GDPR Compliance

We process your personal data based on the following legal grounds:

• Contract Performance: To provide our services as agreed
• Legitimate Interest: To improve our services and prevent fraud
• Consent: For marketing communications and optional features
• Legal Obligation: To comply with applicable laws and regulations

Under GDPR, you have the following rights:

Right to Access

You can request a copy of all personal data we hold about you.

Right to Rectification

You can request that we correct inaccurate or incomplete data.

Right to Erasure (Right to be Forgotten)

You can request deletion of your personal data, subject to legal retention requirements.

Right to Restrict Processing

You can request that we limit how we use your data.

Right to Data Portability

You can receive your data in a structured, machine-readable format.

Right to Object

You can object to processing based on legitimate interests or direct marketing.

Right to Withdraw Consent

You can withdraw consent at any time where we rely on consent for processing.

Right to Lodge a Complaint

You can file a complaint with your local data protection authority.

To exercise any of your GDPR rights:

1. Send an email to privacy@blogflux.ai
2. Include your name, email address, and specific request
3. We will verify your identity for security purposes
4. We will respond within 30 days (may be extended to 60 days for complex requests)

You can also manage many preferences directly in your account settings.

Where We Store Data

Your data is primarily stored in the United States (Digital Ocean, NYC1 datacenter). We use Standard Contractual Clauses (SCCs) approved by the European Commission to protect data transferred outside the EEA.

Data Processors

We use the following third-party processors:

• OpenAI and Anthropic (AI models) - USA
• Stripe (payments) - USA, EU-compliant
• SendGrid (email) - USA
• Digital Ocean (hosting) - USA
• Cloudflare (CDN/security) - Global network
• Honeybadger (error tracking) - USA
• Cloud66 (deployment) - Global

All processors are bound by data processing agreements that comply with GDPR.

We retain personal data only as long as necessary:

• Account Data: Until you close your account, then deleted within 30 days
• Billing Records: 7 years (legal requirement)
• Support Communications: 3 years
• Analytics Data: 2 years, then anonymized
• Marketing Consent: Until withdrawn, then deleted within 30 days

We implement appropriate technical and organizational measures:

• Encryption of data in transit (TLS 1.3) and at rest (AES-256)
• Regular security audits and penetration testing
• Access controls and two-factor authentication
• Employee training on data protection
• Incident response and breach notification procedures
• Regular backups and disaster recovery planning