Privacy Policy

1. Introduction

BlueSignal XYZ ("we", "us", "our") operates waterquality.trading. This Privacy Policy describes how we collect, use, store, and protect your personal information when you use this platform. The BlueSignal hardware site (bluesignal.xyz) and the BlueSignal Cloud dashboard have their own policy at bluesignal.xyz/privacy.

2. Information We Collect

Account Information: Name, email address, company or organization name, role selection (generator, buyer, utility, aggregator), a wallet address if you choose to link one, and authentication credentials managed through Firebase Authentication.

Device and Monitoring Data: Water production volume from inline flow sensors; water quality measurements from BlueSignal WQM-1 devices including pH, TDS, turbidity, temperature, and any optional probe fitted (such as ORP); device status and connectivity data; coordinates and geographic boundaries of enrolled sites.

Transaction Data: Credit purchase and sale history, credit type and quantity, listing details, rebate calculations and settlement records, payout history, and payment information processed through third-party providers.

Usage Data: Our servers keep their own page counts — which page path was viewed and which action was taken, with a timestamp and your current cookie choices. This uses no cookie and no identifier of any kind (no IP address, no browser fingerprint, no account) and cannot be linked to you. Our hosting providers keep short-lived request logs (IP address, browser type, requested URL) for security and reliability. Google Analytics collects page views and interaction data only if you allow analytics in Cookie preferences, and only if it is configured for the site.

Cookies and Local Storage: Firebase session cookies for authentication, local storage for your consent choices and app state, and analytics cookies only if you allow them in Cookie preferences — the link in the footer of every page, and the button below. The first-visit notice closes once you scroll; that closes the notice and turns nothing on. waterquality.trading loads no advertising pixel. bluesignal.xyz can load Meta and Reddit advertising pixels, but only after you allow advertising there — never by default, and never when your browser sends Global Privacy Control.

3. How We Use Your Information

We use your information to: operate and maintain the Platform and your account; process credit transactions, calculate rebates, and facilitate settlements; verify water production and quality data through our three-layer verification system; generate, validate, and issue nutrient credits (AWG credits); communicate about your account, transactions, and Platform updates; improve Platform functionality, reliability, and user experience; comply with legal and regulatory obligations; detect, prevent, and investigate fraud, unauthorized access, or other prohibited activities.

4. How We Share Your Information

We do not sell your personal information. We may share data with the following categories of recipients:

Utilities and Municipalities: Aggregated production and credit data necessary for rebate program administration. Personal information is not shared without your consent.

Verification Partners: Site location, device data, and monitoring records required for independent third-party verification and laboratory analysis.

Service Providers: Firebase (Google) for infrastructure, Cloudflare for CDN and security, Resend for email delivery, OpenStreetMap for map tiles, and Stripe for payment processing where a purchase is enabled.

Legal Requirements: When required by law, court order, subpoena, or government request, or to protect the rights, safety, or property of BlueSignal, our users, or the public.

5. Data Security

We implement industry-standard security measures including: encryption of all data in transit using TLS 1.2+; encryption of data at rest through Firebase and cloud provider encryption; authentication managed through Firebase with secure token-based sessions; role-based access controls limiting data access to authorized personnel; regular security assessments and vulnerability reviews; monitoring for unauthorized access attempts.

6. Data Retention

We retain your data according to the following schedule: account data is retained for the life of your account plus three (3) years after deletion; transaction records are retained for seven (7) years to meet regulatory and audit requirements; monitoring and device data is retained for the verification period plus two (2) years; our own page counts contain no identifier and are kept in aggregate; Google Analytics data, if you allowed it, is retained under the retention setting of our Google Analytics property. You may request deletion of your personal data at any time, subject to our legal retention obligations.

7. Third-Party Services

The Platform integrates with the following third-party services, each subject to their own privacy policies: Firebase (Google) for authentication, real-time database, and hosting; Cloudflare for CDN, DDoS protection, and edge optimization; Resend for transactional email; OpenStreetMap, whose tile servers your browser contacts directly on map pages (they see your IP address and the map area requested); the Texas Water Development Board, whose public desalination dataset the map page queries directly from your browser; Stripe for payment processing (when enabled); Livepeer for video upload and streaming, if you upload media.

8. Your Rights

Depending on your jurisdiction (including rights under CCPA, GDPR, and other applicable laws), you may have the right to: access the personal information we hold about you; correct inaccurate or incomplete information; request deletion of your personal data; export your data in a portable, machine-readable format; opt out of certain data processing activities; withdraw consent where processing is based on consent; lodge a complaint with a supervisory authority. To exercise any of these rights, contact us via our Contact page or email privacy@bluesignal.xyz. We will verify the request and respond within the time applicable law allows.

9. Children's Privacy

The Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected data from a minor, we will promptly delete it.

10. International Transfers

Your data may be processed and stored in the United States and other countries where our service providers operate. By using the Platform, you consent to the transfer of your information to these jurisdictions, which may have different data protection standards than your country of residence.

11. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, services, or legal requirements. Material changes will be communicated through the Platform or via email at least thirty (30) days before they take effect. The "Last Updated" date at the top of this page indicates when the most recent revision was made.

12. Contact

For privacy questions or to exercise your data rights, visit our Contact page or email us at privacy@bluesignal.xyz.