Privacy Policy

1. Who is responsible for your data

Ravinaro LLC, a Wyoming (USA) limited liability company, 30 N Gould St Ste R, Sheridan, WY 82801, United States, is the controller of personal data processed through BlogTend.

For anything in this policy, including a request to see or delete your data, write to info@blogtend.com or use the contact form.

2. What we collect

You give us

• Account details — name, email address and a hashed password. If you sign in with Google we receive your name, email address, profile picture and Google's stable account identifier instead of a password.
• Connected site credentials — the site URL and whatever lets BlogTend publish there: a WordPress username and Application Password or connector token, a Wix app instance or API key, a Webflow app access token or site API token, a webhook endpoint and its signing secret, or a Google Search Console service-account key you add for indexing. Secrets are encrypted at rest with AES-256-GCM, are not shown back to you (a webhook signing secret only while you connect or rotate it), are never sent to any AI provider, and are deleted when you disconnect the site (Wix and Webflow app access is also revoked with the platform).
• Shopify installs — the shop domain, the store owner's email and name (used to create your BlogTend account when the app is first opened), an encrypted access token, plus the blog and article content BlogTend publishes to your store. We never receive your Shopify customer or order data. The access token is deleted when you uninstall the app. On Shopify's shop-redact request, the store's details are erased, and so is the account created for it unless you took it over by setting a password.
• Content you write — prompts, topics, business context, saved article styles, and anything you type into a support ticket or the contact form.
• Your acceptance of our terms — when you accepted the Terms of Service and this policy, which version, how (for example by creating an account under the sign-up notice), and the network address, country and browser it came from, kept as evidence of the agreement.
• Billing details — handled by Stripe. We store the Stripe customer and subscription identifiers and your plan. We never see or store card numbers.

We generate or collect automatically

• Generated content — articles, images, research notes and the source URLs behind them.
• Usage records — which model ran at which step, token counts and the cost of each run, so both of us can see what an article cost.
• Product usage events — inside the signed-in app we record events such as which feature you used, a failed site connection or a cancelled check-out, linked to your account, so we can see where customers get stuck and fix it. These stay on our own servers and are not shared with advertisers.
• Network address and approximate location — the network (IP) address your account was created from and the one you last used, with the country and, where our hosting provider supplies it, the city it maps to. We use them to protect accounts and the Service: spotting fraud and abuse, and blocking access from an address that abuses it.
• How you found us — when analytics is allowed, a first-party cookie notes the website that referred you (its address only, not the full page), campaign tags in the link you followed, whether you arrived from an ad, and the first page you visited. If you create an account, that note is saved with it, so we can understand which channels bring customers.
• Operational logs — request and error logs, and a log of emails sent to you.
• Analytics and advertising measurement — pages viewed, clicks on key buttons, sign-ups, check-outs and purchases, the device, browser and approximate location Google derives from your network address, and, if you arrived from one of our Google, Meta, TikTok, ChatGPT or Microsoft ads, the ad click identifier. Where advertising measurement is on, Google Ads receives a purchase with your email address in one-way hashed form, Meta also receives page views and the steps sign-up, checkout and purchase, with your email address and account id in one-way hashed form, TikTok receives page views and the steps sign-up, checkout and purchase, with your email address and account id in one-way hashed form, OpenAI receives page views and the steps sign-up, checkout and purchase, with your email address and account id in one-way hashed form, and Microsoft Advertising receives page views and the steps sign-up and purchase (the amount and currency), without your email address or account id. See “Analytics and advertising measurement” below.
• Bot-protection signals — our bot-protection service inspects the browser on sign-up, sign-in and the contact form. It is designed not to track people across sites.

3. Why we use it, and on what legal basis

• To provide the Service — generating and publishing articles, running your automations, showing your usage. Basis: performance of our contract with you.
• To bill you and keep the records tax law requires. Basis: contract and legal obligation.
• To email you about verification, published articles, paused automations, low credits and support replies. Basis: contract. Optional notifications can be turned off.
• To send product emails — a few tips and reminders while you try the Service, such as free articles you have left, what a paid plan adds, and one reminder if you start checking out for a plan and don't finish (for that we keep the plan and the time of each checkout you start with your account, until the account is deleted; at most one such reminder a week). Basis: our legitimate interest in following up on what you started. Each carries an unsubscribe link, and Notifications turns any of them off.
• To keep the Service secure and working — bot protection, abuse prevention, debugging. Basis: our legitimate interest in a service that is not overrun.
• To understand how the site is used and whether our ads work — Google Analytics, Microsoft Clarity, Google Ads conversion measurement, Meta (Facebook and Instagram) advertising measurement, TikTok advertising measurement, OpenAI (ChatGPT) advertising measurement and Microsoft Advertising measurement. Basis in the EEA, the UK, Switzerland and the UAE: your consent, which you give or refuse in the cookie banner and can withdraw at any time. Elsewhere: our legitimate interest in measuring and improving our own website and advertising, and you can switch it off at any time in Cookie settings.
• To protect accounts and block abuse — the network address and approximate location we keep with each account, used to detect fraud and to block addresses that abuse the Service. Basis: our legitimate interest in keeping the Service and its customers safe.
• To understand how people find us — the referral and campaign note described above, which follows your analytics choice. Basis in the EEA, the UK, Switzerland and the UAE: your consent. Elsewhere: our legitimate interest in knowing which channels work, and you can switch it off in Cookie settings.
• To improve the product — the first-party usage events described above. Basis: our legitimate interest in a product that works; you can object by writing to us.
• To keep evidence of our agreement — your acceptance record. Basis: our legitimate interest in being able to prove the contract, and legal obligation where it applies.

4. What the AI providers receive

Producing an article means sending your prompt, the site context you supplied and the intermediate drafts to the AI model provider handling that step, and sending the topic to that provider's web-search tool. We work with several established AI model providers and choose which one handles each step as models improve. They are located in the United States, Singapore and the People's Republic of China.

We use these providers only through their paid business APIs, under terms that bind them to process the data to provide their service. Some providers are headquartered in, or process data in, the People's Republic of China, where data-protection law differs materially from yours. The current list of providers, and which ones handle your articles, is available on request: write to us and we will send it.

We never send your site credentials to any AI provider. They receive the writing task, not the keys to your site.

5. What ProveRank receives

Keyword and search data comes from ProveRank, our sister product, operated by the same company. To return search volume, difficulty and related keywords, it receives your site's domain, the country and language you target, your topic seeds and the keywords planned for your articles. It does not receive your article content or your site credentials.

Your name and email address go to ProveRank only when you click to claim a free ProveRank account, never before. Search Console data comes back from ProveRank only if you connected Search Console in ProveRank yourself.

Once you have a ProveRank account, ProveRank's own privacy policy covers it: ProveRank privacy policy.

6. Analytics and advertising measurement

We use Google Analytics 4 on our website and in the app to see which pages are visited, which buttons are clicked and where sign-ups and purchases come from. We advertise with Google Ads, and Google Ads counts sign-ups and purchases as conversions by importing them from Google Analytics. When you arrive from one of our Google ads and have allowed advertising measurement, we also keep that ad’s click identifier with your account, so that if you buy a plan we can report the purchase (its amount, currency and order reference, with the click identifier) to Google Ads as a conversion. When you buy a plan and have allowed advertising measurement, our server also sends Google Ads your email address in one-way (SHA-256) hashed form with that purchase report, even if we hold no click identifier for you, so that Google can match the purchase to a Google ad you interacted with; Google discards it if it finds no match. It is sent for ad measurement only, marked as not allowed for ad personalisation, and never in readable form. We also advertise on Facebook and Instagram and measure those ads with the Meta Pixel and Meta's Conversions API, on TikTok, measured with the TikTok Pixel and TikTok's Events API, in ChatGPT, measured with the OpenAI Ads Measurement Pixel and OpenAI's Conversions API, and on Bing and Microsoft's other search and partner sites, measured with the Microsoft Advertising UET tag, all described below. We do not use any other advertising network or tracking pixel.

What Google receives

• The address of the page, the page before it, the event (for example a page view, a sign-up or a started check-out) and details such as the sign-in method or the plan you chose — never your name, your email address, your article content or your site credentials.
• Your network address, device and browser. Google Analytics uses the network address to derive an approximate location and does not log or store the address itself. A random identifier kept in the _ga cookie tells one browser apart from another.
• If you arrived from a Google ad: the ad click identifier (gclid) that Google adds to the link. It is kept in the _gcl_aw cookie, only when advertising is allowed, so a later sign-up or purchase can be credited to that ad.
• When you sign up or log in, and only if advertising is allowed: your email address, which the Google tag turns into a one-way (SHA-256) hash in your browser before sending it, so Google Ads can match the sign-up or purchase to the ad you came from (Google calls this enhanced conversions). Google never receives the address in readable form from us.
• When you pay: we store the Google Analytics identifiers of your browser (client and session identifiers, the ad click identifier if you allowed advertising, and your advertising choice) with the Stripe checkout. When Stripe confirms the payment, our server sends Google Analytics a purchase event with those identifiers, the transaction number, the plan or pack bought, the amount and the currency. Renewals are sent the same way, as a separate renewal event. Your name, email address and card details are never sent. If analytics was not allowed when you checked out, nothing is stored with the checkout and nothing is sent.

Your choice

• In the EEA, the UK, Switzerland and the UAE (and when we cannot tell where you are) analytics and advertising are off until you choose in the cookie banner, which offers Analytics and Advertising separately. Until then the Google tag stores no cookies; Google receives only cookieless signals (that a page was viewed, whether consent was given, and the page address, which may include an ad click identifier), which Google says it uses for aggregate modelling and not to identify you. Meta's, TikTok's and OpenAI's pixels and Microsoft's UET tag are not loaded at all until you accept Advertising: no cookie is set and no request reaches Meta, TikTok, OpenAI or Microsoft Advertising.
• Everywhere else both are on by default and you can switch either off. A browser Global Privacy Control signal keeps advertising tags in the browser off.
• You can change or withdraw your choice at any time from Cookie settings at the foot of every page, or with this button: Cookie settings
• Withdrawing does not affect measurement that already happened. You can also block these cookies in your browser, or install Google's opt-out add-on: tools.google.com/dlpage/gaoptout

Google's role

For Google Analytics, Google processes this data on our behalf under its data-processing terms. For advertising measurement, and for any use of the data to personalise ads, Google also acts as an independent controller under its own privacy policy. With advertising allowed, Google may use it to show our ads to people who have visited our site.

• How Google uses information from sites that use its services: policies.google.com/technologies/partner-sites
• Your Google ad settings: myadcenter.google.com

Advertising measurement with Meta (Facebook and Instagram)

We use the Meta Pixel and Meta's Conversions API to measure which of our own Facebook and Instagram ads lead to a sign-up or purchase. This follows your Advertising choice, not your Analytics choice, with the same regional rules as above: in the EEA, the UK, Switzerland and the UAE (and when we cannot tell where you are) it is off until you accept Advertising in the cookie banner; elsewhere it is on unless you switch Advertising off. While it is off, Meta's script is not loaded, no Meta cookie is set and no request reaches Meta.

• Sent by your browser: the page you view and the steps viewing our pricing, sign-up, starting checkout and purchase (the plan, amount and currency), your network address, browser details and the Meta cookie ids (_fbp, and _fbc when you arrive from one of our ads). Automatic matching of form fields and button clicks is switched off, so the pixel does not read what you type.
• Sent by our server when you create an account or buy a plan: the step and, for a purchase, the plan, amount and currency; your email address and account id in one-way (SHA-256) hashed form; your network address and browser details; and the Meta cookie ids. When a subscription renews, our server reports the renewal in the same way, without your network address and browser details. So that a payment can be reported, checkout stores the Meta cookie ids, your network address and browser details with the Stripe payment, and only if Advertising was allowed; if it was not, nothing is stored and nothing is sent. When a plan starts with a free period, its first payment is reported as the purchase when it is taken, in the same way but without your network address and browser details; for that, the Meta cookie ids are also kept with your account from sign-up and each checkout, only while Advertising is allowed, and the payment is reported only if Advertising was allowed at your most recent checkout.
• We never send Meta your name, your email address in readable form, or anything from inside your account, such as your sites, articles, keywords or credentials. Meta can match a hashed email address against the hashed addresses of its own users, which is how it connects a sign-up or purchase to an ad.
• Meta may use what it receives to measure our ads and to deliver and optimise them, under its own terms and privacy policy: facebook.com/privacy/policy
• Reject in the cookie banner, or turn Advertising off in Cookie settings, and from then on your browser sends nothing to Meta and our server reports no further sign-ups or purchases from you. Exceptions: the renewal of a subscription you bought while Advertising was allowed is still reported until it ends, because that choice is stored with the payment, and the first payment of a plan you started with a free period is reported if Advertising was allowed when you checked out, because that choice is stored with your account; write to info@blogtend.com and we will stop either. Withdrawing does not affect what Meta already received. You can also block the pixel in your browser, or manage ads in your Facebook and Instagram settings.

Advertising measurement with TikTok

We use the TikTok Pixel and TikTok's Events API to measure which of our own TikTok ads lead to a sign-up or purchase. It follows your Advertising choice with the same regional rules as Meta above: in the EEA, the UK, Switzerland and the UAE (and when we cannot tell where you are) it is off until you accept Advertising in the cookie banner; elsewhere it is on unless you switch Advertising off. While it is off, TikTok's script is not loaded, no TikTok cookie is set and no request reaches TikTok.

• Sent by your browser: the page you view and the steps viewing our pricing, sign-up, starting checkout and purchase (the plan, amount and currency), your network address, browser details and the TikTok cookie id (_ttp). When you arrive from one of our TikTok ads we also keep its click identifier in a cookie of our own (bt_ttclid) for 30 days.
• Sent by our server when you create an account or buy a plan: the step and, for a purchase, the plan, amount and currency; your email address and account id in one-way (SHA-256) hashed form; your network address and browser details; and the TikTok cookie id and ad click identifier. So that a payment can be reported, checkout stores these with the Stripe payment, and only if Advertising was allowed; if it was not, nothing is stored and nothing is sent. When a plan starts with a free period, its first payment is reported as the purchase when it is taken, in the same way but without your network address and browser details; for that, the TikTok cookie id and ad click identifier are also kept with your account from sign-up and each checkout, only while Advertising is allowed, and the payment is reported only if Advertising was allowed at your most recent checkout. Renewals are not sent to TikTok by our server.
• We never send TikTok your name, your email address in readable form, or anything from inside your account. TikTok may use what it receives to measure our ads and to deliver and optimise them, under its own terms and privacy policy: tiktok.com/legal/privacy-policy
• Reject in the cookie banner, or turn Advertising off in Cookie settings, and from then on your browser sends nothing to TikTok and our server reports no further sign-ups or purchases from you. One exception: the first payment of a plan you started with a free period is reported if Advertising was allowed when you checked out, because that choice is stored with your account; write to info@blogtend.com and we will stop it. Withdrawing does not affect what TikTok already received.

Advertising measurement with OpenAI (ads in ChatGPT)

We use the OpenAI Ads Measurement Pixel and OpenAI's Conversions API to measure which of our own ads in ChatGPT lead to a sign-up or purchase. It follows your Advertising choice with the same regional rules as Meta above: in the EEA, the UK, Switzerland and the UAE (and when we cannot tell where you are) it is off until you accept Advertising in the cookie banner; elsewhere it is on unless you switch Advertising off. While it is off, OpenAI's script is not loaded, no OpenAI cookie is set and no request reaches OpenAI.

• Sent by your browser: the page you view and the steps viewing our pricing, sign-up, starting checkout and purchase (the plan, amount and currency), your network address, browser details, the OpenAI cookie ids (__oppref, the ad reference when you arrive from one of our ads in ChatGPT, and __obref), and, after you sign up or log in, your email address in one-way (SHA-256) hashed form. We also keep the ad reference in a cookie of our own (bt_oppref) for 30 days.
• Sent by our server when you sign up and when you buy a plan or credits: the step (for a purchase, the plan or pack, amount and currency); your email address and account id in one-way (SHA-256) hashed form; your network address and browser details; and the OpenAI ad reference and browser reference. So that a payment can be reported, checkout stores these with the Stripe payment, and only if Advertising was allowed; if it was not, nothing is stored and nothing is sent. When a plan starts with a free period, its first payment is reported as the purchase when it is taken, in the same way but without your network address and browser details; for that, the OpenAI ad reference and browser reference are also kept with your account from sign-up and each checkout, only while Advertising is allowed, and the payment is reported only if Advertising was allowed at your most recent checkout. Renewals are not sent to OpenAI.
• We never send OpenAI your name, your email address in readable form, or anything from inside your account. OpenAI uses what it receives to measure our ads, under its own terms and privacy policy: openai.com/policies/privacy-policy
• Reject in the cookie banner, or turn Advertising off in Cookie settings, and from then on your browser sends nothing to OpenAI, the OpenAI cookies are deleted, and our server reports no further sign-ups or purchases from you. One exception: the first payment of a plan you started with a free period is reported if Advertising was allowed when you checked out, because that choice is stored with your account; write to info@blogtend.com and we will stop it. Withdrawing does not affect what OpenAI already received.

Advertising measurement with Microsoft Advertising (Bing)

We use the Microsoft Advertising UET (Universal Event Tracking) tag to measure which of our own ads on Bing and Microsoft's other search and partner sites lead to a sign-up or purchase. It follows your Advertising choice with the same regional rules as Meta above: in the EEA, the UK, Switzerland and the UAE (and when we cannot tell where you are) it is off until you accept Advertising in the cookie banner; elsewhere it is on unless you switch Advertising off. While it is off, Microsoft's script is not loaded, no Microsoft advertising cookie is set and no request reaches Microsoft Advertising.

• Sent by your browser only: the page you view, the steps sign-up and purchase (for a purchase, the amount and currency), your network address, browser details and the UET cookie ids (_uetvid, _uetsid, and _uetmsclkid when you arrive from one of our Microsoft ads). Our server sends Microsoft nothing.
• We never send Microsoft Advertising your name, your email address in any form, your account id or anything from inside your account. Microsoft may use what it receives to measure our ads and to deliver and optimise them, under its own terms and privacy statement: privacy.microsoft.com/privacystatement
• Reject in the cookie banner, or turn Advertising off in Cookie settings, and from then on your browser sends no further page views, sign-ups or purchases to Microsoft Advertising. Withdrawing does not affect what Microsoft already received.

Heatmaps and session recordings (Microsoft Clarity)

We use Microsoft Clarity to understand how people use our website and app: where they click and scroll, and recordings of visits, so we can find what confuses people and fix it. It follows the same analytics choice as Google Analytics: in the EEA, the UK, Switzerland and the UAE it only runs after you allow analytics in the cookie banner, and you can switch it off at any time in Cookie settings. It never runs inside our app when it is embedded in Shopify or Wix.

• Clarity records page layout, mouse movement, clicks, scrolling and the pages you visit. Clarity is set to mask text you type into form fields, so it is not sent. When you are signed in, the visit is linked to a random account number, never to your name or email address.
• Our Clarity project is linked to our Google Analytics and Google Ads accounts, so a recording can be matched with the analytics visit and the ad campaign that led to it. This happens only when you have allowed analytics, and no name or email address is shared.
• Microsoft processes this data for us under its Clarity terms and its own privacy statement: privacy.microsoft.com/privacystatement

What we do not do

• Our server never sends Google your name, your email address in readable form, or anything from inside your account, such as your sites, articles, keywords or credentials. The only contact detail it sends Google Ads is your hashed email address with a purchase, as described above, and only when advertising measurement is allowed.
• Google signals is switched off, so Google Analytics does not link your visits to your Google account for cross-device reports.

7. Who else processes your data

These are the companies we rely on to run the Service:

We do not sell or rent personal data. The only advertising companies that receive data from us are Google, Meta, TikTok, OpenAI and Microsoft, for the measurement described under “Analytics and advertising measurement”. We may disclose data where the law requires it, or to establish or defend legal claims.

8. How your site credentials are protected

• Secrets are encrypted at rest and decrypted only to make a request to your site.
• They are not returned to the browser, and we design our logging and error messages to leave them out.
• You can revoke an Application Password from your own WordPress admin at any time, which cuts our access immediately.
• Disconnecting a site in BlogTend deletes the stored credential.

9. How long we keep things

• Account and content — for as long as the account exists, then deleted or anonymised within 30 days of closure.
• Acceptance records — for as long as the account exists and for up to six years after it closes, so we can prove the agreement if a dispute arises.
• Site credentials — until you disconnect the site or close the account.
• Billing records — as long as tax and accounting law requires, which is generally several years, regardless of account closure.
• Network address, location and referral note — for as long as the account exists. An address blocked for abuse stays on our block list until we remove it.
• Free trial record — if BlogTend articles were delivered to a website and it is then disconnected, or its account is closed, we keep a one-way hash of the website's domain for 12 months, no longer linked to you once your account is closed, so the same website cannot restart the free trial.
• Operational and email logs — short-lived, kept only as long as they are useful for debugging and abuse prevention.
• Google Analytics data — event-level data is kept for 14 months, then deleted by Google; aggregated reports that identify nobody are kept longer. The _ga cookies last up to 2 years and the _gcl cookies up to 90 days in your browser unless you delete them.
• Microsoft Clarity data — recordings are kept for 30 days (up to 13 months only for a recording we mark to study); heatmaps and other aggregate data up to 13 months.
• Google Ads conversion records — kept by Google under its own retention policies.
• Meta advertising measurement data — what Meta receives is kept by Meta under its own terms. The Meta cookie ids, network address and browser details that checkout stores with a Stripe payment stay with that payment record for as long as the billing record. Those kept with your account are cleared 90 days after they were collected, or when the account is deleted. The _fbp and _fbc cookies last up to 90 days in your browser unless you delete them.
• TikTok advertising measurement data — what TikTok receives is kept by TikTok under its own terms. The TikTok ids, network address and browser details that checkout stores with a Stripe payment stay with that payment record for as long as the billing record. Those kept with your account are cleared 90 days after they were collected, or when the account is deleted. The _ttp cookie lasts up to 13 months and bt_ttclid 30 days in your browser unless you delete them.
• OpenAI advertising measurement data — what OpenAI receives is kept by OpenAI under its own terms. The OpenAI references, network address and browser details that checkout stores with a Stripe payment stay with that payment record for as long as the billing record. Those kept with your account are cleared 90 days after they were collected, or when the account is deleted. The __oppref and bt_oppref cookies last 30 days and __obref up to 12 months in your browser unless you delete them.
• Microsoft Advertising measurement data — what Microsoft receives is kept by Microsoft under its own terms. We store nothing for it. The _uetvid cookie lasts up to 13 months, _uetmsclkid 90 days and _uetsid one day in your browser unless you delete them.

10. International transfers

Ravinaro LLC is registered in the United States and run from Dubai, United Arab Emirates, and our providers are located in several countries, including the United States (among them Google, Meta, TikTok, OpenAI and Microsoft, for analytics and advertising measurement), Singapore and the People's Republic of China (for some AI providers). Where data leaves a jurisdiction that restricts transfers, we rely on the appropriate safeguards for that route — for transfers out of the EEA or the UK, the standard contractual clauses in our providers' data-processing terms, or the provider's certification under the EU-US Data Privacy Framework and its UK and Swiss extensions where it holds one.

11. Your rights

Depending on where you live you may have the right to:

• ask what we hold about you and get a copy;
• have inaccurate details corrected;
• have your data deleted;
• receive it in a portable format;
• object to, or ask us to restrict, processing based on legitimate interests;
• withdraw consent where we relied on it;
• complain to your data-protection authority.

These rights come from the UAE Personal Data Protection Law, the GDPR and UK GDPR, and the CCPA/CPRA in California, among others. Write to info@blogtend.com and we will answer within 30 days. We do not discriminate against anyone for exercising a right.

Your privacy choices (California and other US states)

We do not sell personal information for money. Letting Google Ads cookies, the Meta Pixel, the TikTok Pixel, the OpenAI Ads Measurement Pixel and the Microsoft Advertising UET tag measure and personalise or optimise our advertising, and our server sending Google, Meta, TikTok and OpenAI a hashed email address, may count as “sharing” personal information for cross-context behavioural advertising, or as “targeted advertising”, under California and other US state laws. You can opt out at any time: open Cookie settings and turn off Advertising (or Analytics too). The choice is stored in that browser, so repeat it on each browser you use; clearing your cookies resets it. You can also email info@blogtend.com, and an authorised agent may make a request for you. We do not knowingly sell or share the personal information of anyone under 16.

12. Cookies and similar technologies

Necessary cookies and your saved preferences are always on. Analytics and advertising cookies (including Meta's _fbp and _fbc, TikTok's _ttp, OpenAI's __oppref and __obref and Microsoft's _uetvid and _uetsid) follow your choice in the cookie banner: in the EEA, the UK, Switzerland and the UAE they are off until you accept them; elsewhere they are on until you turn them off. Change your choice at any time in Cookie settings.

Your light/dark theme choice is kept in your browser's local storage, not in a cookie, and is never sent to us.

Our bot-protection service may set its own cookies while it runs the bot check, and Stripe sets its own cookies on its checkout and billing-portal pages, under their own policies.

13. Children

The Service is for business use by adults. We do not knowingly collect data from anyone under 18. If you believe a child has created an account, tell us and we will remove it.

14. If something goes wrong

If a security incident affects your personal data we will investigate, contain it, notify the relevant authority where the law requires, and tell affected customers by email without undue delay.

15. Changes to this policy

We will update this page when our practices change and move the "last updated" date. For material changes — a new category of data, or a new kind of processor — we will also email account holders.