Summary: We collect only what we need to operate our services. We do not sell your data. Student and minor data receives elevated protection. You can request deletion at any time by emailing privacy@bluepeaks.io.
1. Who We Are
Blue Peaks Innovations Inc. ("Blue Peaks", "we", "our", or "us") is a technology company federally incorporated in Canada. We operate the following services:
- VIA Connect — a SaaS platform for international student recruitment agencies, schools, and families.
- AI Studio — custom AI development and integration services for business clients.
- AI Governance Advisory — consulting services for responsible AI deployment.
Our registered contact for privacy matters: privacy@bluepeaks.io
2. Information We Collect
2.1 Information you provide directly
- Contact information: name, email address, phone/WhatsApp, country.
- Account credentials: email and hashed password (never stored in plaintext).
- Agency or institution information: organization name, country of operation, size.
- Student data (via VIA Connect): name, date of birth, passport details, academic records, visa documents, and other information required for international enrollment — provided by agencies or families using our platform.
- Communications: messages submitted via contact forms or email.
2.2 Information collected automatically
- Log data: IP address, browser type, pages visited, timestamps.
- Cookies: session authentication cookies (strictly necessary). We do not use third-party advertising cookies.
- Usage data: features used, actions taken within the platform (to improve the service).
2.3 Information from third parties
If you sign in via a third-party identity provider (e.g., Microsoft Entra ID / Azure AD), we receive your name and email from that provider, subject to their privacy policy.
3. How We Use Your Information
- To provide, maintain, and improve our services.
- To authenticate your identity and secure your account.
- To process transactions and send related communications.
- To respond to inquiries and provide customer support.
- To send service-related notifications (you can opt out of marketing communications).
- To detect and prevent fraud, abuse, or security incidents.
- To comply with legal obligations.
We do not use student data submitted through VIA Connect to train AI models or for any purpose other than operating the platform for the agency or institution that submitted it.
4. Legal Basis for Processing (GDPR / PIPEDA)
For users in the European Economic Area (EEA), United Kingdom, or other jurisdictions with similar legislation, we process personal data on the following bases:
- Contract performance — to provide services you have requested.
- Legitimate interests — to operate and improve our services, prevent fraud, and communicate with you.
- Legal obligation — to comply with applicable law.
- Consent — for optional marketing communications (withdrawable at any time).
For users in Canada, we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.
5. How We Share Your Information
We do not sell, rent, or trade personal information. We may share data with:
- Service providers acting as processors on our behalf (cloud hosting, email delivery, payment processing). These providers are contractually bound to use data only for the services they provide to us.
- Legal requirements — when required by law, court order, or governmental authority.
- Business transfers — in the event of a merger, acquisition, or sale of assets, personal data may transfer to the acquiring entity (with advance notice to affected users).
6. Data Retention
We retain personal data for as long as necessary to provide our services and comply with legal obligations. Specific periods:
- Active account data: retained for the duration of the business relationship.
- Audit logs: minimum 365 days from creation.
- Contact form submissions: up to 2 years.
- Student data in VIA Connect: per the agreement with the agency or institution; deleted within 30 days of a verified deletion request.
7. International Data Transfers
Blue Peaks operates primarily from Canada and may process data on servers located in Canada, the United States, and the European Union. When we transfer data outside the country of origin, we ensure appropriate safeguards are in place (e.g., Standard Contractual Clauses for EEA data).
8. Security
We implement industry-standard security measures including AES-256-GCM encryption at rest, TLS 1.3 in transit, multi-factor authentication, role-based access controls, and tamper-evident audit logging. No method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.
9. Children's Privacy
VIA Connect processes data about students, some of whom may be minors. This data is provided by accredited agencies and educational institutions acting in a professional capacity, who are responsible for obtaining appropriate consents under their local law. We apply heightened protections to student data and do not knowingly collect personal information directly from children under 13 without parental consent.
10. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Request deletion ("right to be forgotten").
- Restrict or object to certain processing.
- Data portability (receive your data in a structured, machine-readable format).
- Withdraw consent at any time (without affecting prior lawful processing).
To exercise any of these rights, contact us at privacy@bluepeaks.io. We will respond within 30 days.
11. Cookies
Our marketing website (bluepeaks.io) uses only strictly necessary session cookies for language preference and form state. No advertising or analytics cookies are set without your consent. Our platform (app.bluepeaks.io) uses authentication cookies required for login sessions.
12. Third-Party Services on This Website
The bluepeaks.io website loads resources from the following third-party services. When your browser requests these resources, the providers may receive your IP address and browser metadata. This occurs regardless of whether you have an account with us and is inherent to how the web works.
Google Fonts
We use Google Fonts to display typography (Instrument Serif, Figtree, JetBrains Mono, Noto Sans). Your browser makes requests to fonts.googleapis.com and fonts.gstatic.com to load these font files. Google may collect your IP address and HTTP request metadata as part of this process. This data is processed by Google LLC in accordance with their privacy policy.
Provider: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
Privacy policy: https://policies.google.com/privacy
Google Fonts data disclosure: https://developers.google.com/fonts/faq/privacy
Unsplash
The homepage of this website displays a photographic image served from Unsplash's content delivery network (images.unsplash.com). When your browser loads this image, Unsplash's servers may collect your IP address and standard HTTP request information.
Provider: Unsplash Inc., 500 rue Saint-Jacques, Montréal, QC H3C 1C6, Canada.
Privacy policy: https://unsplash.com/privacy
13. Changes to This Policy
We may update this Privacy Policy periodically. For material changes, we will provide notice via email or a prominent notice on our website at least 14 days before the change takes effect. Continued use of our services after the effective date constitutes acceptance of the updated policy.
14. Contact Us
For privacy questions, requests, or complaints:
- Email: privacy@bluepeaks.io
- Website: bluepeaks.io
If you are in the EEA and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.