Privacy Policy

This policy explains what personal information BlinkSpot collects, why, who helps us process it, and the choices and rights you have. BlinkSpot is run by Mubia Investment Limited ("we", "us"), a company registered in Kenya, at P.O. Box 621 - G.P.O, Nairobi 00100, Kenya. We are the data controller for the information described here. For anything in this policy, email info@blinkspot.io.

It covers blinkspot.io, the BlinkSpot app, websites you publish with it, and BlinkSpot's connections for AI apps (like Claude). When an agency or business uses BlinkSpot for its own clients, it decides what goes in; for that content we act on its behalf.

1. What we collect

• Your account. Your name, email address and password (stored only as a secure hash), or, if you use Sign in with Google, the name, email address and profile picture Google shares. When you signed up and which version of our terms you agreed to.
• Your brands and content. What you add or make: brand details, logos, product photos, videos, voice recordings, prompts, captions, messages to Ask BlinkSpot, and the pictures, videos, carousels, motion graphics and websites you create. Contact details you put on a brand or website (like a WhatsApp number) are part of this.
• Connected social accounts. When you connect Instagram, TikTok, Facebook, LinkedIn, X, YouTube or another network, we receive the account's name and picture, keep what's needed to post for you, and the posts you schedule with their results.
• Payments. Paystack collects your card, bank or mobile money details on its own page. We never see or store your full card number. We receive a payment reference, the plan or credit pack, the amount, currency, date and whether it went through.
• Usage of credits and AI. Which AI features you used, what each cost in credits, and when.
• AI app connections. When you connect Claude or another AI app, or make an API key: its name, the brands and permissions you allowed, its monthly budget, and a log of what it did.
• Device and log data. Your IP address, browser and device type, the pages you request, and errors. Our hosting providers record this to keep BlinkSpot running and secure.
• Analytics. With your consent where the law requires it (the EU, EEA, UK and Switzerland), PostHog records which pages and features are used, and session replays with every typed field hidden. Elsewhere it's on by default and you can turn it off in Cookie settings.
• Messages to us. What you send when you email us or ask for support.

You need an email address to have an account. Everything else is up to you, though some features need it (posting needs a connected account; buying a plan needs a payment). We don't ask for sensitive information (like health, religion or political views), and we don't buy data about you from others.

2. Why we use it, and our legal bases

We don't sell your personal information, and we don't use it for targeted advertising.

3. AI and your content

• To make what you ask for, we send the prompt and the material it needs (like your brand details, product photos or footage) to the AI provider for that feature (listed below). We send only what the task needs.
• We don't use your content to train AI models, and we don't let it be used for advertising. Anthropic and OpenAI state that they don't train their models on data sent through their business APIs by default; each provider processes data under its own terms.
• AI can be wrong. Review what it makes before you post it.
• We don't make decisions about you by automated means that have legal or similarly significant effects. Automated checks (like rate limits or blocking abuse) only limit use of the service.
• If your content shows other people, you need their permission to use it.

4. Who we share it with

Service providers that process data for us, under contract, only to run BlinkSpot:

We also share information:

• Where you send it: the social networks you publish to, the AI apps you connect (they get only what you allowed), and the people you share a brand with.
• When the law requires it, or to protect people, our users or BlinkSpot from harm or fraud.
• If our business is sold or merged, with the buyer, who must keep protecting it under this policy.

Google Fonts on BlinkSpot and on websites you publish are fetched by our own server, so your browser doesn't contact Google for them.

5. International transfers

We are based in Kenya and our providers process data in the United States and other countries. Where the law requires it, transfers are protected by safeguards such as the European Commission's Standard Contractual Clauses (and the UK addendum) in our providers' data processing terms, or the provider's certification under the EU-US Data Privacy Framework, and as the Kenya Data Protection Act requires.

6. How long we keep it

• Account and content: while your account is open. When you delete something, it leaves the app straight away; stored copies are removed when you close your account. When you close your account, we delete your account and content within 30 days; backups roll off within 90 days.
• Payment and billing records: as long as tax and accounting law requires (up to 7 years).
• Logs and security records: for short periods, unless needed to investigate abuse.
• Analytics: only as long as we need it to understand how BlinkSpot is used. We delete yours when you ask.
• Your cookie choice: 12 months, then we ask again.

7. Your rights and choices

Depending on where you live (including under the GDPR, UK GDPR, the Kenya Data Protection Act 2019 and US state laws), you can:

• get a copy of your personal information, and have it in a portable format;
• correct it, or have it deleted;
• object to, or ask us to restrict, how we use it;
• withdraw consent any time (for analytics, use Cookie settings), without affecting what happened before;
• not be treated differently for using these rights.

Much of this you can do in the app: edit your profile and brands, delete content from your Library, disconnect social accounts, revoke AI connections in Settings > AI connections, cancel your plan in Billing, and delete your account and everything in it in Settings > Delete my account. For anything else, email info@blinkspot.io from your account's email address. We reply within one month.

You can also complain to a data protection authority: in Kenya, the Office of the Data Protection Commissioner (odpc.go.ke); in the EU or EEA, the authority where you live or work; in the UK, the ICO (ico.org.uk). We'd like the chance to fix it first, so please write to us.

US residents: we don't sell personal information or share it for cross-context behavioural advertising. You can ask to know, correct or delete what we hold, and an authorised agent can ask for you.

8. Cookies

We use essential cookies to keep you signed in and secure, and analytics cookies only as described above. No advertising cookies. Details in our Cookie Policy; change your choice in Cookie settings.

9. Google user data

With Sign in with Google, we receive only your name, email address and profile picture, and use them only to create and sign you in to your account. Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

10. Children

BlinkSpot is for people 18 and over. We don't knowingly collect information from children. If you think a child has given us information, email us and we'll delete it.

11. Security

We use encryption in transit, access controls that keep each account's data to itself, and providers with strong security programmes; payment details stay with Paystack. No system is perfectly secure. If a breach puts your information at risk, we'll tell you and the authorities as the law requires.

12. Changes

We'll update the date at the top when this policy changes. For important changes we'll tell you by email or in the app before they apply.