Version 1.3
Effective Date: October 13, 2026
Last Updated: October 13, 2026
BlueForge Tech LLC, doing business as Get Me Paid ("Get Me Paid," "BlueForge," "we," "us," or "our"), provides business software for invoicing, collections, payments, scheduling, workforce coordination, and related business operations. We process our business customers' customer information only to provide the Service on the business's instructions, subject to our Data Processing Addendum. We do not sell personal information or use Business Content to build advertising profiles.
This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information in connection with the Get Me Paid applications, websites, hosted document pages, and related services (the "Service").
1. Our Privacy Roles
For information about the Business account holder, authorized users, website visitors, billing administration, product security, support, and our own business operations, BlueForge determines the purposes and means of processing and acts as the controller or business under applicable privacy law.
For personal information about a Business's customers, contacts, workers, or other persons that the Business enters, imports, or generates in the Service as Business Content, the Business is the controller or business and Get Me Paid acts as the processor or service provider. Our processing of that Business Content is governed by the Data Processing Addendum at https://getmepaid.dev/dpa.
2. Information We Collect
2.1 Account and Profile Information
Source: provided by you and generated through authentication.
We may collect account identifiers, email address, name, phone number where supplied, password-related authentication state, email-confirmation status, app-language preference, account settings, default Business, and session information. We do not receive your plaintext password from our authentication provider.
On supported devices, biometric quick login uses the device's local biometric system. Get Me Paid does not receive or store biometric templates; we receive the local authentication result and may store protected device/account credentials needed for the feature.
2.2 Business, Team, and Workforce Information
Source: provided by you or your authorized team and generated by the Service.
We may collect Business name, address, phone number, email, timezone, tax and document defaults, branding and logo, plan and billing state, host identity, team members, roles, invitations, workforce status, assignments, and historical activity attribution.
2.3 Customer and Service Information
Source: provided by the Business or its authorized users.
Business Content may include customer and contact names, email addresses, phone numbers, service addresses, billing addresses, preferred language, notes, tax settings, routine-service information, archived status, service history, communication preferences, and payment-behavior information generated from the Business's records.
2.4 Invoices, Quotes, Payments, Expenses, and Financial Records
Source: provided by you or your team, generated by the Service, or received from a payment provider.
We may process invoice and quote numbers, dates, service dates and times, descriptions, quantities, rates, tax settings, totals, notes, terms, status, revisions, approvals, assignments, public-link records, payment amounts, payment dates and methods, payment notes, provider identifiers, refunds, reversals, disputes, expenses, merchants, categories, sales-tax summaries, income/profit summaries, and related audit history.
Raw payment-card numbers and card security codes are collected by Stripe and are not stored by Get Me Paid.
2.5 Collections, Reminders, and Communications
Source: provided by the Business, generated by the Service, and received from communications providers.
We may process reminder settings, collection events, payment promises, follow-up history, email recipients, message content, email-delivery status, provider identifiers, failures, timestamps, and related communication history. Historical communication, consent, opt-out, and provider-status records may remain where necessary for audit, legal, security, or dispute purposes.
2.6 Files, Logos, and Imports
Source: uploaded or selected by the Business.
We may store uploaded Business logos and information created from supported imports. Bank CSV and external-invoice import files are parsed for the requested import workflow; raw CSV file contents are not intended to be retained after parsing. We may retain import metadata such as source filename, row reference, fingerprint, and the records created from the import.
2.7 Public Document Links
Source: generated by the Service and accessed by recipients.
We may process secure public-link tokens or hashes, creation and expiration information, revocation state, document identifiers, and view timestamps associated with customer-facing invoices and quotes.
2.8 Device, Push, Crash, Diagnostic, and Security Information
Source: collected automatically from your device, app, network, and service infrastructure.
We may collect app version, build, platform, installation identifiers, push-notification tokens, device model when available, error and crash details, stack traces, app and device context, security events, network request information, IP address, and operational logs.
We use Sentry, a third-party error-monitoring service, for crash and diagnostic reporting when configured. Get Me Paid configures Sentry not to send personal information by default, but technical context or user-entered data may appear in an error report if it is part of the failing operation.
Supabase, our cloud authentication, database, storage, and server-function provider, and Cloudflare, our public website hosting and security provider, also process operational logs and network metadata needed to operate and protect their services.
2.9 Advertising Data
Source: collected by the advertising SDK and network when ads are enabled.
Free-plan versions of the Android app may display Google AdMob advertising. Our integration is intended to request non-personalized/contextual ads. Google may process advertising or device identifiers, IP address, coarse location inferred from IP, app/device information, app interactions, SDK diagnostic or performance data, ad requests, and ad interactions to deliver, measure, secure, and prevent fraud in ads.
Get Me Paid does not request precise GPS location for advertising and does not use Business Content to create advertising profiles.
2.10 AI-Assisted Feature Data
Source: selected Business Content and limited context sent when an AI-assisted feature is used.
We use OpenAI's API for supported AI-assisted collection drafting and Pro+ customer-text translation. Owner-facing collection drafts are requested in the sender's current app language. For supported manual collection-message translation, the final owner-edited text may be translated immediately before delivery into the customer's current profile language. Other supported translation may include selected invoice or quote line-item descriptions and custom notes. We send only the selected content and limited context needed to generate the requested output.
We do not intentionally send whole customer profiles, complete payment histories, raw Stripe payment credentials, unrelated documents, or entire Business databases to the AI provider.
We do not use Business Content to train Get Me Paid AI models. Under OpenAI's current API data-use terms, API inputs and outputs are not used to train OpenAI models by default unless the account holder expressly opts in to data sharing. OpenAI may retain API inputs and outputs for a limited period for safety, abuse monitoring, support, or legal compliance under its applicable API terms.
2.11 Aggregate and De-identified Service Statistics
Source: derived from Service records.
We may create aggregate or de-identified statistics to operate, analyze, improve, and describe the Service. The public recovery metric uses qualifying reminder and payment activity to maintain an aggregate amount and processing checkpoint. The public display does not include Business or customer identities, invoice details, individual payment records, or business-level results.
2.12 Support and Feedback
Source: provided by you and generated from app context.
Support or feedback submissions may include the text you send, category, screen area, platform, app version/build, and optional device information needed to investigate the issue.
3. How We Collect Information
We collect information directly from you and your authorized users; from customers or recipients interacting with public document and payment flows; from Stripe and communications providers; automatically from the app, website, and infrastructure; and from records generated when you use the Service.
4. How We Use Information
We use personal information and Business Content to:
•
create and authenticate accounts;
•
operate and secure Business workspaces, roles, and permissions;
•
create, send, display, and maintain invoices, quotes, documents, reminders, schedules, and service records;
•
process and record payments and payment-provider events;
•
provide collection workflows, reports, Simple Books, exports, imports, and workforce tools;
•
send transactional email, push, and in-app notifications where enabled, and account-security verification messages where requested;
•
provide AI-assisted drafting and translation when requested or enabled;
•
administer subscriptions, billing, seats, and entitlements;
•
provide customer support and respond to requests;
•
detect, prevent, and investigate fraud, misuse, abuse, and security incidents;
•
maintain reliability, troubleshoot errors, and improve the Service;
•
create aggregate or de-identified service statistics for analytics and marketing, including the public recovery metric described above;
•
comply with law, enforce agreements, and protect rights; and
•
deliver and measure non-personalized/contextual advertising on eligible free-plan app screens.
We do not use Business Content to train AI models, create advertising profiles, or sell lists of customer information.
5. How We Disclose Information
We disclose information only as reasonably necessary for the purposes described in this Policy.
5.1 Service Providers and Subprocessors
We use service providers for cloud hosting and authentication, email, account-security verification, push notifications, AI, diagnostics, website hosting/security, and advertising. Current providers and their functions are listed at https://getmepaid.dev/subprocessors.
These providers receive only the information reasonably needed to perform their functions and process it subject to applicable contracts, provider terms, and law.
5.2 Payment Providers
Stripe processes connected-account onboarding, customer payment credentials, direct invoice payments, payouts, disputes, refunds, and subscription billing where applicable. Stripe may act under its own agreements and privacy terms for portions of its payment services.
5.3 App Marketplaces
Google Play and, when applicable, Apple's App Store may process account, device, purchase, subscription, and marketplace information under their own terms and privacy policies.
5.4 Communications and Carriers
Transactional email may be transmitted through Amazon SES. Account-security verification messages may be transmitted through Twilio and mobile carrier networks when a user initiates a supported verification flow. Push notifications may be routed through Expo Push Notification Service and, on Android, Firebase Cloud Messaging.
5.5 Legal, Safety, and Business Transfers
We may disclose information when we reasonably believe disclosure is required by law, legal process, or a valid government request; to protect the security or integrity of the Service; to investigate fraud or abuse; or to protect the rights and safety of BlueForge, our users, or others.
If BlueForge is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction. A successor will be bound by this Policy with respect to information collected under it, or we will notify affected users before their information becomes subject to a materially different privacy policy where required by law.
6. Advertising, Sale, Sharing, and Privacy Choices
We do not sell personal information for money. We do not use Business Content to create advertising profiles or enable personalized or cross-context behavioral advertising.
Eligible Free-plan Android screens may display ads through Google AdMob. Get Me Paid requests non-personalized/contextual ads. Non-personalized ads are not selected based on a user's past behavior, but Google and participating advertising technology partners may still process advertising or device identifiers where available, network and IP information, approximate location inferred from IP, app and device information, app interactions, SDK diagnostic or performance data, ad requests, and ad interactions for ad delivery, measurement, frequency capping, aggregate reporting, security, and fraud prevention.
Where required by applicable U.S. state privacy law, users can open Privacy Choices in the Android app to submit an opt-out applicable to the sale or sharing of personal information and processing for targeted advertising. Google may receive applicable Global Privacy Control signals and privacy choices communicated through Google's User Messaging Platform using the Global Privacy Platform. Google applies Restricted Data Processing when supported signals indicate a qualifying opt-out. Providing these choices does not mean that Get Me Paid sells personal information for money or requests personalized advertising.
An opt-out does not necessarily disable every advertisement. Users may continue to see non-personalized/contextual ads. Google may make eligible ad requests available to participating advertising technology partners selected through AdMob. Those partners may receive information needed to participate in eligible ad requests, subject to applicable restrictions, the user's privacy choices, and their respective privacy practices. The partners eligible for a particular request may vary.
7. Retention
We retain information according to the type of record, the status of the account, legal requirements, and operational need.
•
Active account and profile information: retained while the account is active and during the 30-day deletion hold; deleted or de-identified at final deletion except for information that must be retained for legal, security, fraud-prevention, or audit purposes.
•
Ordinary Business Content: retained while the Business is active; after final account or Business deletion, deleted or de-identified when it is not part of a retained financial, transaction, audit, consent, dispute, or legal record.
•
Financial, transaction, tax, provider, and audit records: reach a deletion-review point after 7 years from the relevant transaction, record, account closure, or other applicable event. They may remain retained until an approved deletion review is completed, and longer when required by law, an active dispute, a provider obligation, or a legal or security hold.
•
Ownership-transfer and historical attribution records tied to financial or audit history: generally retained for up to 7 years.
•
Historical communication-consent, opt-out, and related compliance evidence, where retained from a previously contemplated, tested, or available feature: retained for the period reasonably necessary to document compliance, resolve disputes, or satisfy applicable law.
•
Crash and diagnostic data under our control: generally retained for no more than 90 days unless a longer period is reasonably necessary to investigate an active security, fraud, support, or reliability issue. Provider-side operational logs may follow the provider's configured retention and legal requirements.
•
Support and feedback records: generally retained for up to 2 years after the matter is closed, unless needed longer for a dispute, security matter, or legal requirement.
•
Push and device-registration records: retained while active or until replaced, revoked, stale, or removed through account deletion.
•
Public invoice and quote links: normally expire after 90 days or earlier if revoked; underlying business records follow their separate retention period.
•
Managed database backups: for our launch configuration, production database backups are maintained for disaster recovery and service continuity on a rolling basis for up to 7 days. Information deleted from the live Service may remain in backup copies until the applicable backup expires.
•
Deletion tombstones and minimal legal records: may be retained for up to 7 years when reasonably necessary to document deletion, ownership, fraud prevention, financial integrity, or legal compliance.
We may delete information earlier when it is no longer needed and we are not legally or contractually required to retain it.
8. Account and Business Deletion
Get Me Paid provides in-app account-deletion controls and a public deletion resource at https://getmepaid.dev/delete-account.
A deletion request begins a 30-day hold. During that period, the request may be canceled and authorized access remains available. We recommend exporting needed records before the hold expires.
After finalization, active access is removed and ordinary Business Content is deleted or de-identified, subject to the retention categories above. Financial, tax, transaction, payment, dispute, consent, and audit records may be retained to protect record integrity, comply with law, resolve disputes, and prevent fraud.
9. Your Privacy Rights
Depending on where you live and the nature of the information, you may have rights to request access to personal information, correct inaccurate information, request deletion, obtain a portable copy, or receive information about our processing.
You may submit a privacy request to privacy@getmepaid.dev. We may need to verify your identity and authority before completing a request. If the information is Business Content controlled by a Get Me Paid Business customer, we may refer the request to that Business or assist the Business in responding under the Data Processing Addendum.
We do not discriminate against a person for exercising a privacy right.
If we deny a privacy request and applicable law provides a right to appeal, you may appeal by emailing privacy@getmepaid.dev with the subject "Privacy Appeal" and identifying the request you are appealing. We will respond as required by applicable law.
10. Communications Choices
Business-to-customer communications through Get Me Paid are governed by the Messaging Addendum at https://getmepaid.dev/messaging where applicable.
You may disable optional push notifications through supported app settings or device settings. Transactional account, security, billing, document, and service communications may still be sent when reasonably necessary to operate the Service.
If BlueForge sends a non-transactional marketing email, the email will include any unsubscribe mechanism required by law. Get Me Paid does not provide businesses with a general-purpose bulk marketing or newsletter platform.
Phone numbers may also be used for one-time verification or account-security messages when a user initiates or enables a supported verification flow.
11. Security
We use administrative, technical, and organizational measures designed to protect information appropriate to the nature of the Service. Measures include authenticated access, tenant/business separation, row-level access controls, role-based permissions, encryption in transit, encryption at rest provided by our infrastructure platform, protected server credentials, error monitoring, logging, provider security controls, and security restrictions on public document links.
No security measure can guarantee absolute security. You are responsible for protecting your credentials, devices, and authorized-user access.
If a security incident affects personal information, we will notify affected users, Business customers, and regulators as required by applicable law and our contractual obligations.
12. U.S. Service and Processing
The Service is operated from the United States and intended for users in the United States. Information may be processed in the United States and in locations where our service providers operate, subject to applicable law and contractual protections.
If you access the Service from outside the United States, you understand that your information may be transferred to and processed in the United States.
13. Children and Minors
The Service is for business users who are at least 18 years old and is not directed to anyone under 18. We do not knowingly permit a person under 18 to create a Get Me Paid business account.
We also do not knowingly collect personal information from a child under 13 in a manner subject to the Children's Online Privacy Protection Act. Business users may not use the Service to collect, store, or communicate information about a person under 18 except where strictly necessary to identify an authorized customer contact in a lawful business record.
If you believe we have received personal information from a child in violation of this section, contact privacy@getmepaid.dev.
14. Website Cookies and Tracking
At launch, getmepaid.dev does not use advertising cookies, product-analytics cookies, or third-party behavioral tracking scripts. Cloudflare and other infrastructure needed to serve and secure the website may process ordinary network request information, security signals, and technically necessary data as part of hosting and security operations.
If we later add analytics, advertising cookies, or other non-essential tracking, we will update this Policy and provide any legally required notice or choice before using those technologies.
15. Third-Party Links and Services
The Service may contain links to or integrations with third-party sites and services. Information you provide directly to a third party is governed by that third party's terms and privacy policy. Review those terms before providing information directly to the third party.
16. Changes to This Privacy Policy
We may update this Policy to reflect changes in law, the Service, vendors, advertising practices, data practices, or security. For a material change that adversely affects how we use personal information, we will provide at least 15 days' advance notice unless a shorter period is reasonably necessary for security, fraud prevention, provider requirements, or law.
The updated Policy will identify its new effective date and version. We will obtain additional consent when required by law.
17. Contact Us
BlueForge Tech LLC, doing business as Get Me Paid
4105 Shawnee Cir
Bryan, TX 77802
United States
Privacy and deletion requests: privacy@getmepaid.dev
Support: support@getmepaid.dev
Legal notices: legal@getmepaid.dev
Website: https://getmepaid.dev
Data Processing Addendum: https://getmepaid.dev/dpa
Subprocessors: https://getmepaid.dev/subprocessors