Privacy Policy

Last updated: October 18, 2026

BlogAmplify ("we", "us" or "our") plans, writes and publishes SEO articles for businesses at blogamplify.com (the "Service"). This policy explains what personal data we collect, why, who processes it for us, how long we keep it and the choices you have.

For the data in your account, we are the controller. If articles or reports we produce for you contain personal data about other people, you decide what is published on your website and remain responsible for it there.

1. Information We Collect

1.1 Account data

When you create an account we collect your email address and, if you sign in with Google, the name and profile picture Google shares with us. Sign-in is handled by Supabase.

1.2 Website and business data

To plan and write articles we collect what you tell us about your business (website address, business name, products and services, audiences, main market, competitors, brand colour, tone and article settings) and what we read from your website: its sitemap and the text, headings, images, links and technical details of its public pages. We also store your answers to the optional questions we ask about your business.

1.3 Connected accounts

You may connect the following services. Their credentials are encrypted before we store them:

• Shopify: the app credentials or access token for your store
• WordPress: your username and an Application Password
• Notion: an OAuth access token
• Google Search Console: an OAuth token with read access to your search data
• Bing Webmaster Tools: an OAuth token, used to read your Bing search data and submit new articles for indexing
• Custom webhook: your endpoint address and signing secret

We use these credentials only to provide the Service and never share them with anyone else.

1.4 Search and visibility data

When you connect Google Search Console or Bing Webmaster Tools, we regularly import search performance data (queries, pages, clicks, impressions and positions) and, for Google, the index status of your pages. We also collect public data about your website and market: keyword volumes, Google search and map results, your Domain Rating, listings on third-party pages and, on plans with AI visibility, the answers AI assistants give to the questions we track for you.

1.5 Content we create for you

We store content plans, topics, articles, images, the research behind them (sources and excerpts), quality notes, the changes we make to published articles, and your conversations with the in-app assistant.

1.6 Billing data

Payments are handled by Dodo Payments. We receive your subscription's status, plan, period, invoices and the email and customer reference Dodo uses for you. We do not receive or store your full card details.

1.7 Technical and usage data

Our servers record technical information such as IP address, browser type and the requests made, for security and debugging. On our public pages we use Google Analytics, only after you accept analytics cookies (see section 8). Google Analytics never runs inside the logged-in app.

1.8 Connected AI apps

You can connect AI apps that support the Model Context Protocol (MCP), such as Claude, ChatGPT, Claude Code or Cursor, to your account, or create an API key for an app or script (Settings, Connected apps). When you do, we store:

• the name and web addresses the app gave us when it registered with BlogAmplify
• what you allowed it to do (read only, or read and make changes) and on which of your websites
• its access tokens, or your API key, only as a one-way hash, so they can't be read back from our database
• a record of each request the app made on each website: what it asked for, a short outcome and any change or proposal it made, which you see in Settings, Connected apps

When an app you connected asks for it, we send it data about the websites you allowed, for example Site Health results, rankings, content plans and articles, Search Console figures, Get listed pages, local search and AI visibility results. The app and the AI service behind it (for example Anthropic for Claude, or OpenAI for ChatGPT) handle that data under their own terms and privacy policies, as a service you chose, not on our behalf. Only connect apps you trust, and remove the ones you no longer use.

2. How We Use Your Data

• Providing the Service: analysing your website, planning topics, researching and writing articles, making images and publishing to the platforms you connect
• Keeping articles up to date: checking your published articles and, when that setting is on, making small edits to them, which you can undo
• Reports: Site Health, rankings, AI visibility, Get listed and Local search
• Connected AI apps: answering the requests of the AI apps you connect, within the access you gave them, and showing you what they did
• Billing: subscriptions, trials and invoices, including making sure each email address gets one free trial
• Email: messages about your account and billing, the monthly AI visibility report when it is switched on for a website, and short good-news emails you can turn off with one click
• Improving our website: understanding which public pages and channels bring visitors (Google Analytics, with your consent)
• Security: preventing abuse, fraud and unauthorised access

We do not sell your personal data and we do not use it for advertising.

3. Legal Basis for Processing (GDPR)

If you are in the European Economic Area, the UK or Switzerland, we rely on these legal bases:

• Contract: providing the Service you signed up for, including billing, publishing and reports
• Consent: Google Analytics cookies on our public pages, and connecting your Google, Bing and publishing accounts and AI apps. You can withdraw consent at any time.
• Legitimate interest: security, fraud prevention, preventing repeat free trials, and essential service emails
• Legal obligation: keeping billing and tax records

4. Service Providers (Processors)

These companies process personal data on our behalf, each only for the job listed. The publishing platforms you connect (Shopify, WordPress, Notion or your own webhook) receive the articles we publish for you under their own terms, and AI apps you connect receive the data they ask for under theirs (see Connected AI apps).

Google Search Console and Bing Webmaster Tools are used only when you connect them. Microsoft (Bing) then receives the addresses of your new articles for indexing.

5. International Data Transfers

Our servers run in India and our database is hosted in Singapore, and our providers may process data in the United States, the European Union and other countries. For transfers of personal data from the European Economic Area, the UK or Switzerland to countries without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses and equivalent safeguards offered by our providers.

6. Data Retention

• Active account: we keep your data while your account is open.
• Deleting your account: you can delete your account in Settings. Any running subscription is cancelled first, then your account, websites, topics, articles, connected accounts, connected AI apps, reports and assistant conversations are deleted from our database straight away, and your sign-in record is removed. Articles already published on your website stay there.
• Connected AI apps: an app's access and the record of what it did are kept until you remove the app or delete your account. Access tokens expire after an hour, and an app that isn't used for 90 days has to sign in again (API keys work until you remove them). The record keeps about the last 1,000 requests of each app on each website.
• Images: article images stay in storage after you delete your account, because articles on your website may still show them, unless you choose to delete them too when you delete your account.
• Free trial record: we keep a normalised copy of your email address after deletion so the same address cannot start a second free trial.
• Billing records: kept by us and Dodo Payments as long as tax and accounting law requires.
• Server logs: kept for up to 90 days for security and debugging.
• Backups: deleted data can remain in our database provider's backups until they expire.
• Google Analytics: kept for no longer than 14 months.

7. Your Rights

Depending on where you live, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your data (you can delete your account yourself in Settings)
• Receive your data in a machine-readable format
• Restrict or object to processing based on legitimate interest
• Withdraw consent at any time, without affecting processing before you withdrew it
• Complain to your local data protection authority

To use any of these rights, email us at support@blogamplify.com.

8. Cookies, Google Analytics and Local Storage

8.1 Google Analytics

We use Google Analytics 4 to understand which pages and channels bring visitors to BlogAmplify. It runs on our public pages (such as the home page, pricing, guides and blog), the sign-up and log-in pages, the plan step and the page you return to after checkout. On the page you pass through after signing up with Google, it only records that a new account was created. It never runs inside the logged-in app: the dashboard, editor, settings and setup steps send nothing to Google.

Consent. When you first visit a page where it runs, a banner asks whether you accept analytics cookies. Until you click Accept, Google Analytics sets no cookies. We use Google's Consent Mode: before you accept, or if you decline, the Google tag may still send Google basic visit signals without cookies or any identifier stored on your device, which Google uses only in aggregated form. Declining also removes Google Analytics cookies set earlier. You can change your choice at any time with Cookie settings at the bottom of every page.

What is collected. Pages viewed (the address is cleaned first: account and order numbers are removed and only campaign tags such as utm_source are kept), the site that referred you (its domain only), page title, device and browser type, screen size, language, approximate location derived from your IP address, interactions Google Analytics measures automatically (such as scrolling and clicks on links to other sites) and these steps: creating an account, starting a checkout, starting a trial and buying a plan (with the plan and its price). We never send your email address, name, account or subscription numbers to Google Analytics. Google signals and ad personalisation are off, and advertising storage stays denied: we run no ads.

Google as processor. Google processes this data for us as a processor under its Google Ads Data Processing Terms. Google says Google Analytics 4 does not log or store IP addresses. You can read more in How Google uses information from sites that use its services.

8.2 Cookies and storage we use

The app also keeps a few settings in your browser's local and session storage, such as the assistant conversation you have open and notices you have closed. These stay on your device. We use no advertising cookies.

9. Children's Data

The Service is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

10. Security

• Credentials for connected accounts are encrypted at rest
• Connected AI apps sign in with OAuth 2.1 and PKCE, and their tokens and API keys are stored only as hashes
• All data in transit is encrypted with HTTPS (TLS)
• Every request is checked against your account, and each of your websites is kept separate from the others
• OAuth connections are protected against cross-site request forgery
• Pages we fetch on your behalf are limited to public internet addresses

No method of storing or sending data is completely secure, so we cannot guarantee absolute security. If a breach affects your personal data, we will tell you and the authorities as the law requires.

11. Changes to This Policy

We may update this policy. We will email you about material changes at least 15 days before they take effect. The "Last updated" date at the top shows when it last changed.

12. Contact Us

Questions about this policy or your data: support@blogamplify.com. See also our Terms and Conditions.