BlunxAI BlunxAI
Try for free

Your data.
Your control.

This policy explains which personal data we collect, why, how we protect it and what your rights are, in accordance with the General Data Protection Regulation (GDPR).

Last updated: August 6, 2026 GDPR compliant

Table of contents

1. Introduction 2. Data controller 3. Data collected 4. Purposes and legal bases 5. Cookies and trackers 6. Data processed by artificial intelligence 7. Recipients and processors 8. Transfers outside the European Union 9. Retention period 10. Data security 11. Your rights 12. Minors 13. Changes to the policy 14. Contact and complaints
1

Introduction

The protection of your personal data is at the heart of our commitments. This Privacy Policy describes how BlunxAI collects, uses, shares and protects the personal data of Users of the blunxai.com platform and its API.

It applies to all processing carried out by BlunxAI, as data controller and, where applicable, as processor when you connect third-party personal data to the Service.

We invite you to read this document carefully; it forms an integral part of the Terms of Service.

2

Data controller

The controller of the personal data collected in the context of the Service is the company BlunxAI.

ControllerBlunxAI
Emailprivacy@blunxai.com
FormContact page
3

Data collected

We only collect the data strictly necessary to provide and improve the Service:

Account data: name, email address, password (stored hashed and salted, never in plain text).
Subscription data: plan subscribed, billing cycle, subscription status, Stripe reference identifiers (customer and subscription), invoice history. Payment data (card number, etc.) is processed exclusively by our payment provider Stripe; we never store it.
Application and API data: name and description of the applications created, API key prefix (full keys are stored hashed), last-used date.
Usage data: request logs (endpoint called, status code, duration, possible error message), usage counters per application.
Data sent to the Service: the questions asked in natural language and the data from your databases required to generate the answers. This data is processed only for as long as needed to produce the requested result.
Contact data: name, email address, subject and message when you use the contact form.
4

Purposes and legal bases

Every data processing operation relies on a clear purpose and a legal basis compliant with Article 6 of the GDPR:

Account creation and management - performance of the contract (Art. 6.1.b).
Provision of the AI features (chat, insights, reports) - performance of the contract (Art. 6.1.b).
Billing, payment and subscription management - performance of the contract (Art. 6.1.b) and legal obligation (Art. 6.1.c).
Security, prevention of abuse and fraud - legitimate interest (Art. 6.1.f).
Improvement of the Service based on anonymized and aggregated metrics - legitimate interest (Art. 6.1.f).
Answering contact and support requests - legitimate interest (Art. 6.1.f).
Sending transactional emails (email verification, billing notifications) - performance of the contract (Art. 6.1.b).
Sending marketing communications (where applicable) - consent (Art. 6.1.a), withdrawable at any time.
5

Cookies and trackers

The Service only uses cookies strictly necessary for its operation, exempt from prior consent:

  • Session cookie (blunxai_session): authenticates you and keeps your login session alive. It is signed and expires at the end of the session.
  • CSRF token: protects forms against cross-site request forgery attacks.

We do not use advertising cookies or third-party tracking. You can configure your browser at any time to block or delete cookies, bearing in mind that this may affect how the Service works.

6

Data processed by artificial intelligence

To generate answers to your questions, the Service relies on artificial intelligence models provided by third-party vendors (such as Anthropic), acting as processors. In this context:

  • only the data strictly necessary for the answer is transmitted (minimization principle);
  • transmissions are encrypted in transit (TLS 1.3);
  • your Data is never used to train AI models, unless you give explicit prior consent;
  • the data transmitted is processed only for as long as necessary to generate the result.

We recommend that you only send the Service the data genuinely required for your analysis and that you avoid, as far as possible, sensitive personal data (health, biometric data, etc.) unless appropriate safeguards are put in place.

7

Recipients and processors

Your data may be transmitted to the following categories of recipients, only for the purposes described above:

Cloud host (AWS, EU region): hosting of the data and the infrastructure.
Stripe: payment processing and subscription management. See the Stripe privacy policy.
AI model providers (e.g. Anthropic): generation of answers, under the conditions described in section 6.
Email delivery provider: sending transactional and notification emails.
BlunxAI team: limited access, on a need-to-know basis, for support and maintenance.

Each of these providers is bound by contractual guarantees compliant with the GDPR. We never sell, rent or share your personal data for commercial purposes.

8

Transfers outside the European Union

Your data is hosted within the European Union. Some of our processors (in particular the AI model providers) may be located outside the EU.

These transfers are governed by the appropriate safeguards provided for by the GDPR (Chapter V): standard contractual clauses adopted by the European Commission, adequacy decisions, or binding corporate rules.

You can obtain a copy of the safeguards applicable to these transfers by contacting us at the address given in section 14.

9

Retention period

Your data is kept for no longer than necessary for the purposes for which it is processed:

Account and subscription dataUntil the account is deleted
Request logs (audit trail)1 year
Invoices and accounting data10 years (legal obligation)
Backups30 days
Session cookieDuration of the session
10

Data security

We implement appropriate technical and organizational measures to ensure a level of security suited to the risk, in accordance with Article 32 of the GDPR. In short:

  • AES-256 encryption at rest and TLS 1.3 in transit;
  • passwords hashed and salted, API keys stored hashed (SHA-256);
  • role-based access control (RBAC) and 24/7 monitoring;
  • notification of personal data breaches as soon as possible and, where required, to the CNIL within 72 hours.
11

Your rights

In accordance with the GDPR, you have the following rights over your personal data:

Access

Obtain a copy of your data (Art. 15).

Rectification

Correct inaccurate data (Art. 16).

Erasure

Have your data deleted (Art. 17).

Restriction

Restrict the processing of your data (Art. 18).

Portability

Retrieve your data in a readable format (Art. 20).

Objection

Object to certain processing operations (Art. 21).

You can exercise these rights at any time:

  • by email to privacy@blunxai.com, stating your request;
  • directly in your customer account to change or delete your account.

We respond to any request within a maximum of one month from receipt. We may need to verify your identity before acting on it.

12

Minors

The Service is intended exclusively for persons aged at least 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, contact us so that we can delete it.

13

Changes to the policy

This Privacy Policy may be updated to reflect changes in our practices, the Service or the regulations. Users will be informed by any appropriate means. The version in force is always available from this page and carries its update date.

14

Contact and complaints

For any question about this policy or the exercise of your rights, contact us at privacy@blunxai.com or via the contact page.

If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the French data protection authority (CNIL), the competent supervisory authority in France.

Your data belongs to you.

No resale. No model training without your consent. Full control, at any time. That is our commitment.

Try BlunxAI for free

A question? → Contact us