Privacy Policy

1. Who is responsible for your data

Ravinaro LLC-FZ, Dubai, Meydan Grandstand is the controller of personal data processed through BlogTend.

For anything in this policy, including a request to see or delete your data, write to info@blogtend.com or use the contact form.

2. What we collect

You give us

• Account details — name, email address and a hashed password. If you sign in with Google we receive your name, email address, profile picture and Google's stable account identifier instead of a password.
• Connected site credentials — the site URL and whatever lets BlogTend publish there: a WordPress username and Application Password or connector token, a Wix app instance or API key, a Webflow app access token or site API token, a webhook endpoint and its signing secret, or a Google Search Console service-account key you add for indexing. Secrets are encrypted at rest with AES-256-GCM, are not shown back to you (a webhook signing secret only while you connect or rotate it), are never sent to any AI provider, and are deleted when you disconnect the site (Wix and Webflow app access is also revoked with the platform).
• Shopify installs — the shop domain, the store owner's email and name (used to create your BlogTend account when the app is first opened), an encrypted access token, plus the blog and article content BlogTend publishes to your store. We never receive your Shopify customer or order data. The access token is deleted when you uninstall the app. On Shopify's shop-redact request, the store's details are erased, and so is the account created for it unless you took it over by setting a password.
• Content you write — prompts, topics, business context, saved article styles, and anything you type into a support ticket or the contact form.
• Your acceptance of our terms — when you accepted the Terms of Service and this policy, which version, how (for example the sign-up checkbox), and the network address, country and browser it came from, kept as evidence of the agreement.
• Billing details — handled by Stripe. We store the Stripe customer and subscription identifiers and your plan. We never see or store card numbers.

We generate or collect automatically

• Generated content — articles, images, research notes and the source URLs behind them.
• Usage records — which model ran at which step, token counts and the cost of each run, so both of us can see what an article cost.
• Product usage events — inside the signed-in app we record events such as which feature you used, a failed site connection or a cancelled check-out, linked to your account, so we can see where customers get stuck and fix it. These stay on our own servers and are not shared with advertisers.
• Network address and approximate location — the network (IP) address your account was created from and the one you last used, with the country and, where our hosting provider supplies it, the city it maps to. We use them to protect accounts and the Service: spotting fraud and abuse, and blocking access from an address that abuses it.
• How you found us — when analytics is allowed, a first-party cookie notes the website that referred you (its address only, not the full page), campaign tags in the link you followed, whether you arrived from an ad, and the first page you visited. If you create an account, that note is saved with it, so we can understand which channels bring customers.
• Operational logs — request and error logs, and a log of emails sent to you.
• Analytics and advertising measurement — pages viewed, clicks on key buttons, sign-ups, check-outs and purchases, the device, browser and approximate location Google derives from your network address, and, if you arrived from one of our Google ads, the ad click identifier. See “Analytics and advertising measurement” below.
• Bot-protection signals — our bot-protection service inspects the browser on sign-up, sign-in and the contact form. It is designed not to track people across sites.

3. Why we use it, and on what legal basis

• To provide the Service — generating and publishing articles, running your automations, showing your usage. Basis: performance of our contract with you.
• To bill you and keep the records tax law requires. Basis: contract and legal obligation.
• To email you about verification, published articles, paused automations, low credits and support replies. Basis: contract. Optional notifications can be turned off.
• To keep the Service secure and working — bot protection, abuse prevention, debugging. Basis: our legitimate interest in a service that is not overrun.
• To understand how the site is used and whether our ads work — Google Analytics, Microsoft Clarity and Google Ads conversion measurement. Basis in the EEA, the UK and Switzerland: your consent, which you give or refuse in the cookie banner and can withdraw at any time. Elsewhere: our legitimate interest in measuring and improving our own website and advertising, and you can switch it off at any time in Cookie settings.
• To protect accounts and block abuse — the network address and approximate location we keep with each account, used to detect fraud and to block addresses that abuse the Service. Basis: our legitimate interest in keeping the Service and its customers safe.
• To understand how people find us — the referral and campaign note described above, which follows your analytics choice. Basis in the EEA, the UK and Switzerland: your consent. Elsewhere: our legitimate interest in knowing which channels work, and you can switch it off in Cookie settings.
• To improve the product — the first-party usage events described above. Basis: our legitimate interest in a product that works; you can object by writing to us.
• To keep evidence of our agreement — your acceptance record. Basis: our legitimate interest in being able to prove the contract, and legal obligation where it applies.

4. What the AI providers receive

Producing an article means sending your prompt, the site context you supplied and the intermediate drafts to the AI model provider handling that step, and sending the topic to that provider's web-search tool. We work with several established AI model providers and choose which one handles each step as models improve. They are located in the United States, Singapore and the People's Republic of China.

We use these providers only through their paid business APIs, under terms that bind them to process the data to provide their service. Some providers are headquartered in, or process data in, the People's Republic of China, where data-protection law differs materially from yours. The current list of providers, and which ones handle your articles, is available on request: write to us and we will send it.

We never send your site credentials to any AI provider. They receive the writing task, not the keys to your site.

5. What ProveRank receives

Keyword and search data comes from ProveRank, our sister product, operated by the same company. To return search volume, difficulty and related keywords, it receives your site's domain, the country and language you target, your topic seeds and the keywords planned for your articles. It does not receive your article content or your site credentials.

Your name and email address go to ProveRank only when you click to claim a free ProveRank account, never before. Search Console data comes back from ProveRank only if you connected Search Console in ProveRank yourself.

Once you have a ProveRank account, ProveRank's own privacy policy covers it: ProveRank privacy policy.

6. Analytics and advertising measurement

We use Google Analytics 4 on our website and in the app to see which pages are visited, which buttons are clicked and where sign-ups and purchases come from. We advertise with Google Ads, and Google Ads counts sign-ups and purchases as conversions by importing them from Google Analytics. We do not use any other advertising network or tracking pixel.

What Google receives

• The address of the page, the page before it, the event (for example a page view, a sign-up or a started check-out) and details such as the sign-in method or the plan you chose — never your name, your email address, your article content or your site credentials.
• Your network address, device and browser. Google Analytics uses the network address to derive an approximate location and does not log or store the address itself. A random identifier kept in the _ga cookie tells one browser apart from another.
• If you arrived from a Google ad: the ad click identifier (gclid) that Google adds to the link. It is kept in the _gcl_aw cookie, only when advertising is allowed, so a later sign-up or purchase can be credited to that ad.
• When you pay: we store the Google Analytics identifiers of your browser (client and session identifiers, the ad click identifier if you allowed advertising, and your advertising choice) with the Stripe checkout. When Stripe confirms the payment, our server sends Google Analytics a purchase event with those identifiers, the transaction number, the plan or pack bought, the amount and the currency. Renewals are sent the same way, as a separate renewal event. Your name, email address and card details are never sent. If analytics was not allowed when you checked out, nothing is stored with the checkout and nothing is sent.

Your choice

• In the EEA, the UK and Switzerland (and when we cannot tell where you are) analytics and advertising are off until you choose in the cookie banner, which offers Analytics and Advertising separately. Until then the Google tag stores no cookies; Google receives only cookieless signals (that a page was viewed, whether consent was given, and the page address, which may include an ad click identifier), which Google says it uses for aggregate modelling and not to identify you.
• Everywhere else both are on by default and you can switch either off.
• You can change or withdraw your choice at any time from Cookie settings at the foot of every page, or with this button: Cookie settings
• Withdrawing does not affect measurement that already happened. You can also block these cookies in your browser, or install Google's opt-out add-on: tools.google.com/dlpage/gaoptout

Google's role

For Google Analytics, Google processes this data on our behalf under its data-processing terms. For advertising measurement, and for any use of the data to personalise ads, Google also acts as an independent controller under its own privacy policy. With advertising allowed, Google may use it to show our ads to people who have visited our site.

• How Google uses information from sites that use its services: policies.google.com/technologies/partner-sites
• Your Google ad settings: myadcenter.google.com

Heatmaps and session recordings (Microsoft Clarity)

We use Microsoft Clarity to understand how people use our website and app: where they click and scroll, and recordings of visits, so we can find what confuses people and fix it. It follows the same analytics choice as Google Analytics: in the EEA, the UK and Switzerland it only runs after you allow analytics in the cookie banner, and you can switch it off at any time in Cookie settings. It never runs inside our app when it is embedded in Shopify or Wix.

• Clarity records page layout, mouse movement, clicks, scrolling and the pages you visit. Clarity is set to mask text you type into form fields, so it is not sent. When you are signed in, the visit is linked to a random account number, never to your name or email address.
• Our Clarity project is linked to our Google Analytics and Google Ads accounts, so a recording can be matched with the analytics visit and the ad campaign that led to it. This happens only when you have allowed analytics, and no name or email address is shared.
• Microsoft processes this data for us under its Clarity terms and its own privacy statement: privacy.microsoft.com/privacystatement

What we do not do

• Google's enhanced conversions and user-provided data collection are switched off in our Google Analytics and Google Ads accounts, so Google does not collect your email address or any other contact detail from our site. If we ever turn them on, we will update this policy first.
• Google signals is switched off, so Google Analytics does not link your visits to your Google account for cross-device reports.

7. Who else processes your data

These are the companies we rely on to run the Service:

We do not sell personal data. The only advertising company that receives data from us is Google, for the measurement described under “Analytics and advertising measurement”. We may disclose data where the law requires it, or to establish or defend legal claims.

8. How your site credentials are protected

• Secrets are encrypted at rest and decrypted only to make a request to your site.
• They are not returned to the browser, and we design our logging and error messages to leave them out.
• You can revoke an Application Password from your own WordPress admin at any time, which cuts our access immediately.
• Disconnecting a site in BlogTend deletes the stored credential.

9. How long we keep things

• Account and content — for as long as the account exists, then deleted or anonymised within 30 days of closure.
• Acceptance records — for as long as the account exists and for up to six years after it closes, so we can prove the agreement if a dispute arises.
• Site credentials — until you disconnect the site or close the account.
• Billing records — as long as tax and accounting law requires, which is generally several years, regardless of account closure.
• Network address, location and referral note — for as long as the account exists. An address blocked for abuse stays on our block list until we remove it.
• Operational and email logs — short-lived, kept only as long as they are useful for debugging and abuse prevention.
• Google Analytics data — event-level data is kept for 14 months, then deleted by Google; aggregated reports that identify nobody are kept longer. The _ga cookies last up to 2 years and the _gcl cookies up to 90 days in your browser unless you delete them.
• Microsoft Clarity data — recordings are kept for 30 days (up to 13 months only for a recording we mark to study); heatmaps and other aggregate data up to 13 months.
• Google Ads conversion records — kept by Google under its own retention policies.

10. International transfers

We operate from Dubai, United Arab Emirates. and our providers are located in several countries, including the United States (among them Google, for analytics and advertising measurement), Singapore and the People's Republic of China (for some AI providers). Where data leaves a jurisdiction that restricts transfers, we rely on the appropriate safeguards for that route — for transfers out of the EEA or the UK, the standard contractual clauses in our providers' data-processing terms, or the provider's certification under the EU-US Data Privacy Framework and its UK and Swiss extensions where it holds one.

11. Your rights

Depending on where you live you may have the right to:

• ask what we hold about you and get a copy;
• have inaccurate details corrected;
• have your data deleted;
• receive it in a portable format;
• object to, or ask us to restrict, processing based on legitimate interests;
• withdraw consent where we relied on it;
• complain to your data-protection authority.

These rights come from the UAE Personal Data Protection Law, the GDPR and UK GDPR, and the CCPA/CPRA in California, among others. Write to info@blogtend.com and we will answer within 30 days. We do not discriminate against anyone for exercising a right.

Your privacy choices (California and other US states)

We do not sell personal information for money. Letting Google Ads cookies measure and personalise our advertising may count as “sharing” personal information for cross-context behavioural advertising, or as “targeted advertising”, under California and other US state laws. You can opt out at any time: open Cookie settings and turn off Advertising (or Analytics too). The choice is stored in that browser, so repeat it on each browser you use; clearing your cookies resets it. You can also email info@blogtend.com, and an authorised agent may make a request for you. We do not knowingly sell or share the personal information of anyone under 16.

12. Cookies and similar technologies

Necessary cookies and your saved preferences are always on. Analytics and advertising cookies follow your choice in the cookie banner: in the EEA, the UK and Switzerland they are off until you accept them; elsewhere they are on until you turn them off. Change your choice at any time in Cookie settings.

Your light/dark theme choice is kept in your browser's local storage, not in a cookie, and is never sent to us.

Our bot-protection service may set its own cookies while it runs the bot check, and Stripe sets its own cookies on its checkout and billing-portal pages, under their own policies.

13. Children

The Service is for business use by adults. We do not knowingly collect data from anyone under 18. If you believe a child has created an account, tell us and we will remove it.

14. If something goes wrong

If a security incident affects your personal data we will investigate, contain it, notify the relevant authority where the law requires, and tell affected customers by email without undue delay.

15. Changes to this policy

We will update this page when our practices change and move the "last updated" date. For material changes — a new category of data, or a new kind of processor — we will also email account holders.