Privacy Policy

• Account information — your email (and name if provided), used to sign you in and manage your account. Authentication is handled by Supabase / Google sign-in.
• Your content — the prompts you enter and the websites Blyx generates, so we can build, save, host, and let you edit them.
• Payment information — handled entirely by Stripe . We never see or store your full card number, only limited billing metadata (e.g. plan, last-4, status).
• Usage & device data — logs, approximate location from IP, browser/device type, and in-app activity used to operate, secure, and improve the Service and to prevent abuse.
• Support communications — messages you send us.
• Visitor data for sites you publish — cookieless, aggregated traffic data (page views, approximate country, device, referrer) collected on your behalf so you can see your analytics.

To provide, operate, secure, and improve Blyx; to generate your sites; to process payments and manage subscriptions; to prevent fraud and abuse and enforce our Terms; to respond to support; and to send important service messages. We do not sell your personal information, and we do not use your private content to train third-party models beyond what is needed to generate your output.

Where the GDPR/UK GDPR applies, we process personal data on these bases: performance of a contract (to provide the Service), legitimate interests (to secure and improve the Service and prevent abuse), consent (where required, e.g. certain communications), and legal obligation (to comply with the law).

We share data only with trusted providers that process it on our behalf under their own terms, including Supabase (database & auth), Stripe (payments), Anthropic (AI generation), Vercel (hosting), and email/analytics providers. We share only what each needs to function. We may also share data in a merger, acquisition, or asset sale, in which case we will notify you.

We built Blyx to collect as little personal data as possible, so there is very little to hand over in the first place. We do not sell, rent, or voluntarily share your personal information with governments or anyone else.

We disclose your data only when we are legally compelled to by valid legal process — a court order, warrant, or subpoena that we believe is lawful and properly scoped — and even then only the specific information we are legally required to provide. We make a single narrow exception to prevent an imminent risk of death or serious physical harm (for example, terrorism or a child in danger). Where the law permits, we notify affected users, and we push back on requests that are overbroad, invalid, or improperly founded. We will not weaken these protections voluntarily.

We use a small number of strictly-necessary cookies / local storage to keep you signed in and remember preferences. Traffic analytics for the sites you publish are cookieless.

We keep your data while your account is active and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. When you delete your account, we delete or de-identify your projects and personal data within a reasonable period, except where retention is legally required.

Depending on where you live (including under GDPR/UK GDPR and the CCPA/CPRA), you may have the right to access, correct, delete, port, or restrict your personal information, to object to certain processing, and to opt out of sale/sharing (we do not sell). California residents have the right not to receive discriminatory treatment for exercising these rights.

To exercise any right, email legal@blyx.dev — we will verify and respond within the timeframe the law requires. You may also complain to your local data-protection authority.

We and our providers may process data in the United States and other countries whose laws may differ from yours. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for cross-border transfers.

For the websites you build and publish, you are the data controller of your visitors' information and any leads collected through your forms; Blyx acts as a processor on your behalf. You are responsible for having an appropriate privacy notice and lawful basis for your own visitors (Blyx auto-includes a basic notice on every build, but you must ensure it fits your use).

We use industry-standard measures (encryption in transit , access controls, trusted infrastructure) to protect your data. No system is perfectly secure, so we cannot guarantee absolute security. If a breach affects you, we will notify you as required by law. Report vulnerabilities to support@blyx.dev.

Blyx welcomes young founders. Anyone under 18 should use Blyx with a parent or guardian's involvement and consent, and that parent/guardian is responsible for the account and billing. For children under 13, a parent or guardian must operate and supervise the account and provides consent to this policy on the child's behalf; we do not knowingly collect personal data directly from a child under 13 without that consent. If you believe a child has given us data without the required parental consent, contact legal@blyx.dev and we will delete it.

We may update this policy; the "last updated" date reflects the latest version, and material changes may be signaled in-app or by email. Privacy questions or requests: legal@blyx.dev.