Skip to main content
BlenSiteBlenSite

Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) is:

BlenCode GmbH
Boschstraße 10
73734 Esslingen am Neckar
Germany

Email: info@blencode.com
Phone: +49 155 60021144 Website: https://blensite.com

2. What Data We Collect and Why

2.1 When Visiting Our Website (Server Log Data)

When you access our website, the following data is automatically collected by the web server and the delivering content delivery network (CDN):

  • IP address
  • Date and time of access
  • Name and URL of the requested file
  • Referrer URL (previously visited website)
  • Browser type and version, operating system

Purpose: Operation, delivery, and security of the website, troubleshooting. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and functional website). Retention period: Server and CDN access logs are stored only for a short period, as a rule up to 30 days, and then automatically deleted.

2.2 Registration and User Account

When you create a BlenSite account, we process:

  • Email address
  • Password (stored encrypted)

Purpose: Provision and management of your user account, access to the platform. Legal basis: Art. 6(1)(b) GDPR (performance of contract). Retention period: Until deletion of your account, then in accordance with statutory retention obligations.

Sign in with Google (single sign-on): If you use the "Sign in with Google" option, the sign-in is routed through our identity service Amazon Cognito to Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The data released by your Google account (in particular your email address and Google user ID) is transmitted to us to create or match your BlenSite account. Google processes the sign-in as an independent controller; this may involve a transfer to Google LLC (USA) (see section 4). Using this option is voluntary; alternatively, you can sign in with email address and password. Legal basis: Art. 6(1)(a) GDPR (consent through actively choosing Google sign-in) and Art. 6(1)(b) GDPR (performance of contract).

2.3 Website Creation and AI Processing

When creating your website through our AI-powered service, we process:

  • Company name, industry, description, and other business information
  • Texts and content you provide
  • Generated website content

Purpose: AI-powered creation and delivery of your website. Legal basis: Art. 6(1)(b) GDPR (performance of contract). Retention period: As long as your account and website are active.

2.4 Contact Form

When you contact us through the contact form, we process:

  • Name (if provided)
  • Email address
  • Content of your message

Purpose: Processing your inquiry. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest). Retention period: Until full processing, then in accordance with statutory retention obligations.

2.5 Payment Processing

For paid subscriptions, we process payment data through our payment service provider Stripe. BlenCode itself does not store credit card numbers or bank details.

Purpose: Payment processing for subscriptions. Legal basis: Art. 6(1)(b) GDPR (performance of contract).

2.6 Cookies and Consent Management

Our website uses technically necessary cookies. For optional cookies (analytics, marketing), we obtain your explicit consent pursuant to § 25(1) TDDDG and Art. 6(1)(a) GDPR via our consent management tool (CCM19).

Legal basis for necessary cookies: § 25(2) TDDDG. Legal basis for optional cookies: § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.

Details of the cookies used, their purposes, and their lifetimes can be found in our Cookie Policy.

2.7 Web Analytics with Google Analytics 4

On our platform we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses cookies and similar technologies to analyze how the platform is used (e.g. pages viewed, time spent, approximate origin based on the truncated IP address, device used). This information helps us improve the platform.

Strictly consent-based loading: Google Analytics is loaded exclusively after you have consented to the statistics/analytics category via our consent banner (CCM19). Before your consent, no script is loaded from Google and no connection to Google is established.

  • Data processed: truncated IP address (IP anonymization enabled), device/browser data, usage events, pseudonymous identifiers from cookies.
  • Cookies used: among others _ga (lifetime up to 2 years), _ga_<container ID> (up to 2 years), and possibly _gid (up to 24 hours).
  • Purpose: statistical reach and usage analysis to improve the platform.
  • Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG (consent).
  • Retention period: see the cookie lifetimes above; usage and event data held at Google level are deleted in accordance with the retention periods configured in Google Analytics (by default up to 14 months).
  • Third-country transfer: using Google Analytics may involve a transfer of data to Google LLC in the USA (see section 4).
  • Withdrawal: you can withdraw your consent at any time with effect for the future via the consent icon; no new analytics data is collected thereafter.

3. Processors and Service Providers

We use the following carefully selected service providers. With processors within the meaning of Art. 28 GDPR we have concluded corresponding data processing agreements (DPA). Google (web analytics and Google sign-in) acts as an independent or joint controller in this respect.

  • Hosting and Infrastructure: Amazon Web Services EMEA SARL (Luxembourg) — Server location: EU (Frankfurt, Paris, Ireland)
  • Content Delivery Network (CDN): Amazon CloudFront (Amazon Web Services EMEA SARL, Luxembourg) — worldwide delivery via edge locations; access data (including IP address) may be processed at edge locations outside the EEA (see section 4)
  • Authentication: Amazon Cognito — Server location: EU (eu-central-1)
  • Database: Amazon DynamoDB — Server location: EU (eu-central-1)
  • Payment Processing: Stripe Payments Europe, Ltd. (Ireland)
  • Consent Management: CCM19 — self-hosted at consent.blencode.com
  • AI text processing: Amazon Bedrock (Claude models by Anthropic) — EU region (eu-central-1/eu-west-1/eu-west-3) — data remains exclusively within the EU/EEA
  • AI image generation: Black Forest Labs GmbH (Freiburg, Germany) — generation of image material for your website via EU endpoints (see section 5)
  • AI video generation (Premium frame sequences only): fal.ai (Features & Labels, Inc., San Francisco, USA) — interpolation of short animated image sequences (see section 4)
  • Stock images and video: Pexels (a brand of Canva Germany GmbH, Berlin) — retrieval of royalty-free stock images and background videos
  • Web analytics: Google Ireland Limited (Google Analytics 4) — only after consent (see section 2.7)
  • Sign in with Google: Google Ireland Limited — only when you actively use Google sign-in (see section 2.2)

Without your consent, no data is shared with third parties for advertising purposes.

4. Data Transfers to Third Countries

We process personal data primarily within the European Economic Area (EEA). In the following cases, a transfer to third countries — in particular the USA — may occur:

Amazon Web Services / Amazon CloudFront: For data processing (hosting, database, authentication, AI text processing) we exclusively use EU regions; our contractual partner is AWS EMEA SARL (Luxembourg). Delivery via the CDN Amazon CloudFront takes place through globally distributed edge locations, so access data (including IP address) may be processed outside the EEA. Amazon's parent company Amazon.com, Inc. (USA) is certified under the EU-U.S. Data Privacy Framework (DPF); additionally, EU Standard Contractual Clauses apply (Art. 46(2)(c) GDPR).

Stripe: Stripe Payments Europe, Ltd. is based in Ireland. Insofar as data is transferred to Stripe, Inc. (USA), this is based on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and the EU-U.S. Data Privacy Framework.

Google (Google Analytics 4, sign in with Google): Our contractual partner in the EEA is Google Ireland Limited. Processing may involve a transfer to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google LLC is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the EU Commission, Art. 45 GDPR); additionally, EU Standard Contractual Clauses apply (Art. 46(2)(c) GDPR). This transfer only takes place after your consent (Google Analytics) or when you actively use Google sign-in.

fal.ai (Features & Labels, Inc., USA): In the Premium tier only, we use fal.ai to interpolate short animated image sequences. For this we transmit text prompts derived from your business information plus two AI keyframe images to fal.ai in the USA. The transfer is based on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). No personal data of third parties is transmitted. The AI image generation itself is performed by Black Forest Labs (EU) and does not leave the EEA.

5. AI Processing

5.1 Text Generation (Amazon Bedrock)

For AI-powered creation of website texts, we use Amazon Bedrock with Claude models by Anthropic.

  • Processing region: EU region (eu-central-1/eu-west-1/eu-west-3) — data remains exclusively within the EU/EEA
  • No model training: Your data is not used to train AI models
  • Data minimization: Only business information necessary for website creation is transmitted
  • No access by Anthropic: When used through Amazon Bedrock, Anthropic has no access to your data

5.2 Image and Video Generation

For the generation of image material we use Black Forest Labs (Black Forest Labs GmbH, Freiburg, Germany; FLUX models) via their EU endpoints — processing stays within the EU. Short background videos in the page hero are not AI-generated but sourced as royalty-free stock material from Pexels. In the Premium tier only, short animated image sequences are additionally interpolated using fal.ai (Features & Labels, Inc., USA) from two AI keyframes; regarding the third-country transfer, see section 4. In each case only text prompts derived from your business information (e.g. industry, desired motif) are transmitted, not personal data of your customers. The use of AI-generated content is made transparent in accordance with Art. 50 of the AI Act: AI-generated images — and every frame of the AI-generated animated sequences — carry a machine-readable provenance marker (IPTC "trainedAlgorithmicMedia"), and generated pages include a generator meta tag in the page head ("BlenSite (AI-assisted)"). The stock background videos are not AI-generated and therefore carry no such marker. Where you interact directly with our AI assistant, you are informed of this in the interface itself (Art. 50(1) of the AI Act).

Legal basis: Art. 6(1)(b) GDPR (performance of contract — AI processing is a core component of our service).

6. Retention Periods

Data type Retention period
Server log data 30 days
User account Until account deletion
Website data Until deletion of website or account
Contact inquiries Until processing, up to 10 years (German Commercial Code)
Payment data (at Stripe) Per statutory retention obligations
Cookie consents Until withdrawal, maximum 12 months
Contractual data Per statutory retention periods (6 or 10 years)

7. Your Rights

You have the following rights regarding your personal data:

  • Access (Art. 15 GDPR): Information about the data we process about you
  • Rectification (Art. 16 GDPR): Correction of inaccurate or incomplete data
  • Erasure (Art. 17 GDPR): Deletion of your data under certain conditions
  • Restriction (Art. 18 GDPR): Restriction of processing
  • Data portability (Art. 20 GDPR): Receive your data in a machine-readable format
  • Objection (Art. 21 GDPR): Object to processing based on legitimate interests
  • Withdrawal of consent (Art. 7(3) GDPR): At any time with effect for the future

To exercise your rights, please contact: info@blencode.com

8. Right to Lodge a Complaint

You have the right to lodge a complaint with the competent data protection supervisory authority (Art. 77 GDPR):

State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI BW) https://www.baden-wuerttemberg.datenschutz.de

9. Children's Data

Our website and service are directed at businesses and not at persons under 16 years of age. We do not knowingly collect personal data from children.

10. Changes to This Privacy Policy

We reserve the right to update this privacy policy as needed to reflect changes in legal requirements or our data processing practices. The current version is always available on our website.

Last updated: August 2026