privacy policy.

the short version

this summary is provided for convenience only and does not limit the full policy that follows.

• there are no accounts and no logins, so we do not hold a profile of you as a visitor.
• search runs on your own device. your saves and settings stay in your own browser and are never sent to us.
• we record what people search for and which profiles are opened, without names, emails, ip addresses or any other identifier, and combine it into totals.
• if you choose to get found, we keep what you submit so we can review, publish and maintain your profile, and we read the public pages you link to so people can find you.
• we never sell personal information, we do not share it for targeted advertising, there are no ads, and there is no cross-site tracking.
• wherever you live, you can ask us what we hold about you, and ask us to correct or delete it.

1. who we are and what this policy covers

1.1 controller. this privacy policy (this "policy") describes how A BLEUUE CONCEPT LLC, an indiana limited liability company (bleuue.house) (the "company", "we", "us" or "our"), collects, uses, discloses, retains and protects personal information in connection with aayla, a brand of the company, including the website at aaylas.com, its forms and functions, its emails and the threads account @aayla.shah when used to operate the service (together, the "service"). for the purposes of the eu and uk general data protection regulations, the company is the controller of the personal information described in this policy.

1.2 relationship to other documents. this policy forms part of our terms of use. our use of browser storage is described in our cookie policy. terms not defined here have the meanings given in the terms.

1.3 what this policy does not cover. this policy does not apply to third-party platforms you reach through the service, such as threads, instagram, tiktok, cash app or the websites of listed people, each of which is governed by its own privacy policy.

2. information we collect

2.1 when you browse and search. the search index is downloaded to your browser and your searches are matched on your own device. after a search completes, your browser sends us a short record containing the search phrase, the number of results, the handles of up to twelve profiles shown, and up to six words the service did not recognize. when you open a profile, your browser sends us the handle of that profile. these records contain no name, email address, ip address, device identifier or other identifier, are held briefly in a storage buffer, and are then combined into totals: counts per search phrase and unrecognized word, and counts per profile of how often it was shown ("found") and opened.

2.2 information received by our host. as with any website, our hosting provider receives the technical information that your browser transmits with every request, including your ip address, browser type and version, operating system, referring page, requested url and the date and time of the request, in order to deliver the service, and may retain it in short-lived logs for security and reliability. we do not use this information to identify or track you.

2.3 rate limiting. to prevent spam and abuse, our servers count the requests made to our forms and functions. for this purpose your ip address is combined with the current hour (and, for the support assistant's daily limit, the current day) and transformed by a one-way cryptographic hash. only the resulting value and a count are stored; your ip address itself is not. because the hour or day forms part of the input, the value changes every period and cannot be linked across periods, and it is deleted after the period ends.

2.4 on your device only. the following stays on your device and is never sent to us: saved profiles, recent searches, filters, display preferences, the profiles you have opened (used to personalize the home page in your browser), a chosen city and acknowledged notices, all as listed in the cookie policy. if you use "use my location", your browser asks your permission, and your coordinates are compared on your device against a list of cities to select the nearest one; your coordinates are never sent to us, and only the city name is stored, in your browser.

2.5 when you get found. if you submit a profile, through the get found form or by direct message to @aayla.shah, we collect: your name, or your name together with your business name; your headline and descriptions of what you make, offer and are known for; the words people might use to find you; your style, materials and audience; whether you offer products, services or both, and price indicators; your city, state and country; the ways you work (for example, ships, mobile or virtual); any optional self-declared identity descriptors you choose (see section 3); your links (threads, instagram, tiktok, website and others); your email address; up to six photographs; and whether you arrived through a nomination. we also generate and store, with your submission: a handle derived from your links or name; a key that links your submission to the email check described below; suggested categories; words the service did not recognize; and review flags produced by automated checks for human attention. to confirm that the email address is yours, we email you a 6-digit code, which you type on the next screen; we keep only a one-way hash of the code, beside your email address, for 30 minutes, and record on your submission that the email was confirmed. your email address is used to send you that code, your link to edit your page and notices about your page, and is never shown on the service. if you contact @aayla.shah by direct message, we receive your threads handle and the content of your message through threads.

2.6 photographs. photographs are resized on your device before upload and are accepted only in common image formats. each is stored with its file type and upload time under a randomly generated identifier, and, when your submission is saved, is copied into our database as an attachment to your profile.

2.7 information we read from your public links. when you paste a link into get found, our servers may retrieve that public page to prefill your name, description and photograph. when you submit, or when we prepare a profile on your behalf, our servers retrieve the publicly accessible portions of the links you list, including page titles, descriptions, headings and visible text, and store the text with your submission to suggest categories for human review and to improve search matching. we never access private accounts, private messages, password protected pages or addresses on private networks.

2.8 when you edit your page. if you enter an email address to request an edit link, we use it only to look up whether it matches an approved profile and, if it does, to send the link. we do not store the address you enter or the link itself. the link is cryptographically signed, contains the internal record identifier of your profile, expires after one hour, and stops working once you save a change. when you save, we record the changes and the time of the edit, and keep a short log of which parts of your page changed and when. the time of your most recent edit is published as part of your profile data so that recently updated pages can be shown as new. a message you write for your page is checked automatically for unkind or inappropriate words and, if it passes, is published immediately and stored by our hosting provider so that it appears before the site next updates. to stop anyone flooding an inbox with links, each address entered is combined with the current hour and transformed by a one-way cryptographic hash, and only that value and a count are kept, for that hour only, as described in section 2.3.

2.9 when you recover access to your page. if you no longer have access to the email address on your profile and ask to replace it, we collect your handle, the new email address you provide and a verification code, and we receive your direct message containing that code through threads. we use this information solely to confirm, by hand, that the request comes from the profile owner and, if approved, to update your profile. when the email address on a profile is replaced, we send a one-time notice to the previous address with a link to stop the change, so that a profile owner learns of a change they did not make.

2.10 pages we prepare from public posts. we may prepare a profile for a person who offers work or services to the public, using only information that person has made public, such as their name, handle, public bio, public links, a public description of their work and, where included, public posts or photographs they published. such a profile says that we put it together from public posts until the person claims it. if you claim it, we read the public bio of the threads account or the home page of the website already listed on the profile for the code we gave you, without storing the text we read, and we record the email address you provide, the time of the claim and how it was confirmed. if you ask us to take it down, we record the time and any note you choose to add, and the profile is hidden from the service right away.

2.11 notifications. notifications are off unless you turn them on. when you do, your browser gives us an address for sending you notices through its push service (google, apple, mozilla or microsoft, depending on your browser), and we keep it together with what your browser sends to tailor them: the kinds of work, styles and details of profiles you saved or opened, the city you chose, searches you ran on this device that found nobody, and your time zone, so notices only arrive between 9am and 9pm. if you turn on vouch notices for your own page, we also keep which page is yours, confirmed with your edit link. this information has no name or email attached. we use it only to decide which notices to send you, it is refreshed about once a day while you use aayla, and it is deleted when you turn notifications off, when your browser stops accepting them, or 90 days after your browser last checked in. the content of each notice passes through your browser's push service. when someone new is published, their public profile and the text of searches that found nobody, with nothing that identifies who searched, may be sent to anthropic, pbc, our artificial intelligence provider, which suggests a short description of their work, related kinds of work, and which of those searches they answer; that answer is kept with the new profile and used only to choose and word notifications. notices you receive may also be written and sent by us by hand.

2.12 when you ask us to find someone. if a search finds no one and you ask us to find someone, we collect what you were looking for, where, and, optionally, your email address. requests for the same thing in the same place are combined into a single record with a count.

2.13 when you put someone forward. if you recommend (nominate) someone, we collect what you write about them in your own words, and the details you confirm: their name, their social media handle, what they do, their city and any note about why you recommend them, together with the number of times and the most recent time that person was recommended. what you write in your own words may be sent to anthropic, pbc, our artificial intelligence provider, which suggests those details for you to check, and your note may be sent to it to write the one line that opens their invite. each recommendation gets its own invite link, which opens that person's invite page. the page shows their first name, what they do, their city, how many people recommended them, and the lines written from recommenders' notes, never who wrote them. if you choose to give the person's email address, we use it once to send them that invite, and keep only a one-way hash of it, so we never send them more than one invite a month and never again once they tell us not to. if you have a page on aayla and choose to give the email on it, we email you a link to confirm the recommendation was yours; once you confirm, the recommendation is linked to your page, and once the person you recommended joins, the number of people you brought to aayla may be shown on the service, for example in a list of people keeping aayla growing. otherwise we do not ask for, and do not record, the identity of the person recommending. if you are the person recommended, we obtained your information from a visitor who put you forward, and from your public profile on threads.

2.14 when you subscribe or suggest. if you sign up for updates, we collect your email address, the page you signed up from, the time and your subscription status. if you suggest a filter or category, we collect the suggestion, the group it belongs to and the time, without any identifier. whenever you give us an email address on any form, we first check that its domain can receive mail by looking up that domain's public mail records. only the part after the @ is used for this check, and its result is not linked to you.

2.15 when you use the support assistant. written answers are selected within your browser. where no written answer applies and generated answers are enabled, the text of up to your six most recent messages in the conversation, each limited to 400 characters, is sent from our servers to our artificial intelligence provider to produce a reply. we do not store support conversations and we do not associate them with your identity.

2.16 when you donate. donations are made through cash app or other third-party payment providers. we receive only the information the provider makes available to us as recipient, such as a display name or cashtag, the amount and the date. we never receive your card or bank account details.

2.17 when you vouch for someone. a vouch records only that a visitor would recommend a listed person, together with up to two reasons chosen from a fixed list. no name, account, free text or other identifier is collected. to limit each visitor to one vouch per listed person per day, our servers store a one-way hash of your ip address combined with the date and the profile, which cannot be reversed and is deleted the following day. totals are published on the listed person's page and cards. your browser also remembers the profiles you vouched for that day, as described in the cookie policy.

2.18 when you look up a place or view a map. when you type a city in get found or edit your page, the text you type is sent by our servers, not your browser, to the openstreetmap-based photon geocoding service to suggest matching towns. maps on profiles are assembled from openstreetmap tiles that our servers fetch and cache, so your browser does not connect to openstreetmap. if you open a profile's map link, you leave the service for openstreetmap.org, which has its own policies. to start the "people near you" row and the city question in get found in the right place, your browser may ask our servers for your approximate location. our hosting provider estimates the city, region and country of each request from its ip address, and our servers return that estimate to your browser without storing it. your browser keeps it only for the current tab and uses it to pick the nearest city. you can change the city at any time.

2.19 when you contact us. if you email us or send a direct message to @aayla.shah, we receive your email address or handle and the content of your message, together with any information you choose to include.

2.20 when a search finds no one. if a search returns no exact match and search assistance is enabled, the text of that search, and nothing else, is sent from our servers to our artificial intelligence provider, which suggests a rewording in terms of the crafts and services on the service. no ip address, location, saved people or other information about you is sent with it. the search and its rewording are stored without any identifier so the same search can be answered again, and the search is counted toward a per-visitor hourly limit using the same one-way hash of your ip address described for other limits.

3. sensitive information

3.1 self-declared identity descriptors. profile owners may choose to describe their business with identity descriptors such as black-owned, latino-owned, asian-owned, indigenous-owned, lgbtq-owned or disabled-owned. these descriptors may reveal racial or ethnic origin, sexual orientation or disability, which are treated as sensitive personal information or special category data under various laws. selecting a descriptor is entirely optional. by selecting one, you expressly consent to our processing it for the sole purposes of publishing it on your profile and making your profile findable by it. we do not use it for any other purpose, do not use it to infer characteristics about you, and do not disclose it except by publication at your direction. you may withdraw your consent at any time by asking us to remove the descriptor at bleuue@bleuue.com; withdrawal does not affect processing before it.

3.2 no other sensitive information. we do not request government identification numbers, financial account details, precise geolocation, biometric data, health data or account credentials. please do not include any such information in a submission, request, nomination, search or support message.

4. how we use information

we use personal information only for the following purposes:

1. to operate the service: to review, verify, publish, display and maintain profiles; to generate city pages, curated lists and the public search index from approved profiles; to issue edit links and process edits and access recovery requests; and to send approval notices, edit links and request notifications;
2. to improve search: to learn which words people use, which searches find no one, and which words profile owners use for their own work, so that the vocabulary can be extended by hand;
3. to inform profile owners: to maintain aggregate counts of how often each profile is found and opened, to display a found count on profiles that reach a threshold, and, if we enable it, to send profile owners with an email address a periodic note of those counts;
4. to find people: to act on requests and nominations, including by posting requests on threads without any email address and by contacting nominated people;
5. to communicate: to respond to your messages and to send updates you asked for;
6. to answer support questions through the support assistant;
7. to keep the service safe: to prevent and detect spam, fraud, impersonation and abuse, to enforce rate limits and our terms, and to filter profane and offensive language;
8. to comply with law and to establish, exercise or defend legal claims, and to protect the rights, safety and property of the people on the service, the public and the company.

4.1 no advertising, profiling or automated decisions. we do not use personal information for advertising, we do not build profiles of visitors (other than the interests your browser shares if you turn on notifications, as described in section 2.11, which are used only to choose which notices to send you), and we do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects. search results are produced and ordered by a deterministic matching system, not by artificial intelligence. where a search finds no exact match, its text may be reworded with the help of an artificial intelligence provider, as described in section 2.20, and the reworded search is matched by the same system. automated checks may flag submissions for closer human review, and may cause submissions that appear to come from automated software not to be saved, but every decision to approve or decline a profile is made by a person.

5. legal bases for processing (eea, uk and switzerland)

if you are in the european economic area, the united kingdom or switzerland, we rely on the following legal bases:

where we rely on legitimate interests, we have balanced those interests against your rights and freedoms, taking into account the limited nature of the information and the safeguards described in this policy. you may ask us for more information about this balancing.

6. what is public

6.1 approved profiles. when your profile is approved, the following becomes publicly available on the service and in the public search index that visitors' browsers download: your name, handle, headline, descriptions, the words people might use to find you, categories (including any identity descriptors you selected), city, state and country, links, photographs, price indicators, open status, any threads post selected for embedding, the date you joined, whether you are featured, and your found count. keywords derived from the text we read from your links are included in the search index but are not displayed on your profile. search engines may index your profile unless you ask us to hide it from them, and anyone may copy or share public information. we cannot control copies made by others.

6.2 never public. your email address, verification code, review flags, the full text read from your links, suggested categories, unrecognized words, view counts and our review notes are never published.

6.3 public search phrases. search phrases that returned results and that the service fully understood may be displayed on the service as recent searches, without any link to who searched. you should not enter personal information into the search field.

6.4 requests. the substance of a request (what and where) may be posted publicly on threads. your email address is never posted.

7. service providers and other disclosures

7.1 service providers. we disclose personal information to the following service providers, which process it on our behalf to provide services to us, under terms that restrict their use of it:

meta, google, cash app (block, inc.) and other third-party platforms may also act as independent controllers of information they collect directly from you under their own privacy policies.

7.2 nominated people. a recommended person's invite page, and any invite we email them, may show the note a recommender wrote, quoted or written as a short line in our own words, but never the recommender's identity. a recommender who has confirmed a recommendation from their own page is never named to the person they recommended.

7.3 legal and safety disclosures. we may disclose information where we believe in good faith that disclosure is required by law, regulation or valid legal process; to protect the rights, property or safety of any person, the public or the company; to investigate or prevent fraud, abuse or violations of our terms; or with your direction or consent.

7.4 business transfers. if the company is involved in a merger, acquisition, reorganization, financing, bankruptcy or sale of all or part of its assets, information may be transferred as part of that transaction, subject to this policy or a policy at least as protective of it.

8. no sale, no sharing, no targeted advertising

we do not sell personal information, and we have not sold personal information in the preceding twelve months. we do not "share" personal information for cross-context behavioral advertising, and we do not process personal information for targeted advertising, as those terms are defined under california and other state privacy laws. we do not display advertising, we do not use advertising cookies, pixels or other cross-site tracking technologies, and we do not use fingerprinting. we have no actual knowledge of selling or sharing the personal information of anyone under 16. we do not disclose personal information to third parties for their own direct marketing purposes.

9. retention

we retain personal information only for as long as reasonably necessary for the purposes described in this policy, as follows:

information retained in de-identified or aggregate form is maintained in that form, and we do not attempt to re-identify it.

10. your choices

• you can delete everything stored in your browser by clearing site data for aaylas.com, as described in the cookie policy.
• you can deny or revoke location permission in your browser at any time.
• you can unsubscribe from updates using the link in any email or by emailing bleuue@bleuue.com.
• profile owners can edit their profile through an edit link, and can ask us to correct or remove it, to remove an identity descriptor, to stop reading their links, or to hide it from search engines, by emailing bleuue@bleuue.com.
• you can turn notifications off at any time from the link at the bottom of any page or in your device settings, and we delete what we kept for them.
• if we prepared a page about you from your public posts, you can claim it, or have it taken down right away with no questions, using the links at the bottom of that page.
• a nominated person who does not wish to hear from us can tap "not for you" in the invite email, which stops all further invites, or email bleuue@bleuue.com and we will delete the nomination.

11. united states privacy rights

11.1 applicable laws. residents of certain states have rights under laws including the california consumer privacy act as amended by the california privacy rights act (ccpa/cpra), the colorado privacy act, the connecticut data privacy act, the virginia consumer data protection act, the utah consumer privacy act, the texas data privacy and security act, the oregon consumer privacy act, and comparable laws of delaware, indiana, iowa, kentucky, maryland, minnesota, montana, nebraska, new hampshire, new jersey, rhode island, tennessee and other states. regardless of whether a particular law applies to the company, we will honor requests to know, access, correct and delete personal information from any person, wherever they live.

11.2 your rights. subject to applicable law, you may have the right to:

1. confirm whether we process your personal information and access it, including the categories and specific pieces of personal information we hold, the categories of sources, the purposes, and the categories of recipients;
2. obtain a copy of your personal information in a portable and, where technically feasible, readily usable format;
3. correct inaccurate personal information;
4. delete personal information we hold about you;
5. opt out of the sale of personal information, sharing for cross-context behavioral advertising, targeted advertising, and profiling in furtherance of decisions producing legal or similarly significant effects (we do none of these);
6. limit the use of sensitive personal information (we use it only to publish it at your direction, as described in section 3);
7. withdraw consent to the processing of sensitive data;
8. obtain a list of the specific third parties to which we have disclosed personal information, where required by law;
9. appeal a decision regarding your request;
10. be free from discrimination or retaliation for exercising any of these rights.

11.3 how to make a request. email privatestudios@bleuue.com with the subject "privacy request", describing your request. because there are no accounts, we will verify your request by matching information we already hold, for example by asking you to write from the email address on your profile or to send a message from the account listed on your profile. we will not ask for more information than is necessary to verify you. please note that for visitors who have not submitted anything, we generally hold no information that can be associated with you, because searches and views are recorded without identifiers.

11.4 authorized agents. you may designate an authorized agent to make a request on your behalf. we may require the agent to provide written permission signed by you and may require you to verify your identity directly with us, except where the agent holds a valid power of attorney.

11.5 timing. we will acknowledge and respond to verified requests within the period required by applicable law, generally within 45 days, which may be extended by a further period where permitted, in which case we will tell you why.

11.6 appeals. if we decline to act on your request, in whole or in part, you may appeal by replying to our response with the subject "privacy appeal" within a reasonable time. we will respond to your appeal in writing within the period required by applicable law, explaining our decision. if your appeal is denied, you may contact the attorney general of your state.

11.7 california notice at collection. in the preceding twelve months we have collected the following categories of personal information, as defined in the ccpa: identifiers (such as name, handle, email address, and ip address as received by our host and transiently for rate limiting); personal information described in california civil code section 1798.80(e) (such as name and email address); characteristics of protected classifications (only self-declared identity descriptors); commercial information (limited donation information made available by payment providers); internet or other electronic network activity information (search phrases and profile views recorded without identifiers); audio, electronic, visual or similar information (photographs); and professional or employment related information (the nature of your work or business). we collect these from you, from your device, from the public pages you link to, and, for nominated people, from nominators and public threads profiles. we use them for the purposes in section 4, retain them as described in section 9, and disclose them for business purposes to the service providers in section 7. we do not sell or share any category of personal information. sensitive personal information (identity descriptors) is used only for purposes permitted under the ccpa regulations, and is not used to infer characteristics. we do not collect precise geolocation.

11.8 no financial incentives. we do not offer any financial incentive or price or service difference in exchange for personal information.

11.9 california shine the light. we do not disclose personal information to third parties for their own direct marketing purposes.

11.10 nevada. we do not sell covered information as defined under nevada law.

12. rights in the eea, uk and switzerland

if you are in the european economic area, the united kingdom or switzerland, you have the right, subject to applicable law, to access your personal data; to rectify inaccurate data; to erase your data; to restrict processing; to data portability; to object at any time to processing based on our legitimate interests; and, where processing is based on consent, to withdraw your consent at any time without affecting the lawfulness of processing before withdrawal. you are not subject to decisions based solely on automated processing that produce legal or similarly significant effects. to exercise these rights, email privatestudios@bleuue.com. you also have the right to lodge a complaint with the data protection supervisory authority where you live or work or where an alleged infringement occurred, including, in the united kingdom, the information commissioner's office. providing information to us is voluntary; however, if you do not provide the information required to submit a profile, we cannot review or publish it.

13. children

the service is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13, in accordance with the children's online privacy protection act. profiles may be submitted only by people 18 or older, and our automated checks flag submissions that suggest the submitter may be a minor for closer human review. if we learn that we have collected personal information from a child under 13, or a profile submitted by a person under 18, we will delete it. if you believe a child has provided us with information, contact privatestudios@bleuue.com.

14. security

we maintain reasonable administrative, technical and physical safeguards appropriate to the nature of the information, including encrypted connections, access to our database and providers limited to authorized personnel, cryptographically signed and time limited edit links that reveal nothing about whether an email address is on a profile, one-way hashing in place of ip addresses for rate limiting, refusal to retrieve addresses on private networks, and, above all, collecting as little as possible. no method of transmission or storage is completely secure, and we cannot guarantee absolute security. if we become aware of a security incident affecting your personal information, we will notify you and the relevant authorities where and as required by law.

15. international transfers

the company is located in the united states, and the service is operated from the united states. information is processed in the united states and in other countries where our service providers operate, whose data protection laws may differ from those of your country. where we transfer personal data from the european economic area, the united kingdom or switzerland, we rely on the transfer mechanisms available under applicable law, such as the standard contractual clauses incorporated in our service providers' data processing terms, where applicable. you may request further information about these safeguards by contacting us.

16. do not track and global privacy control

16.1 global privacy control. we treat a global privacy control signal sent by your browser as a valid request to opt out of the sale and sharing of your personal information and of targeted advertising, for that browser. because we do none of these things, the signal requires no change in how the service operates, and we will not ask you to confirm it.

16.2 do not track. there is no common industry standard for responding to do not track signals. because the service does not track visitors across websites or over time, it operates the same way whether or not your browser sends such a signal.

17. changes to this policy

we may update this policy from time to time. when we do, we will update the "last updated" date displayed with it. if we make a material change, we will provide notice on the service before it takes effect and, where required by law, obtain your consent. we will not use personal information in a manner materially different from what we stated at the time of collection without notice and, where required, consent.

18. contact

A BLEUUE CONCEPT LLC, an indiana limited liability company (bleuue.house), operator of aayla.

• privacy requests, appeals and legal notices: privatestudios@bleuue.com
• general questions, profile changes and removals: bleuue@bleuue.com

if you have difficulty accessing this policy because of a disability, contact bleuue@bleuue.com and we will provide it in an alternative format.