Privacy Policy
Last updated: 5 October 2026
1. Who we are
Blog AI (blogaihq.com) is operated by Blog AI, Ireland, the data controller for the personal data described here. Contact us about privacy at privacy@blogaihq.com.
When you use Blog AI to write about or publish to your own website, the content and site data you give us are yours. We process them to provide the service to you.
2. What we collect
- Account: your name, email address and profile picture (from Google sign-in), and your email preferences.
- Sites and content: the sites you connect, your posts, drafts, ideas, suggestions, writing-style (voice) profile and the description of your site you give us (what it does, who it's for and what the blog is for), and the published posts we import from your site to learn your voice.
- Credentials: WordPress application passwords, Strapi API tokens and your Google refresh token. These are encrypted in a secrets vault and are only ever read by our servers to act on your behalf.
- Google data you connect: Search Console performance (pages, queries, clicks, impressions, position) and Google Analytics metrics (sessions, engagement, conversions) for the properties you choose. See section 4.
- Billing: your plan, credit history and payment records (amount, date, invoice number). Card details are collected and held by Stripe; we never see them.
- Usage and technical data: which features you use (product analytics, without cookies) and error logs needed to keep the service working.
- Emails: which emails we sent you and whether they were delivered, bounced or marked as spam.
- Free blog audit (no account): the website you enter, a one-way hash of your IP address (for abuse limits) and the report itself (built from your site's public pages, and page-speed scores from Google PageSpeed Insights). If you ask us to email you the report, we also keep a one-way hash of your email address and when you agreed; the address itself is used to send the report and is stored, encrypted, only if you ticked the tips box, until you confirm it. If you create an account from an audit, a copy of the report is saved to your account.
- Shopify waiting list (optional): if you join the waiting list on our Shopify page, we keep your email address and when you joined, and use it only to tell you when Blog AI for Shopify launches. We don't share it, and you can ask us to remove it at any time.
- Tips from Blog AI (optional): if you tick the separate "Email me occasional tips and product news" box on the free blog audit and confirm your address, we keep your email address, the website you checked, and a record of your consent (when, the exact wording you saw, and a hash of your IP address).
3. Why we use it, and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the service: generating, checking and publishing content, syncing your Google data, account and billing emails | Contract |
| Security, fraud prevention, debugging and keeping the service reliable | Legitimate interests |
| Improving the product from aggregated, cookieless usage analytics | Legitimate interests |
| The weekly digest email (you can turn it off at any time) | Legitimate interests |
| Product update emails: a short monthly note to customers about what's new in the service they use. You can turn them off at any time in Settings or with the unsubscribe link in every email | Legitimate interests (emails to existing customers about our own, similar service; the "soft opt-in") |
| Google Analytics cookies on our marketing pages; the referral-link cookie | Consent (you can withdraw it at any time) |
| The free blog audit you request and, if you ask for it, its report email | Consent (you can withdraw it with the link in the email) |
| The Shopify waiting list and its launch email | Consent (ask us to remove you at any time) |
| Tips and product news by email, if you ticked the optional box on the free blog audit (for now, two follow-up emails about your audit) | Consent (unsubscribe any time with the link in every email) |
| Keeping payment records | Legal obligation (tax and accounting law) |
4. Google user data
If you connect Google, we request these permissions:
| Permission | What we do with it |
|---|---|
| Sign-in (openid, email, profile) | Create and sign in to your account |
| Search Console, read-only (webmasters.readonly) | Show how your posts perform in Google Search and base post ideas and refresh suggestions on the queries your site already ranks for |
| Google Analytics, read-only (analytics.readonly) | Show sessions, engagement and conversions for your posts |
Blog AI's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- We use Google data only to provide and improve the features you see in Blog AI.
- We transfer it only to provide those features (for example, sending your search queries to our AI providers: Anthropic, to plan a post for you, and TypeSafe, to check which searches fit the site description you gave us), for security, or to comply with the law.
- We never sell it, use it for advertising, or use it to train general-purpose AI models. Anthropic does not train its models on data sent through its commercial API.
- People at Blog AI do not read your Google data unless you ask us to (for support), it is needed for security, or the law requires it.
- You can disconnect Google at any time in Blog AI (Sites or Settings) or in your Google account settings; deleting your Blog AI account deletes the data and revokes our access.
5. Who processes your data (sub-processors)
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, sign-in and file storage | EU |
| Vercel | Hosting and delivery of the website and app | EU and US |
| Anthropic | AI models that research, write and check your drafts | US |
| TypeSafe | AI model that checks your drafts' claims against the public source pages they cite, and checks which of your search queries fit the site description you give us | US |
| Stripe | Payments, subscriptions and invoices | EU and US |
| Resend | Sending account and notification emails | EU |
| fal.ai | AI image generation | US |
| PostHog | Cookieless product analytics and error tracking | US |
| Sign-in with Google, Search Console and Analytics data you connect, and Google Analytics on our marketing pages (with consent) | US |
When you publish, we send your post to the website platform you connected (for example WordPress or Strapi), which you control. We do not sell personal data.
6. International transfers
Some providers above process data outside the EU/EEA, mainly in the US. These transfers are covered by the EU–US Data Privacy Framework where the provider is certified, or by the European Commission's Standard Contractual Clauses.
7. How long we keep it
- Your account, sites, content, credentials and Google data: until you delete them or your account. Deleting your account removes them straight away; copies in our database backups are overwritten within 30 days.
- Payment records (amount, date, invoice number): kept for 6 years as tax law requires, no longer linked to your account after you delete it. Stripe keeps its own invoice records.
- If an email to you bounces or is marked as spam, we keep a one-way hash of the address so we never email it again.
- A record that your account was deleted, holding only its internal id, so we can show we honoured the request.
- If you used the free post or the free AI visibility check, the website address (the Google Search Console property and its host name) it was used for, no longer linked to you after you delete your account. We keep it so each site gets the free allowance once (preventing abuse, our legitimate interest).
- Error logs: up to 12 months.
- Free blog audits: 30 days (a copy saved to your account stays until you delete your account). An unconfirmed email address is deleted after 48 hours. If you ask us to stop audit emails, we keep a one-way hash of the address so we don't email it again.
- Shopify waiting list: until we send the launch email, then deleted, or earlier if you ask.
- Tips sign-ups: until you unsubscribe. Then we delete your email address and keep only a one-way hash with the record of your consent, so we can show you agreed and never email you again.
8. Your rights
Under the GDPR you can:
- Access and take your data: Settings → Export my data downloads everything we hold about you (JSON, with CSV for tables).
- Delete your account: Settings → Delete account removes your data immediately and cancels your subscription.
- Stop emails: turn off the weekly digest and the monthly product updates in Settings or with the unsubscribe link in any such email. Site-check and tips emails have their own unsubscribe link.
- Correct your data, restrict or object to processing, and withdraw consent at any time.
For anything else, email privacy@blogaihq.com. We reply within one month. You can also complain to the Data Protection Commission in Ireland (dataprotection.ie).
9. Security
Data is encrypted in transit and at rest. Third-party credentials are stored in an encrypted vault. Every database table is protected by row-level security so one customer can never read another's data.
10. Cookies
See our Cookie Policy. In short: sign-in cookies, cookieless product analytics, and, only if you accept them, Google Analytics on marketing pages and a cookie that remembers a friend's referral link.
11. Children
Blog AI is a business service and is not intended for anyone under 18.
12. Changes
We will update this page when our practices change and email you before any material change takes effect.