Privacy Policy
This policy explains what personal data Blueprint collects and why. The data controller is Office Commun, 27 rue des Frênes, 49740 La Romagne, France. For any question or request, write to hello@blueprint.page.
What we collect
- Account: your email address, your name if you sign in with Google, and your password (stored hashed by our authentication provider, never in clear text).
- Your work: projects, tools and their versions, your conversation with the assistant (prompts and replies), and small thumbnails of the reference images you attach. If you connect your own coding agent (Claude Code, Codex, Cursor or the Claude app) to Blueprint, each request it sends is kept with the tool’s history: your request as the agent relays it, the agent’s note, which agent sent it, and the result (the version saved or the problems found).
- Files you add: images you upload to your tools, screenshots attached to a support request or to feedback.
- Support and feedback: the messages you send us, and the email replies we send you.
- Usage and billing: each generation (model, size in tokens, cost) and the history of your credits. Payments are handled by Stripe: we never see or store your card number.
- Audience measurement: the pages visited, the referring site, the browser and device type, an approximate location (country and city, derived from the IP address, which is not stored) and page load times. Visitors are counted with an anonymous hash that changes every day. This uses no cookie and stores nothing on your device, is not linked to your account, and is turned off if your browser sends Do Not Track or Global Privacy Control.
- Security: at sign-up, a salted hash of your IP address to limit abuse, deleted after two days, and a hash of your email address (never the address itself) so free credits are given only once per person, kept after the account is closed. Our hosts keep short-lived technical logs.
Why we use it
- To provide the service you signed up for: your account, your tools, generation and credits (performance of the contract).
- To protect the service against fraud and abuse (our legitimate interest).
- To understand how the website is used, with audience statistics that identify no one (our legitimate interest).
- To keep billing records when you buy a plan or credits (legal obligation).
- To email you when your credits are running low, with the plans or credit packs that fit your account: one email when your balance drops, never more than once a week (our legitimate interest). You can turn these reminders off in your settings or with the link in the email.
We do not sell your data, we do not show ads and we do not use your content to train AI models.
Who processes it
- Anthropic (United States) generates your tools: your prompts, the reference images you attach and the code of the current tool are sent to its API for each request. Under Anthropic’s commercial terms, API data is not used to train its models.
- Supabase hosts our database and handles sign-in, in the European Union (Paris region).
- Vercel (United States) hosts the website and runs our servers.
- Cloudflare stores the files you upload in the European Union (R2), runs our audience measurement, and, when the security check is enabled on sign-up and sign-in, analyses technical signals to tell people from bots (Turnstile).
- Stripe (United States and Ireland) processes payments and subscriptions, and keeps the related billing records.
- Resend (United States) sends our emails: sign-in links, invitations, support replies, billing notices and low-credit reminders.
- Google, only if you choose to sign in with Google.
When data is transferred outside the European Union, it is protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.
Signing in with Google
If you choose to sign in with Google, Google shares with us your name, your email address and your profile picture (the “openid”, “email” and “profile” permissions). We use them only to create your Blueprint account, sign you in and show your name in the app. We do not ask for access to any other Google data, such as your Gmail, Drive or contacts, and we never sell or share this information.
Blueprint’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove Blueprint’s access at any time from your Google Account settings.
How long we keep it
- Account, work, uploaded files, support requests and feedback: as long as your account exists. Deleted when you close it from your settings, or within 30 days after you ask us.
- Billing records: as long as required by French accounting law (up to 10 years). Stripe keeps them on its side too.
- Sign-up IP hashes: 2 days.
- Email hashes used to give free credits once: kept after the account is closed, to prevent abuse.
Cookies
Blueprint only uses cookies that are strictly necessary: to keep you signed in, and to remember that you unlocked a password-protected tool. Our audience measurement uses no cookie. No advertising or tracking cookies, so there is no cookie banner.
Your rights
Under the GDPR, you can access, correct, delete or export your data, object to or restrict its processing, and give instructions about it after your death. Write to hello@blueprint.page; we answer within one month. You can also file a complaint with the CNIL (cnil.fr), the French data protection authority.
Children
Blueprint is not intended for children under 15.
Changes
If we change this policy in a way that matters, we will let you know before the change applies.