This Privacy Policy explains how Behind The Product Consulting LLC ("BTP", "we"), a Washington limited liability company at 522 W Riverside Ave, Ste N, Spokane, WA 99201, USA, handles personal data and customer content in the Blueprint invite-only beta (the "Service"). It forms part of the Blueprint Terms of Service. Where you have a signed NDA with BTP, the NDA controls on confidential information.
0. Where the Service is offered
The Service is offered only in the United States and India. It is not offered in, and may not be used from, the EU/EEA, the UK or Switzerland, and this policy does not provide GDPR or UK GDPR terms.
1. Who is responsible
BTP decides how and why personal data in the Service is processed (the "data fiduciary" under India's DPDP Act, and the business or controller under US law). Contact: Behind The Product Consulting LLC. Privacy requests: hello@gobehindtheproduct.com. General and legal notices: contact@gobehindtheproduct.com. This contact also acts as grievance officer for India.
2. What we collect
- Account data: at sign-up we collect only your email address and country; we also record your program role (owner, adviser, viewer) and sign-in times. Source: you, or the person who invited you.
- Customer content: typed or pasted product problems, requirements, design and blueprint descriptions, BOMs, cost data, decisions and AI assistant conversations. Source: you and your invitees.
- AI-call log: model, token counts, timing and estimated cost of each AI call, with no prompt or response text. Source: generated by the Service.
- Technical data: IP address, browser, device and request logs, and essential sign-in cookies. Source: collected automatically via our hosting and sign-in providers.
The Service's code includes no analytics, advertising or error-tracking tools, and we do not sell or share personal data for advertising. Our hosting provider may record standard request logs and aggregated performance data as part of operating its platform.
File uploads. The beta does not accept file uploads; content is typed or pasted. If uploads are added, this policy will be updated before they are enabled. We do not ask for health, financial-account, biometric or other sensitive data; please don't enter it.
3. Why we use it
- To provide the Service: sign-in, storing your programs, running the AI interviewer, recommendations and reviews, and showing provenance.
- To secure the Service, prevent abuse and fix problems.
- To communicate with you about the beta, including changes and incidents.
- To meet legal obligations.
Export-controlled data. Do not enter data controlled under ITAR, the EAR or India's SCOMET list; see the Terms of Service.
Legal basis. For users in India, we process personal data on the basis of your consent, given when you accept the invitation, and for the legitimate uses the DPDP Act permits. You may withdraw consent at any time (section 7), which ends your use of the Service.
4. AI and no training
Customer content you send to the assistant is processed by the AI provider selected for each job (by default Anthropic's Claude models; an administrator can select Google's Gemini models). No files are sent to AI providers. We do not use your content to train or fine-tune any model. BTP uses only paid, commercial API tiers (never free or consumer keys, including for Gemini), and only providers whose terms prohibit training on API data and let BTP control retention and deletion. BTP has not set a zero-data-retention arrangement, so providers may retain API inputs and outputs briefly for abuse and safety monitoring under their terms, and then delete them. Our AI-call log keeps only the model, token counts, timing and cost.
5. Subprocessors
- Vercel Inc.: application hosting and delivery. Data: all data in transit and request logs. Location: Vercel's global edge network, with application processing in the region configured for the Service.
- Supabase Inc.: Postgres database (no file storage) and magic-link sign-in via Supabase Auth. Data: account data, customer content and AI-call metadata. Location: US West (N. California, us-west-1).
- Anthropic PBC: Claude AI models (interviewer, recommendations, reviews). Data: content sent in AI requests. Location: US.
- Google LLC: Gemini AI models, only if selected by an administrator, on a paid tier. Data: content sent in AI requests. Location: US / Google global infrastructure.
- Hostinger: DNS for behindtheproduct.pro. Data: no customer content. Location: EU / global.
- Sign-in email delivery (Supabase Auth's email service or an email delivery provider engaged by BTP): delivering sign-in emails. Data: email address. Location: the provider's infrastructure.
Voyage AI (embeddings) is used only for BTP's own reference material and never receives customer content, so it is not a subprocessor. We give at least 30 days' email notice before adding or replacing a subprocessor that receives customer content, and 14 days' notice for any other.
6. International transfers (US and India)
BTP and all of its subprocessors that store customer content are in the United States. If you are in India, your data is transferred to and processed in the US. The DPDP Act allows transfers outside India except to countries the Government of India restricts by notification; the US is not restricted at the time of writing. We protect transferred data with the measures in this policy and our providers' contractual terms.
7. Your rights and choices
You may ask us to: access a summary of your personal data and how we process it; correct or update it; export your programs; delete your account and programs; withdraw consent; nominate another person to exercise your rights if you die or become incapacitated (India); or complain. Email hello@gobehindtheproduct.com. We respond within 30 days. You can also close your account yourself in the Service at any time. When you close it, you can choose "delete now" to delete your account and content from the live Service immediately; otherwise your data is deleted within one (1) year after the account closes. If you ask us by email instead, we complete deletion from the live Service within 14 days of your request. "Delete now" does not remove messages you wrote in programs owned by someone else; those messages stay in that program, linked to your user ID. If you are in India and are not satisfied, you may complain to the Data Protection Board of India once it is operational for your request. Residents of US states with privacy laws may have similar rights; we honour them for all users.
8. Retention and deletion
- Account and program data: kept while your account is active. You can close your account in the Service at any time and choose "delete now" for immediate deletion from the live Service; otherwise data is deleted within one (1) year after the account closes. Deletion requests sent by email are completed within 14 days.
- Where an NDA applies, its return-and-destruction terms override these periods (for Pontala SafeTech: destruction within 14 days of a written request).
- Deleting a program also deletes its assistant conversations, proposals and memberships.
- AI-call log: keeps only model, token, timing and cost metadata with no content, and is kept only as long as reasonably needed for accounting and running the Service.
- Backups: held by our database provider for a limited period and overwritten in the ordinary course; not restored except to recover the Service.
- AI providers: per section 4.
- Terms acceptance records (user ID, email, country, the document versions accepted, timestamp, IP address and browser user agent): kept for the life of your account plus 2 years.
- Closed-account records: a minimal record of each closed account (email, closure date and purge date) is kept to administer deletion and prevent re-registration abuse.
- Records we must keep by law, kept only as long as required.
9. Security
Encryption in transit and at rest (provider-managed), invite-only magic-link sign-in, per-program access checks on the server, row-level security preventing direct browser database access, server-only secrets and logging. Only members of a program can view it in the Service; BTP administrators cannot open a program they are not a member of. The server can technically read all data, and access to the systems behind it is limited to BTP personnel who need it. Test and preview versions cannot use the production database. We will notify affected users within 72 hours of confirming a breach affecting their data and, where required, the Data Protection Board of India, of a personal data breach without undue delay.
10. India – Digital Personal Data Protection Act, 2023 (in brief)
For users in India, BTP processes digital personal data under the DPDP Act: on the basis of notice and consent; for the stated purposes only; keeping it accurate and secure; deleting it when the purpose ends or consent is withdrawn; reporting breaches; and honouring the rights of access, correction, erasure, grievance redressal and nomination. The Service is not directed to children under 18 and we do not knowingly process their data. Some obligations under the DPDP Act and the Digital Personal Data Protection Rules, 2025 take effect in phases; we will meet each obligation as it comes into force.
11. Washington My Health Data Act
The Service is not designed to collect consumer health data, and we do not knowingly collect it. Product designs for safety or wearable products (for example, product specifications describing sensors) are product data, not health data about a consumer. If that changes, for example if users upload test data about identifiable people, we will update this policy and obtain the consent the Act requires before collecting it.
12. Children
The Service is for businesses and is not intended for anyone under 18.
13. Changes
We will email you at least 14 days before a material change.
Contact: Behind The Product Consulting LLC, 522 W Riverside Ave, Ste N, Spokane, WA 99201, USA · Privacy requests: hello@gobehindtheproduct.com · General and legal notices: contact@gobehindtheproduct.com