Privacy Policy

This policy explains which of your personal data is processed, for what purpose and for how long, when you use the blink artifacts service (the “Service”). For users in Turkey, the disclosure under the Turkish Personal Data Protection Law No. 6698 (KVKK) is set out separately in the KVKK Disclosure Notice.

1. Data controller

Data controller

BlinkBros Technology Ltd. (a company registered in the Dubai International Financial Centre (DIFC)) · DIFC Commercial Licence No: CL11924 (DIFCA registration no. 11924)

Address

Innovation Hub, IH-00-01-01-OF-01, Floor 1, Dubai International Financial Centre, Dubai, United Arab Emirates

Contact

Email: support@blinkbrosai.com · Phone: +971 50 164 2662

Data controller’s representative in Turkey

Information on the data controller’s representative is to be added to this text once the appointment is completed.

VERBİS registration (the Turkish Data Controllers’ Registry)

VERBİS registration details are to be added to this text once the registration is completed.

2. Data we process

• Account information: your email address and, if you choose to provide it, your display name. If you opened your account by arriving from the “made with” badge, the shared artifact you came from is stored as a code from which the artifact’s identity cannot be recovered.
• Sign-in and session information: one-time sign-in codes (only in hashed form, valid for 10 minutes), the session cookie and your API tokens (only their hash is stored).
• Subscription information: your Stripe customer ID, your subscription status, the time of the approvals you gave before subscribing and the version of the text you approved. Your card details do not reach us; Stripe receives the payment directly.
• Content: the Artifacts you publish, files you upload, comments, questions you ask the Agent, and their versions.
• Sharing information: the email addresses of the people you invite, the roles you assign, link settings and, if any, a hash of the link password.
• View information: when you view an Artifact while signed in, your name, your last view time and your view count.
• Abuse reports: the reason for the report and a hash of the reporter’s IP address.
• Technical data: connection data such as IP address, request time and browser information. These are used for rate limiting, bot protection and infrastructure logs.

We do not ask for special categories of personal data (such as health, belief or biometric data). If you place such data in your Artifacts yourself, be careful about whom you share them with.

3. Why we process data

• To open your account, enable you to sign in and provide the Service,
• to publish and share Artifacts and to deliver collaborative editing, comments and questions to the Agent,
• to start, run and end your subscription,
• to send transactional emails such as sign-in codes, invitations, question notifications, account deletion codes, the subscription agreement and notices of material changes,
• to protect the Service against abuse, bot traffic and excessive load,
• to review abuse reports and retain them as evidence against legal claims,
• to comply with our legal obligations.

We do not use your data for advertising, profiling or sale. The legal basis under KVKK for each purpose is shown separately in the KVKK Disclosure Notice.

4. AI Agents and your content

No AI model runs on the Service’s servers. When you ask the Agent a question in an Artifact, the question is forwarded to the Artifact Owner’s own Agent, and that Agent gives the response. The Agent works with the third-party AI provider chosen by the Owner and may send your question and the Artifact content to that provider. This processing is outside the Service; the provider’s own terms and privacy policy apply, and it is the Artifact Owner’s responsibility.

The same rule applies when you connect your own Agent: the provider you choose determines where your Agent sends the content it reads from the Service.

5. Who sees what in shared Artifacts

• Everyone with access to an Artifact can, depending on their role, see the content, the comments and the names of those who wrote comments.
• Your display name is used as your name; if you have not provided one, the username part of your email address (for example “first.last”) is shown. This name also appears in the email sent to a person you invite to an Artifact.
• The Artifact Owner sees the name, last view time and view count of signed-in viewers. People who view without signing in do not appear in this list.
• People who are not signed in can only view Artifacts.

6. Service providers and transfers abroad

The data controller is established in the United Arab Emirates; therefore, when you use the Service from Turkey, your data is processed abroad. To provide the Service we work with the following providers:

• Cloudflare: hosting (Workers, D1 database, R2 file storage, Durable Objects), Turnstile bot protection and infrastructure logs.
• Stripe: payment and subscription management.
• Resend: sending transactional emails (sign-in code, invitation, question notification, account deletion code, subscription agreement, notices of material changes and the abuse report notification sent to the administrator).

These providers’ infrastructure is outside Turkey, principally in the United States and the European Union. Under KVKK art. 9, such transfers require a standard contract to be signed and notified to the Turkish Personal Data Protection Authority; information on the basis of the transfer is to be added to this text once that process is completed. Transfers made outside the DIFC are subject to the conditions in articles 26 and 27 of the DIFC Data Protection Law; the basis of these transfers will also be added to this text.

Apart from these, we share data only at the request of competent authorities when legally required.

7. Enterprise integrations

An organization may connect the Service to its own product, create Artifacts on behalf of its own users and display them within its own product. For these users’ data, the data controller is in most cases the relevant organization; we may act as a processor handling this data on the organization’s behalf and on its instructions. If you use the Service through such an integration, direct your requests about your data first to that organization. The exact roles of the parties are determined in the contract with the organization.

8. Retention periods

• Sign-in codes: valid for 10 minutes.
• Session: the session cookie is valid for 30 days; it is closed when you sign out or delete your account.
• Account and content: retained as long as your account is open. When you delete an Artifact, it is permanently deleted from the database, file storage and live document storage after 30 days.
• Account deletion: you can delete your account from the profile screen by confirming with the code sent to your email. At the moment of deletion your sessions and API tokens are closed and your subscription is cancelled. Your account and Artifacts are permanently deleted after 30 days.
• Backups: point-in-time recovery backups of the database are kept for up to 30 days. Permanently deleted records may remain in backups until this period expires.
• Abuse reports: retained as evidence; not deleted even if the Artifact concerned is deleted.
• Infrastructure logs: kept for up to 30 days.

Comments you write on other people’s Artifacts and content you add are part of that Artifact. Even if you delete your account, this content remains in that Artifact. Once your account is permanently deleted (after 30 days), your name no longer appears next to your comments; your name as written by others in the text may remain. Payment records are subject to Stripe’s own statutory retention obligations.

9. Security

We store sign-in codes and API tokens only in hashed form. To prevent code in an Artifact from reaching your session in the application, we serve user content from a domain separate from the application. Rate limits are applied per IP address and per account; the sign-in screen is protected by Cloudflare Turnstile. Connections are established over HTTPS.

If a data breach occurs, we will notify you and the relevant supervisory authority within the legal time limits.

10. Email communications

We send only the transactional emails necessary for the operation of the Service: sign-in codes, Artifact invitations, notifications about your question, account deletion codes, the Pre-Contractual Information Form and Distance Sales Agreement when you start a paid subscription, and notifications of material changes to the terms or this policy. These messages are not sent for commercial purposes. We do not send newsletters, campaigns or other marketing emails; if we want to send them in future, we will first obtain your consent under art. 6 of Law No. 6563 on the Regulation of Electronic Commerce.

11. Cookies and local storage

We use only the cookies necessary for the Service to work; the list is below. We also keep your theme and interface preferences in your browser’s local storage (localStorage). These preferences stay on your device.

12. Your rights

You have rights such as learning whether your data is processed, requesting information, correction, deletion and objection. The rights of users in Turkey under KVKK art. 11 and how to apply are explained in detail in the KVKK Disclosure Notice. You can also delete your account and content yourself from the profile screen.

13. Your rights under the DIFC Data Protection Law

Because the data controller is established in the DIFC, the DIFC Data Protection Law (DIFC Law No. 5 of 2020) also applies wherever the processing takes place (art. 6(3)). Under this law you have the right to:

• learn whether your data is processed, obtain a copy and request its correction (art. 33(1)), and request its erasure under certain conditions (art. 33(2)) — these requests are free of charge and answered within one month,
• withdraw your consent where processing is based on consent (art. 32),
• object to processing (art. 34) and request restriction of processing (art. 35),
• receive your data in a portable format (art. 37),
• not be discriminated against for exercising your rights (art. 39).

You can send these requests to support@blinkbrosai.com or to the postal address above (art. 40).

If you believe processing is unlawful, you can lodge a complaint with the DIFC Commissioner of Data Protection (art. 60). If you have suffered damage because of a breach of the law, you also have the right to claim compensation before the DIFC Courts (art. 64A).

14. Users in the European Economic Area (GDPR)

If you are in the European Economic Area, under the General Data Protection Regulation (GDPR) you have the right to access your data, to ask for it to be corrected, erased or its processing restricted, to object to processing, to receive your data in a portable format and to withdraw consent where processing is based on consent. You can send these requests to support@blinkbrosai.com; we reply within one month. If you believe your data is processed unlawfully, you can lodge a complaint with the data protection authority of the country where you live.

15. Age limit

The Service is not intended for persons under 18 and we do not knowingly process the data of persons under 18.

16. Changes

When we update this policy, we publish the new text on this page together with its effective date. We announce material changes by notifying your account email address and publishing them on this page.