GDPR &
Data Rights

If you are located in the EEA, United Kingdom, or Switzerland, GDPR and equivalent legislation gives you certain rights over your personal data.

Data Controller

BlogTextify acts as the Data Controller for personal data you provide when creating an account. When processing data on behalf of your connected WordPress blog, BlogTextify acts as a Data Processor and you are the Data Controller for that content.

Legal Basis for Processing

• Contract performance — processing account data and blog credentials to provide the Service
• Legitimate interests — usage analytics and security logs to improve and secure the Service
• Consent — optional analytics cookies, which you can withdraw at any time
• Legal obligation — retention of financial records as required by law

Your Rights Under GDPR

Right of Access (Art. 15)

Request a copy of your personal data via Dashboard → Settings → Privacy → Data Export. We respond within 30 days.

Right to Rectification (Art. 16)

Update incorrect account data directly in your dashboard settings at any time.

Right to Erasure (Art. 17)

Request deletion by deleting your account or submitting a request via the dashboard. Completed within 30 days except where retention is legally required.

Right to Restrict Processing (Art. 18)

Request restriction of processing in certain circumstances — for example while disputing the accuracy of your data.

Right to Data Portability (Art. 20)

Request a machine-readable JSON export of your account information, content history, and settings via dashboard settings.

Right to Object (Art. 21)

Object to processing based on legitimate interests, including profiling. Submit via the dashboard support channel.

Automated Decision-Making

BlogTextify does not make automated decisions that produce legal or similarly significant effects about you as an individual.

Data Transfers Outside the EEA

Google LLC (Gemini API, USA) receives prompts for AI generation, protected under Google's Standard Contractual Clauses (SCCs). Stripe (USA) processes payments under SCCs. All other processing occurs within the EEA or under equivalent safeguards.

Data Retention

Account data retained while active, deleted within 30 days of closure. Financial records retained for 7 years as required by law. Anonymised analytics may be retained indefinitely.

Sub-Processors

Current sub-processors: Google LLC (Gemini AI, hosting), Stripe Inc (payments), Pexels Ltd (image sourcing). We maintain a current list and notify users of material changes.

Right to Lodge a Complaint

You have the right to lodge a complaint with your national data protection supervisory authority. In the UK, this is the Information Commissioner's Office (ICO).

Contact

For GDPR and data subject requests, contact us via the support channel in your dashboard. We respond within 5 business days and always within the 30-day statutory deadline.