Privacy Policy

Last updated: August 2026

This Privacy Policy explains how Bloggerly (“we”, “us”, “our”) collects, uses, and protects your personal data when you use our website and application at bloggerly.ai (the “Service”). We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018.

1. Who we are

Bloggerly is operated by Thomas Mini. We are the data controller responsible for your personal data in respect of the Service. For any privacy questions, contact thomas@bloggerly.ai.

2. What personal data we collect

Account data

Email address (to create and manage your account)
Name (optional, if you provide it)
OAuth identifiers (if you sign in with Google)

Usage data (analytics)

Cookieless analytics (always on): anonymous pageview events captured via PostHog. No identifier is stored on your device. PostHog may derive approximate location from your IP address for aggregate, region-level statistics. We have configured our PostHog project to discard IP data.
Cookie-based analytics (opt-in only): if you accept analytics cookies, PostHog stores a persistent identifier so we can remember you across sessions and link events to your account when signed in. See our Cookie Policy for details.

Content data

Blog briefs, generated content, and writing style settings you create
Website URLs you provide for research and scraping

Product feedback

When you submit feedback in the app we store your account id, the text you wrote, a 1–5 frustration score, the in-app page you came from, and your browser user-agent. We use this to improve the product. Feedback is deleted when you close your account.

Security and error monitoring

Sentry receives error reports that may include your user ID and request metadata (URL, browser, OS). This is necessary to keep the Service reliable and secure.
Authentication events (sign in, sign up, sign out) are logged with your user ID for security auditing. We do not include your email address in these events.

Payment data

Payment processing is handled by Stripe. We do not store your card details — Stripe tokenizes and processes all payment information directly. We receive your subscription status and plan type from Stripe.

3. Legal basis for processing

We process your personal data under the following legal bases:

Performance of a contract (Art. 6(1)(b)) — account creation, content generation, and core Service functionality.
Consent (Art. 6(1)(a)) — cookie-based analytics tracking. You can withdraw consent at any time via Settings → General, the cookie banner on your first visit, or our Cookie Policy page.
Legitimate interests (Art. 6(1)(f)) — anonymous cookieless analytics for product improvement, error monitoring via Sentry, and security audit logging of authentication events and product feedback you send us.

4. How we use your data

To provide, maintain, and improve the Service
To authenticate you and manage your account
To generate AI-powered content based on your inputs
To understand how the Service is used (analytics)
To detect and fix errors (error monitoring)
To read and act on product feedback you send us
To prevent fraud and unauthorized access (security)
To process subscription payments via Stripe
To send you service-related emails (e.g. password resets)

5. Data sharing and processors

We use the following third-party processors to operate the Service:

Supabase — authentication, database hosting, and file storage (Netherlands/EU)
PostHog — product analytics (EU hosting configured)
Sentry — error monitoring
Stripe — payment processing
OpenRouter / fal.ai — AI model providers for content and image generation
Resend — transactional email delivery
Vercel — web hosting and edge functions

We do not sell your personal data. We do not share your data with advertising networks. We do not use marketing or advertising cookies.

6. International data transfers

Some of our processors operate outside the EU/EEA (e.g. Vercel, Sentry, OpenRouter). Where this occurs, we rely on Standard Contractual Clauses (SCCs) and the processor's compliance frameworks to ensure adequate protection of your personal data.

7. Data retention

Account data: retained for the duration of your account. Deleted within 30 days of account closure.
Content data: retained until you delete it or close your account.
Product feedback: deleted within 30 days of account closure (cascade).
Analytics data: cookieless events are retained in aggregate. Cookie-based analytics data is linked to your identifier for 365 days, then anonymized.
Error reports: retained for 90 days, then automatically deleted.
Auth event logs: retained for 12 months for security auditing.

8. Your rights under GDPR

You have the following rights regarding your personal data:

Right of access — request a copy of your data
Right to rectification — correct inaccurate data
Right to erasure — request deletion of your data
Right to restrict processing — limit how we use your data
Right to data portability — receive your data in a machine-readable format
Right to object — object to processing based on legitimate interests
Right to withdraw consent — withdraw consent for cookie-based analytics at any time
Right to lodge a complaint — with your local supervisory authority

To exercise any of these rights, email thomas@bloggerly.ai.

9. Children's privacy

The Service is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe we have collected data from a child, please contact us and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the “Last updated” date. We encourage you to review this page periodically.

11. Contact

For questions about this Privacy Policy or your personal data, email thomas@bloggerly.ai.