Privacy Policy

This Policy explains how Escher Group Pty Ltd (ABN 56 638 285 784) trading as Blueprint (“we”, “us”) collects, uses, keeps and protects personal information in Blueprint by Escher Group (“Blueprint”) and on our website. It covers our customers and the people on their teams, visitors to our website, and people who answer a vote or quiz in a newsletter made with Blueprint.

It applies wherever you are, with extra sections for Australia (Privacy Act 1988 and the Australian Privacy Principles), New Zealand (Privacy Act 2020) and the United States (including the CCPA and CPRA). Please read it with our Terms of Service.

2.1 What you give us

2.2 What we record as you use Blueprint

2.3 Visits to our website

When you visit our website we count the visit: the page, where you came from (only the website’s name, such as a search engine, or a campaign name in the link), your type of device, your country, how far down the page you scroll, how long you stay and which of our buttons you press. We don’t use cookies or any outside tracking service for this, and nothing is stored on your device. To count a visitor once a day we make a code from your connection and browser and a random value that changes every day. It can’t be turned back into who you are, and once the day is over even we can’t link two visits together.

2.4 From others

• Stripe tells us whether a payment went through and the state of your subscription. We never see or store your card number.
• Websites you ask us to read. Blueprint reads the public pages of your website, and of competitors’ websites you add, including screenshots of your own pages for the Website Analyzer.
• Readers of our customers’ newsletters. A business using Blueprint can put a vote or a quiz in its newsletter. When a reader taps an answer, a page opens and we count it for that business. We don’t keep the reader’s name or email address. So each reader counts once, we keep a scrambled code, made from the reader’s id in the business’s email platform where it has one, or otherwise from their connection and browser that day. The code can’t be turned back into who they are. The business sees only the totals.

2.5 Accounts you connect for Reporting

In Reporting, the owner of a Blueprint account can connect their business’s accounts: Google Analytics, Search Console and Google Ads; a Facebook Page, Instagram account and Meta ad account; Klaviyo or Mailchimp; a LinkedIn page and LinkedIn ad account; and a TikTok account and TikTok ad account. Each is connected through the platform’s own sign-in. Blueprint only reads from them: it never posts, sends or changes anything.

Blueprint reads totals only. It never reads who your website visitors, followers or subscribers are.

What Blueprint reads is used only to show your Reporting, to you and your team. It isn’t sold, used for advertising or sent to an AI, and it isn’t shared with anyone except the companies that store it for us (Vercel and Neon, section 6) and our team as section 5.3 describes.

Blueprint’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

To remove Blueprint’s access and delete what it read, see Deleting your connected data. How long it’s kept is in section 8.

We won’t use your personal information for a purpose that’s materially different without telling you first and, where the law requires, asking your consent.

Blueprint uses AI to write your strategy and to power Coach, the Writer, the Planner and the Designer.

4.1 Who processes it. We use two AI companies, through their business services:

• Anthropic writes and refines your strategy and does all of Blueprint’s writing and reading: Coach, the Writer (articles and press releases), the Planner (content plans), the Designer (your Brand Kit, templates, designed posts and newsletters), the Website Analyzer, Competitors, reading the documents you add to Knowledge, and your Monday email.
• Google (Gemini) makes the pictures for your posts.

4.2 What may be sent to them. Only what a task needs, when you ask for it. Depending on the tool, that can include:

• your answers to Blueprint’s questions, and your strategy
• your messages to Coach or the Writer, with recent conversation history
• your first name, and in a team’s Coach chat, your teammates’ first names
• files and pictures you add, including Knowledge documents
• your Brand Kit: logo, colours, fonts, photos, products and the posts you choose to add
• notes you write for a month’s content or for a piece
• public pages of websites you ask us to read, yours and competitors’

If Blueprint can’t read your website when you answer its questions, Anthropic may search the web for your business on our behalf.

For pictures, Google receives a description of the picture, your brand’s colours and style, your logo, and any of your photos used to make it.

Nothing Blueprint reads from the accounts you connect for Reporting (section 2.5) is sent to either company.

4.3 Their commitments. Anthropic’s commercial terms say it may not train its models on what Blueprint sends it or gets back, and it deletes them within 30 days, unless it needs them longer to enforce its usage rules or the law requires it. Google doesn’t use what Blueprint sends it to improve its products, because Blueprint uses its paid service; it keeps prompts for a limited time, only to detect misuse. Both handle your information under their data processing terms.

We don’t use your information to train AI models of our own. Your answers, strategy, messages and content are used only to provide Blueprint to you.

We don’t sell your personal information. We share it only as follows.

5.1 Companies that run Blueprint for us, listed in section 6, only for what this Policy describes.

5.2 Your team. People you invite can see and work on every business in your account. You decide who’s on your team, and can remove anyone at any time.

5.3 Our team. If you ask us for help, or we need to look into a problem, a member of the BLUEPRINT team may open your account to see what you see. They can only look: nothing can be changed or sent while they do. Only Escher Group’s own team can do this, using two-step sign-in, and every time it’s recorded who looked and when. Our team can also see your account details, your activity and the emails we’ve sent you, to help you and to improve Blueprint.

5.4 The law. We may disclose information when the law, a court or a government authority requires it.

5.5 If the business changes hands. If Escher Group is involved in a merger, acquisition or sale, your information may be transferred as part of it.

5.6 With your consent, for anything else.

Blueprint uses only the cookies it needs to work. We don’t use advertising or analytics cookies, and website visits are counted without cookies (section 2.3).

Your browser also remembers a few settings on your device, such as whether you’ve turned Blueprint’s notifications on.

The videos on our website are played by Cloudflare, and some fonts are loaded from Google Fonts, so your browser connects to them and they receive your IP address.

Because we don’t track you across other websites, Do Not Track signals don’t change anything we do.

• In transit: everything travels encrypted (HTTPS).
• At rest: stored information is encrypted too, with AES-256: our database and its backups at Neon, and every file at Cloudflare.
• Passwords are stored scrambled with Argon2id, never in a form anyone can read.
• Sign-in links and codes are stored only in scrambled form, and an authenticator app’s secret is encrypted.
• Keys to the accounts you connect are encrypted with AES-256, used only on our servers to read the numbers, and never reach a browser, a log or an AI.
• Your files are kept private and shown only through links that expire within an hour.
• Two-step sign-in is available to everyone, and required for our own team.
• Limits on repeated attempts protect sign-in and other forms.
• Payments are handled by Stripe (PCI DSS Level 1).
• Our team’s access is limited to what’s needed, and every look at a customer’s account is recorded.

If you think someone has got into your account, email us at info@eschergroup.com.au.

Blueprint is run from Australia. Your information is stored in the United States: Blueprint runs on Vercel in Washington, D.C., our database is with Neon in the eastern US, and files are with Cloudflare in eastern North America. The companies in section 6 may also process it in the US or other countries.

Before we share personal information with a company overseas, we take reasonable steps to make sure it’s protected as the Australian Privacy Principles require: we choose companies whose terms and data processing agreements protect it. We stay responsible for how they handle it.

Wherever you live, you can ask us to:

• see the personal information we hold about you
• correct it (you can change most of it yourself in Settings and in Blueprint)
• delete it, including your whole account
• give you a copy in a structured format
• stop the Monday email or offers: every one has an unsubscribe link
• withdraw consent where we rely on it

Email us at info@eschergroup.com.au and we’ll answer within 30 days.

We comply with the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles. To complain, email info@eschergroup.com.au. If you’re not satisfied with our answer, you can contact the Office of the Australian Information Commissioner (OAIC).

We comply with the Privacy Act 2020 (NZ) and the Information Privacy Principles. To complain, email info@eschergroup.com.au. If you’re not satisfied with our answer, you can contact the Office of the Privacy Commissioner (NZ).

If you live in California, you have the right to know what personal information we’ve collected, to have it deleted (with some exceptions) and corrected, and not to be treated differently for using these rights. We don’t sell your personal information, or share it for advertising across other websites. To use your rights, email info@eschergroup.com.au.

Blueprint isn’t meant for anyone under 18, and we don’t knowingly collect children’s personal information.

We may update this Policy. When we make important changes, we’ll update the “Last updated” date and tell you by email or in Blueprint.

Questions about this Policy: