Legal
Privacy policy
This notice explains who we are, what personal data we collect, why we use it, how long we keep it, who processes it for us, and your rights under UK GDPR.
Effective date: 1 November 2026
1. Who we are
Brandblox is a product of Ofishial Digital Ltd, a company registered in England and Wales (company number 10693890), registered office 86-90 Paul Street, 3rd Floor, London, EC2A 4NE ("Brandblox", "we", "us"). We are the data controller for the personal data described in this policy.
This policy covers our website (brandblox.app and its subdomains), the Brandblox app, and our communications with you. Contact us about privacy at hello@brandblox.app.
When our customers use Brandblox to store their own brand content, they decide what goes in. Where that content includes personal data (for example a name in an email draft), the customer is the controller and we process it on their behalf under our Terms of service.
2. The data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account data | Name, email address, password (stored as a hash), company name, role | You, when you sign up |
| Workspace content | Brands, colours, fonts, logos, images, copy, emails you build, team members you invite | You and your team |
| Billing data | Billing name and address, plan, invoices, last four digits of your card | You, via Stripe (we never see or store your full card number) |
| AI provider keys | API keys you add for OpenAI, Anthropic (Claude) or OpenRouter | You |
| Integration credentials | API keys or tokens for the email platforms and storage buckets you connect | You |
| Usage data | Pages viewed, features used, device, browser, IP address, approximate location | Collected automatically from server and product logs |
| Support messages | What you send us and our replies | You, by email or in-app support |
| Marketing preferences | Whether you've opted in to product news | You |
3. How we use your data
| Purpose | Data used | Lawful basis (UK GDPR) |
|---|---|---|
| Create and run your account and workspace | Account data, workspace content | Contract |
| Take payment and keep financial records | Billing data | Contract; legal obligation (tax and accounting records) |
| Connect to the AI providers and email platforms you choose | AI keys, integration credentials, the content you send | Contract |
| Send service emails (sign-up, security, billing, important changes) | Account data | Contract; legitimate interests |
| Answer support requests | Account data, support messages | Contract; legitimate interests |
| Understand and improve how the website and product are used | Usage data | Legitimate interests (server and product logs) |
| Send product news and offers | Account data, marketing preferences | Consent, or legitimate interests for existing customers, with an unsubscribe link in every email |
| Keep the service secure and prevent abuse | Usage data, account data | Legitimate interests |
| Comply with the law and enforce our terms | Any relevant data | Legal obligation; legitimate interests |
We do not sell your personal data, and we do not use your workspace content to train AI models.
4. Your AI keys and AI requests
Brandblox works with AI providers on a bring-your-own-key basis. When you add a key for OpenAI, Anthropic or OpenRouter:
- We store the key encrypted and use it only to send the requests you make in Brandblox.
- Requests pass through our secure proxy to the provider you chose. Content you choose to save in your workspace stays in your workspace; transient proxy handling is limited to delivering your request.
- The provider processes your request under its own terms and privacy policy, as your provider. Check their policies for how they handle data sent through the API.
- You can delete your key at any time in Settings; we remove it from our systems when you do.
AI features are optional. Brandblox works fully without them.
5. Who we share data with
We share personal data only with service providers that help us run Brandblox, under contracts that require them to protect it and use it only on our instructions.
| Provider | What they do | Location |
|---|---|---|
| Cloudflare, Inc. | Hosts the Brandblox website and app, object storage (R2), attack protection, encrypted key store and AI proxy | Global network |
| Neon, Inc. (a Databricks company) | Hosts the Brandblox database used by the app and authentication | Europe (configured project region) |
| Stripe Payments UK Ltd and affiliates | Processes payments and stores card details | UK, EU, United States |
| SendGrid (Twilio) | Sends service and product emails | United States |
| Slack Technologies, LLC | Receives support requests so our team can reply | United States |
When you connect your own email platform (for example Braze or Klaviyo), AI provider or storage bucket, we send content there on your instruction. Those services are your providers, and their own terms apply.
We may also share data with professional advisers, with authorities where the law requires it, or with a buyer if Brandblox or Ofishial Digital Ltd is sold or restructured (we'd tell you first).
6. International transfers
Some of our providers process data outside the UK, mainly in the United States. Where they do, we rely on the UK–US data bridge for certified companies or the UK International Data Transfer Addendum to the EU standard contractual clauses, so your data keeps an equivalent level of protection.
7. How long we keep data
| Data | How long |
|---|---|
| Account data and workspace content | While your account is open, then deleted within 30 days of closing it, apart from backups, which roll off within 90 days |
| AI keys and integration credentials | Until you remove them or close your account |
| Billing records | 6 years after the transaction, as UK tax law requires |
| Support messages | 24 months after the conversation ends |
| Product usage logs | Retained only as long as needed for security, reliability and abuse prevention |
| Marketing preferences | Until you unsubscribe, then kept as a suppression record so we don't email you again |
8. How we protect data
We use encryption in transit (HTTPS) and at rest, encrypt AI keys and integration credentials separately, restrict staff access to what's needed, and rely on providers with recognised security certifications. No system is completely secure; if a breach affects your personal data, we'll notify you and the ICO where the law requires.
9. Your rights
Under UK data protection law you can ask us to:
- give you a copy of your personal data;
- correct data that's wrong;
- delete your data;
- restrict or object to how we use it, including for direct marketing at any time;
- give you your data in a portable format;
- withdraw consent you've given, such as for marketing emails.
Email hello@brandblox.app. We'll reply within one month. If your request concerns content a customer stored in Brandblox, we'll pass it to that customer, who controls it.
10. Cookies
We use strictly necessary cookies to keep you signed in and keep the service secure. With your consent, we also use Google Analytics 4 (loaded through Google Tag Manager) to understand how people use www.brandblox.app. Analytics cookies are off by default until you Accept in the cookie banner. You can change your choice anytime via Cookie settings in the footer. We do not use advertising cookies on this site.
| Cookie | Purpose | Type | Lasts |
|---|---|---|---|
| better-auth.session_token (may use a __Secure- prefix in production) | Keeps you signed in to the Brandblox app | Strictly necessary | Session / as configured for auth |
| bb_cookie_consent | Stores your analytics cookie choice (accepted or denied) | Strictly necessary | As set by the consent banner |
| _ga and related Google Analytics cookies | Distinguish visitors for site analytics | Analytics (consent required) | Up to 2 years |
11. Children
Brandblox is not for children. You must be 18 or over to create an account, and we don't knowingly collect data from anyone under 18.
12. Changes to this policy
We'll post any changes here and update the effective date. If a change is significant, we'll email account holders before it takes effect.
13. Contact and complaints
Ofishial Digital Ltd, 86-90 Paul Street, 3rd Floor, London, EC2A 4NE · hello@brandblox.app
If you're unhappy with how we've handled your data, please contact us first. You can also complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113.