google LLC, United States): hosting of the Site and of the services the Application calls, sign-in through Firebase Authentication, the database that holds accounts, and storage of installers and plugins.
• Google (Google LLC, United States): Sign in with Google, if you choose it.
• Postmark (ActiveCampaign, LLC, United States): sending account email.
• Google Workspace (Google LLC, United States): our email, including our replies to you.
• Google Analytics (Google LLC, United States): measuring how the Site is used, only if you accept Analytics.
• Google Ads (Google LLC, United States): measuring our ads and showing URSA ads, only if you accept Advertising.
• LinkedIn (LinkedIn Corporation, United States): measuring our ads and showing URSA ads, only if you accept Advertising.
• Meta (Meta Platforms, Inc., United States): measuring our ads and showing URSA ads, only if you accept Advertising.
• Reddit (Reddit, Inc., United States): measuring our ads and showing URSA ads, only if you accept Advertising.

We will name our marketing email provider here before we send any marketing email.

5.3 When the law requires it. We disclose personal information when the law requires it, for example under a court order, warrant or subpoena, and only what is required.

5.4 Business transfer. If URSA or our business is sold, merged, reorganized or moved to a separate company, personal information may pass to the successor, which must protect it as this policy describes.

6. Where your information is stored

6.1 URSA runs on Google Cloud in the United States, and the providers in Section 5 also process information there. We do not store your information in Canada, and we do not claim to.

6.2 Information stored or processed outside Canada is subject to the laws of the country where it is held, and may be accessed by that country's courts, law enforcement and national security authorities.

6.3 The sign-in token, your settings and the diagnostic logs stay on your own device.

6.4 We develop and test URSA in a separate environment with test data only. Your information is not copied into it.

6.5 Transfers from Europe and the United Kingdom. The European Commission and the United Kingdom recognize Canada as providing adequate protection for personal information handled by commercial organizations under Canadian privacy law. Our service providers in the United States process it under data processing terms that include approved transfer safeguards, such as standard contractual clauses or the Data Privacy Framework.

7. How long we keep it

7.1 We keep personal information only as long as we need it for the purposes in this policy or the law requires, then delete it:

• Your account, profile answers and entitlements: while your account exists. You can delete your account from your account page at any time, and deletion takes effect immediately.
• The Client Hub copy: removed when you delete your account.
• Sessions: until you end them. A browser session also ends after 5 days, and a desktop session after 90 days without use.
• Marketing consent records: while your account exists. If we have sent you marketing email, we keep the record of your consent and of its withdrawal for 3 years after you withdraw it or delete your account, as evidence under Canada's Anti-Spam Legislation.
• Newsletter sign-ups that never become an account: 3 years after our last email to you, or until you unsubscribe.
• Problem reports: they reach us by email, so we keep them as email and support correspondence.
• Email and support correspondence: 2 years after the last message in the conversation.
• Email delivery records at Postmark: 45 days.
• Server logs: 30 days.
• Audit records of sign-ins, account changes and the Application's requests: 400 days.
• Google Analytics event data: 14 months.
• Advertising platforms: under their own retention policies (Section 7.4).

7.2 Backups. The database that holds accounts is backed up every day, and each backup is deleted after 7 days. Information you delete stays in backups until they expire, at most 7 days. If we ever restore a backup, we delete again anything that was deleted after it was taken.

7.3 On your device. Uninstalling the Application removes it from your device. Signing out removes the sign-in token.

7.4 Service providers. Google, Postmark, LinkedIn, Meta and Reddit keep the information they hold under their own retention policies and legal obligations.

8. How we protect it

8.1 We protect personal information with safeguards appropriate to its sensitivity, including:

• encryption in transit, and encryption at rest in the database that holds accounts;
• account data that only our server code can write. Your browser and the Application never write to the database directly, and the Application holds no server credentials;
• desktop sign-in through your browser, using a one-time code that expires after 2 minutes, so the Application never handles your password;
• a sign-in token kept in the Windows Credential Manager, not in a plain file;
• installers and plugins held in private storage and released only through links that expire after 5 minutes;
• plugins that are digitally signed and checked every time they load;
• a session list that lets you end any session. Changing your password or signing out everywhere cuts off the Application at its next request; and
• access to account records limited to the staff who need it.

8.2 No system is perfectly secure. If you think your information has been mishandled, tell us at privacy@bluerainlabs.com.

9. Security breaches

9.1 If a breach of our security safeguards involves personal information we hold, we contain it and assess whether it creates a real risk of significant harm to anyone. If it does, we report it to the Office of the Privacy Commissioner of Canada and to any provincial commissioner where the law requires, and notify the people affected as soon as feasible. Where European Union or United Kingdom law applies, we notify the regulator within 72 hours of becoming aware of the breach.

9.2 We keep a record of every breach, whether or not it had to be reported, for at least 24 months.

10. Artificial intelligence

10.1 The Site and the Application do not use AI to process your personal information. If that changes, we will update this policy before the change takes effect.

11. Your rights and choices

11.1 You may:

• ask what personal information we hold about you, how we use it and who we have disclosed it to, and get a copy;
• correct it, in your account page or by asking us;
• withdraw consent: turn marketing email off on your account page or by writing to us, and turn Analytics or Advertising off at any time (Section 4.6);
• see and end your signed-in sessions from your account page; and
• delete your account from your account page at any time.

11.2 How to ask. Write to privacy@bluerainlabs.com or to the address in Section 1.4. We will confirm your identity before disclosing or changing anything, and we respond within 30 days, or tell you within that time if the law allows us more. There is no charge.

11.3 Quebec residents have additional rights under Quebec law, including to receive personal information they provided to us in a structured, commonly used technological format.

11.4 EEA, United Kingdom and Switzerland. Blue Rain Labs Inc. is the controller of your personal information. In addition to the rights above, you may ask us to erase your information, to restrict or object to our use of it, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time. We respond within one month. You may also complain to your local data protection authority, which in the United Kingdom is the Information Commissioner's Office.

11.5 United States. We do not sell personal information. Advertising cookies, which let advertising platforms show you URSA ads elsewhere, run only if you accept them, and you can turn them off at any time from Cookie preferences (Section 4.6). Whatever state you live in, you may ask to access, correct, delete or receive a copy of your information, and we will not treat you differently for asking.

11.6 Complaints. Please contact our Privacy Officer first (Section 15). You may also complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or to your provincial privacy commissioner.

12. Other software and sites

12.1 The Launcher starts content creation software from other companies that is already installed on your device. We do not send those companies your information, and we receive none from that software. Their own privacy policies apply to your use of it.

12.2 The Site may link to other websites. Those sites have their own privacy policies, which apply once you follow the link.

13. Children

13.1 URSA is for adults and is not directed at children. You must be at least the age of majority where you live to create an account. We do not knowingly collect personal information from children. If you believe a child has created an account, tell us and we will delete it.

14. Changes to this policy

14.1 We may update this policy. Each version shows its version number and effective date, and we keep a copy of every version.

14.2 For a significant change we will post a notice on the Site and email account holders at least 30 days before it takes effect. If a change needs your consent, we will ask for it.

15. Contact and Privacy Officer

15.1 Our Privacy Officer, Aaron Wright, is accountable for our compliance with this policy. Contact the Privacy Officer at privacy@bluerainlabs.com or by post at the address in Section 1.4.

15.2 For anything else about URSA, email support@bluerainlabs.com.