Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) is:

BlenCode GmbH
Boschstraße 10
73734 Esslingen am Neckar
Germany

Email: info@blencode.com
Phone: +49 155 60021144 Website: https://blensite.com

2. What Data We Collect and Why

2.1 When Visiting Our Website (Server Log Data)

When you access our website, the following data is automatically collected by the web server:

IP address (anonymized)
Date and time of access
Name and URL of the requested file
Referrer URL (previously visited website)
Browser type and version, operating system

Purpose: Operation and security of the website, troubleshooting. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and functional website). Retention period: 14 days, then automatically deleted.

2.2 Registration and User Account

When you create a BlenSite account, we process:

Email address
Password (stored encrypted)

Purpose: Provision and management of your user account, access to the platform. Legal basis: Art. 6(1)(b) GDPR (performance of contract). Retention period: Until deletion of your account, then in accordance with statutory retention obligations.

2.3 Website Creation and AI Processing

When creating your website through our AI-powered service, we process:

Company name, industry, description, and other business information
Texts and content you provide
Generated website content

Purpose: AI-powered creation and delivery of your website. Legal basis: Art. 6(1)(b) GDPR (performance of contract). Retention period: As long as your account and website are active.

2.4 Contact Form

When you contact us through the contact form, we process:

Name (if provided)
Email address
Content of your message

Purpose: Processing your inquiry. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest). Retention period: Until full processing, then in accordance with statutory retention obligations.

2.5 Payment Processing

For paid subscriptions, we process payment data through our payment service provider Stripe. BlenCode itself does not store credit card numbers or bank details.

Purpose: Payment processing for subscriptions. Legal basis: Art. 6(1)(b) GDPR (performance of contract).

2.6 Cookies and Consent Management

Our website uses technically necessary cookies. For optional cookies (analytics, marketing), we obtain your explicit consent pursuant to §25(1) TTDSG and Art. 6(1)(a) GDPR via our consent management tool (CCM19).

Legal basis for necessary cookies: §25(2) TTDSG. Legal basis for optional cookies: §25(1) TTDSG in conjunction with Art. 6(1)(a) GDPR.

3. Processors and Service Providers

We use the following carefully selected service providers with whom we have concluded data processing agreements (DPA) pursuant to Art. 28 GDPR:

Hosting and Infrastructure: Amazon Web Services EMEA SARL (Luxembourg) — Server location: EU (Frankfurt, Paris, Ireland)
Authentication: Amazon Cognito — Server location: EU (eu-central-1)
Database: Amazon DynamoDB — Server location: EU (eu-central-1)
Payment Processing: Stripe Payments Europe, Ltd. (Ireland)
Consent Management: CCM19 — self-hosted at consent.blencode.com
AI Processing: Amazon Bedrock (Claude models by Anthropic) — EU region (eu-central-1/eu-west-1/eu-west-3) — data remains exclusively within the EU/EEA

4. Data Transfers to Third Countries

We strive to process all personal data within the European Economic Area (EEA).

Amazon Web Services: We exclusively use EU regions for AWS services. AWS EMEA SARL (Luxembourg) is our contractual partner.

Stripe: Stripe Payments Europe, Ltd. is based in Ireland. Insofar as data is transferred to Stripe, Inc. (USA), this is based on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and the EU-U.S. Data Privacy Framework.

5. AI Processing and Amazon Bedrock

For AI-powered website creation, we use Amazon Bedrock with Claude models by Anthropic.

Processing region: EU region (eu-central-1/eu-west-1/eu-west-3) — data remains exclusively within the EU/EEA
No model training: Your data is not used to train AI models
Data minimization: Only business information necessary for website creation is transmitted
No access by Anthropic: When used through Amazon Bedrock, Anthropic has no access to your data

Legal basis: Art. 6(1)(b) GDPR (performance of contract — AI processing is a core component of our service).

6. Retention Periods

Data type	Retention period
Server log data	14 days
User account	Until account deletion
Website data	Until deletion of website or account
Contact inquiries	Until processing, up to 10 years (German Commercial Code)
Payment data (at Stripe)	Per statutory retention obligations
Cookie consents	Until withdrawal, maximum 12 months
Contractual data	Per statutory retention periods (6 or 10 years)

7. Your Rights

You have the following rights regarding your personal data:

Access (Art. 15 GDPR): Information about the data we process about you
Rectification (Art. 16 GDPR): Correction of inaccurate or incomplete data
Erasure (Art. 17 GDPR): Deletion of your data under certain conditions
Restriction (Art. 18 GDPR): Restriction of processing
Data portability (Art. 20 GDPR): Receive your data in a machine-readable format
Objection (Art. 21 GDPR): Object to processing based on legitimate interests
Withdrawal of consent (Art. 7(3) GDPR): At any time with effect for the future

To exercise your rights, please contact: info@blencode.com

8. Right to Lodge a Complaint

You have the right to lodge a complaint with the competent data protection supervisory authority (Art. 77 GDPR):

State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI BW) https://www.baden-wuerttemberg.datenschutz.de

9. Children's Data

Our website and service are directed at businesses and not at persons under 16 years of age. We do not knowingly collect personal data from children.

10. Changes to This Privacy Policy

We reserve the right to update this privacy policy as needed to reflect changes in legal requirements or our data processing practices. The current version is always available on our website.

Last updated: April 2026