Privacy Policy

About This Policy, Bleanx, and Its Scope

This Privacy Policy explains what personal data Bleanx processes, where it obtains that data, the purposes for which it uses it, to whom it discloses it, how it retains and deletes it, and the rights and choices available to individuals.

Who We Are: "Bleanx", "we", "us", and "our" mean Bleanx Inc., a company incorporated in Delaware, United States. Our address is 2810 N Church St STE 88757, Wilmington, DE 19802, United States. For questions about personal data, you may contact support@bleanx.org or telephone (302) 407-0567.

Scope: This Policy covers the processing of personal data in connection with Bleanx's public website at bleanx.com (the "Website"), its web application at bleanx.ai, Bleanx applications actually made available through the Mac App Store or App Store, and related functions, including protected programmatic data export, support, and communications with Bleanx. Referring to applications does not mean that a version for every platform has been released. The bleanx.org domain is used for company email, not as the application or public website address.

This Policy concerns website visitors, account users, Project Owners, Team participants, and Reviewers, as well as other individuals whose personal data is processed through the Services or in communications with Bleanx. An account or paid Subscription is not a prerequisite for exercising applicable personal data protection rights.

Terms and Boundaries: "Personal data" means information relating to an identified or identifiable individual. Such information may be found not only in a profile, but also in Project materials, messages, requests, and AI responses. Business information is not excluded from this category merely because it is used for professional purposes.

The terms Services, Project, Contour, Module, Section, Project Owner, Team participant, Reviewer, User Content, and Output have the same meanings as in the Terms of Use. A Project is organized into Contours, Modules, and Sections. The Terms of Use govern rights in materials and access to them. Those rules do not remove individuals' rights in personal data contained in the materials and do not, by themselves, establish a lawful basis for processing that data.

Information, Not Blanket Permission: This Policy provides information about data processing. Reading it, creating an account, accepting the Terms of Use, or continuing to use the Services does not, by itself, replace separate consent or permission where required. In particular, the required permissions for external AI processing and web search are requested separately. This Policy does not expand Bleanx's permissions to use materials under the Terms of Use.

Privacy at a Glance

This summary is a guide to the detailed sections below, not a separate permission to process data or a replacement for your rights.

_1. Information We Collect

We collect information when you provide it to us, when you use our Website or Services, and when other sources provide it to us, as further described below.

A. Information You Provide to Us

Account and Profile Information: When you create and use a Bleanx account, we process your profile information and the information needed to identify the account and enable sign-in: your profile name, the email address associated with your account, a profile image if supplied, your account identifier, and your sign-in method.

Sign-in to Bleanx is available only through Google and Apple. There is no separate Bleanx sign-in by email, code, or sign-in link. Bleanx does not create or store a separate Bleanx sign-in password for you.

Profile and sign-in information may be provided directly by you or received from your chosen sign-in provider. The information received depends on the sign-in method, the permissions requested, and the data actually supplied by the provider. Providers do not necessarily supply the same information.

If you use Sign in with Apple and choose Hide My Email, the email address associated with your account may be an Apple-provided relay address instead of your personal email address. Bleanx uses the address provided for the relevant account and does not require you to disclose your personal email address merely because you chose that feature.

We also process your selected account and interface settings, including language, appearance, and your choice of an available AI model. Project information, Project roles, purchases, and resource use are described separately below and are not automatically treated as information requested at registration.

When Bleanx requests information from you, required and optional fields are clearly identified. If particular information is necessary to create an account or provide a requested feature, this is explained when the information is requested. Declining to provide optional information does not, by itself, prevent access to your account or the core functionality of the Services.

Project Information, Collaboration and Personal Content

Project Information and Content: When you create and use a Project, Bleanx processes its settings: name, description, industry, and specified location. Location in this context means information specified for the Project, not automatically obtained device coordinates.

We process materials that you or other authorized participants enter, upload, or save in a Project: text, field and table values, images, and other content supported by the relevant feature. Materials are organized into Contours, Modules, and Sections.

User-provided materials are User Content, while results generated by AI through the Services are Output. Saving Output does not automatically make it User Content or Bleanx Content or change the allocation of rights under the Terms of Use.

To perform AI actions, Bleanx also processes user-provided inputs, the context specified for the relevant task, and the results being generated, including before they are saved. Ordinary AI proposals become saved values after the user accepts them; designated managed summaries and other results are saved automatically under the rules of the relevant feature described in the Terms of Use.

Content is processed together with necessary associated information: identifiers of the Project and its elements, their structure and relationships, information about changes and corresponding versions, and applicable AI-origin indicators.

Collaboration and Access Information: To enable collaboration, Bleanx processes information about the Project Owner, Team participants, and Reviewers, their participation in the relevant Project, their roles, and the access individually granted to them by Contour.

This category includes information about invitations and access requests, their status, the email address specified for an invitation and associated accounts, and the granting, changing, and ending of access.

We also process the Journal events supported by the relevant features and their associated information: the author or initiating user, time, relevant Project element, and version, where those details relate to the event.

Direct access to Project materials is determined by the user's role and the permissions granted by the Project Owner. Processing information about participants and invitations does not mean that all such information is visible to every participant.

Journal visibility is governed by the applicable access rules. A Reviewer does not receive access to the shared Project Journal or acquire the right to edit or generate shared Section content.

Granting access to a Project does not, by itself, give other users access to another person's private AI histories, direct correspondence, account settings, or billing data.

Personal AI Interactions and Direct Messages: Personal questions and responses in Ask, conversations in AI Dialogue, and direct messages in Dialogue are processed separately from shared Project content.

Personal Ask and AI Dialogue content, including saved requests and responses, is not made available to the Project Owner, Team participants, or other Reviewers merely because of their role or participation in the same Project.

Among users, direct messages are accessible to the sender and intended recipient. If the Project Owner is a participant in the correspondence, they access it as sender or recipient, not by virtue of owning the Project.

If a user intentionally contributes material from a personal interaction as Project content, the Project access and ownership rules apply to the contributed material. The remaining personal history does not thereby become shared content.

These limits govern access between users. They do not exclude necessary and proportionate processing by Bleanx and its engaged providers to deliver the requested feature, provide support, maintain security, investigate violations, or comply with law, but only within the permitted scope, on an appropriate lawful basis, and subject to applicable safeguards and confidentiality obligations.

Personal Data About Other People: Project materials, images, user-provided inputs, and correspondence may contain personal data about other people, including employees, partners, advisers, and investors who do not have a Bleanx account. This may include names, contact details, positions, and other information about an identified or identifiable individual.

In those cases, Bleanx receives the data from the user providing the relevant material, not necessarily directly from the individual concerned. Personal data may also be contained in Output prepared using those materials.

The user must have the necessary rights and an appropriate lawful basis for providing and using that data as intended, including permissions where required. A user's acceptance of the Terms of Use or activation of an AI feature is not consent from every individual mentioned in the materials.

Bleanx retains its own obligations concerning lawful processing, data minimization, transparency, security, and the exercise of individuals' rights. The user's obligations do not replace Bleanx's obligations.

An individual may contact support@bleanx.org about their personal data and the exercise of applicable rights without registering for the Services. Bleanx handles such requests in light of its role in the relevant processing and applicable law.

Contextual Use of Project Information: When preparing Output and summaries within Contours available to a user, Bleanx may use relevant business information from the entire corresponding Project, including Contours to which that user has no direct access, to keep the result consistent with the overall business description.

The context used is determined by the particular action and the rules of the relevant feature. This does not mean that every request sends the entire Project to an AI provider or that Ask and AI Dialogue automatically receive the same Project data.

Contextual use does not give the user direct access to Contours that are not accessible to them. The Services are not designed to reproduce their content as an alternative way of viewing them. However, Output and summaries available to the user, including previously saved results, may reflect information derived from those Contours. Restricting direct access does not, by itself, prevent derived information from appearing in an available result.

The Project Owner should take this into account when granting access to Team participants and Reviewers. This rule does not include other users' personal Ask content, AI Dialogue, or direct messages in the Project context unless the relevant material has been intentionally contributed to the Project.

Processing personal data in that context and reflecting it in a result are limited to information necessary for the relevant purpose and lawfully permitted to be processed and disclosed on an appropriate basis. Describing this feature does not authorize arbitrary disclosure of personal data or remove Bleanx's own data protection obligations.

Before transmitting data to an external AI provider, Bleanx clearly discloses what data is transmitted, the relevant recipient, and the purpose, and obtains separate express permission from the user initiating the action. Transmission takes place only while that user's permission for external AI processing is active. The personal AI setting of an author of shared Project content, including the Project Owner, does not, by itself, exclude that content from the permitted context of other authorized users' AI actions. This remains the case when the author's own AI permission is off. Section 5 explains the limits of this personal setting and the preserved personal data rights.

External web search in a supported AI scenario requires both permissions: external AI processing and external search. Permission for AI processing is not, by itself, permission for search.

The user is provided with an accessible and understandable way to withdraw the relevant permission for future transmissions for actions they initiate. Withdrawal does not automatically delete data already received by a provider; applicable erasure and other rights remain unaffected.

Reading this Policy, accepting the Terms of Use, owning a Project, or participating in it does not replace those permissions. The initiating user's permission also does not replace the lawful bases and safeguards required for processing other individuals' personal data.

Limits and Related Disclosures: Listing data in this Section does not grant Bleanx additional permission to use it for model training or independent product development. The restrictions in Section 4 of the Terms of Use apply. The external search provider's specific uses of transmitted search queries are disclosed separately and do not extend to other Project materials or personal histories.

The specific purposes and lawful bases of processing, recipients, international transfers, retention periods, deletion, and ways to exercise rights are described in the corresponding sections of this Privacy Policy.

Your Communications with Us

Inquiries and Associated Information: When you contact Bleanx through support@bleanx.org, the available features of the Services, or other available contact channels, we process the information necessary to handle your inquiry, carry out the relevant request, and respond.

Inquiries may concern questions about the Services, technical support, account security, complaints, refunds and withdrawal from a contract, obtaining or erasing data, account deletion, switching to another provider, opting out of the arbitration agreement, and other notices or requests provided for by the Terms of Use or applicable law.

Depending on the inquiry, we process the name and contact details you provide, identifiers of the relevant account, Project, or purchase, the content of your message and supplied attachments, and the date of the inquiry, subsequent correspondence, and information about its handling and outcome. For these inquiries, we process your telephone number or postal address only if you provide it; neither is required for every request.

We request additional information only to the extent necessary. Verification of identity or authority is proportionate to the nature of the request and applicable requirements. Contacting Bleanx does not give us unrestricted access to all of the requester's Projects or personal histories.

Not having an account does not prevent you from contacting us about your personal data or exercising other applicable rights. Support supplements, rather than replaces, the available self-service export, deletion, and Subscription-management features and other contact methods provided for by the Terms of Use or applicable law.

Voluntary Bug Reports: If you voluntarily send Bleanx a bug report, we use the report and any materials supplied with it only as necessary to diagnose, reproduce, correct, and verify the correction of the reported error.

Those materials are not used to train, fine-tune, or improve AI models, for general research datasets, to develop new features, or for independent product development. Aggregating, de-identifying, or otherwise transforming the materials does not create an exception to the restrictions in Section 4 of the Terms of Use.

Submitting a bug report does not transfer ownership of its contents or attachments to Bleanx or expand the sender's rights in another person's materials. We recommend providing only information necessary to explain the error and omitting unrelated personal data, secret access keys, and other confidential information.

Bleanx does not forward user data through provider feedback channels that permit its use for model training or product development. Where provider assistance is necessary to correct the error, Bleanx uses a support channel consistent with these restrictions or reproduces the issue without user data. Any necessary transmission remains subject to applicable permission, data protection, and international-transfer requirements.

Reports of Violations and Moderation Decisions: If you report a suspected violation or challenge a moderation decision, Bleanx processes necessary information about the reporting person and their contact channel, the identified content, message, account, or conduct, the grounds for the report, the materials supplied, and related circumstances. We also process information about the review, decision, notifications, and requests for reconsideration.

That information is used to handle the report, examine the relevant circumstances, take and review measures, provide required notices, and fulfil applicable obligations under the procedures in Section 1 of the Terms of Use. Receiving a report does not, by itself, establish a violation.

Reports and review materials do not become shared Project content. An acknowledgement sent through Dialogue is a private Bleanx system message to the reporting person, not an entry in the shared Journal. Where a report is submitted by email or the reporting person cannot access Dialogue, an available electronic contact channel is used. Review outcomes and notices of restrictions are communicated under the Terms of Use.

Access to review materials is limited to authorized persons and what is necessary. Notifying an affected user of a decision does not automatically disclose the entire report, all attachments, or the reporting person's contact details to that user. Any necessary disclosure is limited by its applicable lawful basis and purpose and the rights of other individuals.

Service Messages and Marketing Consent: Bleanx currently sends only necessary service messages. We use the relevant contact details and account, purchase, Subscription, or inquiry information for that purpose. These messages concern providing, administering, and protecting the Services, including account security, payments, Subscriptions, support, reports, changes to terms, and mandatory notices.

Necessary service messages are not conditional on marketing consent. While your account or Subscription remains active, you cannot opt out of messages necessary for those purposes, except where applicable law or applicable platform rules require an opt-out or other choice.

For applications actually made available, system notifications follow operating-system permissions and settings. Disabling them does not remove access to the application's core functionality. Push notifications do not include confidential Project content or private correspondence.

Bleanx does not currently send marketing messages. Contacting support, sending a bug report or complaint, creating an account, accepting the Terms of Use, or making a purchase does not constitute marketing consent.

If Bleanx introduces marketing communications, it will send them only after separate, voluntary, specific, informed, affirmative consent to the relevant communications. Consent will not be a condition of receiving support, creating an account, or making a purchase.

Each marketing message will identify Bleanx and include a clear, simple, and free way to unsubscribe; marketing emails will provide a one-click unsubscribe option. You may withdraw marketing consent at any time. Unsubscribing will not affect access to the Services, the handling of your inquiries, or necessary service messages, subject to mandatory user rights.

Limits and Related Disclosures: Inquiries and accompanying materials do not provide general permission for model training, product development, or marketing. The restrictions in the Terms of Use and this Privacy Policy apply.

The lawful bases of processing, recipients engaged for the relevant purposes, international transfers, and retention periods for inquiries and related records are described in the corresponding sections of this Policy. Closing an inquiry does not, by itself, mean that all related records are immediately erased, but neither does it authorize indefinite retention.

Payment, Billing and Resource Information

Web Purchases through Stripe: When you purchase a Subscription or a separate Usage Credit top-up directly through Bleanx's web service, Stripe processes the payment and administers authorized renewal-payment attempts and retries. Stripe also sends the configured failed-payment notices and payment-update or invoice-payment links for direct web Subscriptions. Card details are provided through Stripe's payment interface. Bleanx does not receive or store your full card details. Limited payment-method information may be processed if the payment provider supplies it for display or to match a purchase; this does not mean that Bleanx receives full card details.

To arrange the purchase, confirm payment, and provide paid access, Bleanx processes necessary information about the purchaser and transaction: the name, email, and billing address provided, customer, invoice, payment, and Subscription identifiers, the selected product, amount, currency, applicable taxes, and transaction date and status, together with necessary payment-attempt dates and outcomes, pending renewal and retry status, and invoice closure information.

Some of this information is provided by you, some is received from Stripe, and Bleanx generates associated purchase and entitlement records. The information processed depends on the particular purchase and the actions necessary to handle it.

Bleanx uses transaction confirmations and identifiers to match payment to the account, provide the corresponding access or purchased Usage Credits, and handle Subscription renewals, payment failures and retries, cancellations, refunds, and payment disputes. Not receiving full card details does not mean that Bleanx processes no personal data relating to the purchase.

Purchase Location and Tax Information: To verify eligibility for a direct web purchase, Bleanx processes the country you provide, your province or territory for Canada, your billing address, and necessary information about your usual residence or the place of business or receipt of the service where relevant to the purchase.

To verify eligibility, prevent improper payments, and determine the applicable tax treatment, Bleanx compares the information provided with payment information and necessary technical data, including your IP address. Verification is limited to those purposes. An IP address is not treated as conclusive proof of usual residence, and the country selected in a form does not, by itself, determine eligibility or tax treatment.

Where there is a material inconsistency, Bleanx may request necessary clarification or decline to complete the purchase until it is resolved. A technical mismatch does not, by itself, establish a false declaration or breach of the Terms of Use. You may correct inaccurate information or contact support@bleanx.org to request review of an erroneous eligibility determination.

For a permitted business purchase, Bleanx processes the relevant tax identification number and information necessary to verify tax status and apply the lawful tax treatment. Providing that information does not automatically change the party to the contract or the Project Owner.

With the direct-purchase record, Bleanx retains the country or region selected and confirmed for the purchase and the purchase date.

These direct-purchase availability rules apply to direct web purchases, not Apple In-App Purchases. This subsection does not describe the collection of precise device coordinates or continuous tracking of your movements.

Purchases through Apple: When you make an Apple In-App Purchase in a Bleanx application actually made available, Apple processes the payment through the purchaser's Apple Account. Apple does not provide Bleanx with the card details used for that purchase.

Bleanx receives and processes transaction confirmation and necessary information about the product and entitlements: transaction and related original-purchase identifiers, the product, purchase and relevant period dates, Subscription status, and information about renewal, cancellation, plan changes, refunds, payment failures, or a grace period, to the extent relevant to the transaction.

To provide the purchase to the correct user, Bleanx processes the association between the confirmed transaction and the corresponding Bleanx account. This association is used to provide and verify access, account for purchased Usage Credits, restore purchases that are eligible for restoration, and prevent the same purchase from being granted more than once.

Receiving this information does not give Bleanx access to the full payment information of the Apple Account or to your purchases in other applications.

Purchase management follows the channel in which the purchase was made, not the device used to access Bleanx. Using a web Subscription in an application or an Apple Subscription through the web service does not, by itself, change the payment channel.

Purchase and Subscription Records: Bleanx processes the history of Subscriptions and separate Usage Credit top-ups, including the purchase channel, selected product, price, currency, taxes, confirmed payments, relevant periods, recorded cancellation requests and their confirmation or pending outcomes, scheduled endings, restoration of recurring payments through Resubscribe, failed renewal attempts, retry windows, unpaid invoice closure, and new Subscriptions purchased after earlier ones end, Apple-managed plan changes, refunds, statements of withdrawal from a contract, and related payment disputes.

There is no upgrade or downgrade within an active direct web Subscription. For a change of web plan, the necessary records concern cancellation and the effective end of the previous Subscription, the separately confirmed new purchase, and the new monthly period and billing anchor established when Stripe confirms payment. If an existing web renewal is unresolved, necessary status records prevent a second concurrent purchase until it is settled or finally closed. For a plan change through Apple, the relevant Apple events and calculations apply under Section 18 of the Terms. Bleanx uses necessary Subscription-status and account-association records to enforce the rule that only one paid Subscription may be active for the account across web and Apple. This does not give Bleanx access to purchases unrelated to Bleanx or expand the payment-data categories described above.

We also process necessary records of purchase confirmation, authorization of recurring payments, a recorded cancellation request and any post-request payment and refund, a separate request to begin the service during a statutory withdrawal period, acceptance of changes to prices or consumption rules, and related notices. These records include the relevant terms or their version, date, and time where necessary to establish the information provided and the user's choice.

The information is used to fulfil the purchase, correctly provide access and resources, administer payments, meet applicable tax and other obligations, handle refunds, and demonstrate compliance with user rights. Consent to recurring payments is not marketing consent or blanket permission to process data.

For a lawful withdrawal from the combined monthly Subscription service, the percentage of the AI or web-search allowance used does not replace the calculation by duration of service required under the Terms of Use.

Allowance and Usage Credit Accounting: To provide the relevant features and correctly account for resources, Bleanx processes information about the applicable plan, monthly period or one-time Welcome Allowance, the percentage remaining on each of the two separate AI and web-search indicators, and the quantity and remaining balance of separately purchased Usage Credits.

Necessary associated information includes the initiating account, selected model, consumption category, the relevant action and its prescribed chain, and the data needed to determine and verify the consumption accounted for. Consumption is attributed to the initiating user; it does not become the Project Owner's consumption merely because the work concerns a shared Project.

For purchased Usage Credits, Bleanx processes information about the purchase, quantity granted, use, remaining balance, and adjustments relating to a corresponding refund or payment event. This accounting preserves rights under separate purchases and prevents duplicate grants or double charging.

This is operational processing necessary to provide the Services, administer billing, verify accounting accuracy, prevent abuse, and handle related inquiries. Bleanx does not use this data to train or improve AI models, research or develop new features, or independently develop products, including after aggregation, de-identification, anonymization, or another transformation.

Displaying included allowances as percentages does not make them Usage Credits or restrict your applicable rights to obtain usage and purchase data relating to you.

Access, Payment Providers and Retention: Payment, Subscription, and personal resource-balance data do not become shared Project content and are not made available to other participants merely because of their role.

Stripe and Apple, in their payment-provider capacity, process payment data concerning the purchaser, payment method, and transaction under their applicable terms and privacy notices, including for fraud prevention and improvement of their payment services, subject to applicable law. For direct web purchases, Stripe also uses the purchaser's contact and necessary invoice or Subscription information to send payment-failure notices and links to update payment details or pay a pending invoice, under the payment-notification settings used for the transaction. These notices are separate from service emails sent by Bleanx through Resend. Some Stripe and Apple processing is for their own purposes rather than solely on Bleanx's behalf. This is the limited payment-data exception described in Section 4 of the Terms of Use; it is not a general exception for all data held by or accessible to either provider.

The exception does not extend to Project materials, User Content, Output, personal Ask or AI Dialogue content, direct messages, or Bleanx's allowance and consumption records, including transformed information derived from those materials or records. It does not authorize Bleanx to disclose those materials or records for payment-service improvement or to use any application data itself for model training or independent product development. Purchase records, including which product was bought and the amount paid, are distinct from records of how AI, search, allowances, or purchased credits are used within Bleanx. Providing necessary purchaser information for a payment does not open the rest of the user's account or content to the payment provider.

The specific purposes and lawful bases of processing, relevant roles and recipients, international transfers, and retention periods are described in the corresponding sections of this Policy. Engaging a payment provider or referring to its terms does not remove Bleanx's own obligations, replace any consent or safeguard required by law, or permit unrelated processing.

Cancelling a Subscription or deleting an account does not mean that all financial and tax records are immediately erased. Bleanx retains only the information necessary on an appropriate lawful basis for the relevant settlements, refunds, claims, or mandatory recordkeeping, in a limited scope and for a justified period.

B. Information Collected Automatically

Necessary Technical Data and Logs: When you connect to the Website and the Services, Bleanx processes automatically received technical information necessary to handle requests, operate the Services, maintain security, and resolve technical failures.

This category includes IP addresses and technical records of request processing, authentication, errors, and security events. Such records may be associated with the relevant account or action where necessary for the operational task. The absence of analytics does not mean that all technical records are anonymous.

Technical logs are used only to maintain operation of the Services, detect and investigate technical problems and security threats, prevent abuse, and diagnose and correct failures. They are not used to assess users' interests, create marketing profiles, study the popularity of features, or plan product development.

Bleanx does not use this data to train, fine-tune, or improve AI models or for independent product research or development, including after aggregation, de-identification, anonymization, or another transformation.

Logs are limited to necessary information. Bleanx takes measures to prevent the recording of excessive Project content, personal conversations, or active secret access credentials. Access to logs is limited to authorized persons and relevant providers to the extent necessary for the permitted task.

Error Reports — Sentry: Bleanx uses Sentry to receive, store and review error reports from the web application at bleanx.ai, solely to diagnose and correct technical errors. Sentry is connected only to that web application, not to Bleanx's macOS application or the public website at bleanx.com. Bleanx does not use Sentry Session Replay, recording of users' actions or behavioural analytics.

Error reports and their associated technical information remain subject to the necessity, minimization and access limits above. The use of an error-reporting tool does not mean that its reports are anonymous or authorize the transfer of excessive Project materials, private conversations or active secret credentials. Sentry's role, storage location and retention are described in Sections 3, 4 and 7.

IP Address and Purchase Verification: Bleanx uses IP addresses to maintain the security of connections and the Services, identify suspicious requests, and prevent abuse.

For a direct web purchase, the IP address is also used together with user-provided and payment information to verify purchase eligibility, prevent improper payments, and determine the applicable tax treatment, as described under "Payment, Billing and Resource Information".

An IP address is not treated as conclusive evidence of a user's usual residence. A mismatch between technical information and information supplied by the user does not, by itself, establish a violation. The ability to correct information and request review of an erroneous purchase-eligibility determination remains available.

Using an IP address for these purposes does not mean obtaining precise device coordinates, continuously tracking movements, or using location for advertising.

Essential Browser Storage: To enable sign-in and maintain authenticated access, Bleanx's web application uses localStorage, the browser's local storage. It holds service data necessary for the relevant authenticated session.

This storage is used to provide the account access requested by the user, not for analytics, advertising, or tracking behaviour on other websites. It does not involve creating or storing a separate Bleanx password; sign-in takes place through Google or Apple.

Such storage is limited to necessary data, its specified purpose, and a justified duration. The name of the technology or its technical availability does not authorize indefinite retention or use for another purpose.

You may manage locally stored website data through your browser settings. Deleting or blocking it may require you to sign in again or prevent authentication. Deleting browser data does not, by itself, delete your account or Projects on Bleanx's servers or cancel a Subscription; separate functions are provided for those actions.

Using localStorage or signing in does not replace the separate permissions required for external AI processing and web search.

No Analytics or Advertising Tracking: Bleanx does not use visitor or user-behaviour analytics on bleanx.com or in bleanx.ai. Google Analytics and Webflow Analyze are not used.

Bleanx does not use cookies, pixels, or other technologies for analytics, advertising tracking, or building profiles of users' interests. Necessary technical logs and operational resource accounting are not used as a hidden substitute for such analytics.

Signing in to the same account from different devices and providing the data and purchases associated with that account are account functionality, not advertising-related matching of a user's behaviour across devices.

The absence of analytics does not remove the processing necessary for authentication, operation of the Services, security, payments, and resource accounting described elsewhere in this Policy.

Access, Retention and Rights: Technical data and logs do not become shared Project content and are not made available to other participants merely because of their role. A technical identifier or an association with an account does not grant additional access to user content.

Lawful bases, recipients, international transfers, and retention periods are described in the corresponding sections of this Policy. Retention is determined separately for authentication data, technical logs, security events, and purchase-verification information.

Applicable personal data rights also extend to technical records. Information is not excluded from an access request merely because it is in a log; necessary safeguards for other individuals' rights, confidentiality, and security apply when it is provided.

C. Information from Other Sources

Information from Sign-In, Payment and Technical Providers: Bleanx receives some information from providers involved in delivering requested features of the Services, rather than directly from you.

Google and Apple provide information needed for the chosen sign-in method and associated profile within the scope described under "Account and Profile Information". Signing in through a provider does not give Bleanx general access to your email, calendar, cloud files, or other data in the external account.

Stripe and Apple provide purchase-related confirmations, identifiers, and payment and Subscription information within the scope described under "Payment, Billing and Resource Information". Receiving this information does not mean that Bleanx receives your full card details.

In providing the Services, engaged technical providers may also supply technical information associated with the relevant operations, including confirmations of request processing, error records, and security events. Processing is limited to the purposes described under "Information Collected Automatically" and does not authorize analytics-based or marketing-related profile enrichment.

The information received depends on the particular feature and the data actually provided. These provisions do not mean that all providers supply identical information or that Bleanx receives all the data held by a provider.

Information from Other Users and Reporting Persons: Bleanx may receive information about you from another user, for example when a Project Owner specifies your email address for an invitation, grants or changes access, or an authorized participant includes information about you in Project materials.

This may include information about participation, roles and permissions, invitations and associated actions, and personal data contained in the supplied materials. It may concern someone who does not have a Bleanx account.

We may also receive information relating to you in another participant's message, a support inquiry, a report of a violation, or materials submitted for review of a decision. Such information is processed under "Project Information, Collaboration and Personal Content" and "Your Communications with Us".

Receiving information from another person does not automatically establish its accuracy, the consent of the individual concerned, or a right to disclose it to other participants. The established access restrictions, Bleanx's own obligations, and applicable rights to rectification, erasure, and other personal data protection remain in effect.

Results from External AI and Search Providers: When an initiated and authorized AI action is performed, Bleanx receives results from the relevant external AI provider. When external search is authorized, Bleanx receives results from the search provider, identified in Service Providers.

These results may contain information about individuals, including information obtained from publicly accessible internet sources, and links to sources. Output may also contain inferences or statements about individuals generated by AI from the supplied context. An AI result should not automatically be treated as a verified fact or an accurate copy of information from an identified source.

Receiving and using these results is limited to the relevant feature, authorized task, and necessary scope of data. This Section does not authorize Bleanx to create independent marketing databases or dossiers about users or other individuals.

Transmitting data for AI and search remains subject to separate permissions, context restrictions, and Section 4 of the Terms of Use. Describing the results received does not replace permission to transmit the underlying data or expand the agreed exceptions for search queries, payment data, or email-delivery metadata.

A source being publicly accessible does not remove applicable requirements concerning lawful processing, transparency, security, or the exercise of individuals' rights.

Limits on Collection and Required Information: Using a work email address or an address with a particular domain does not, by itself, authorize Bleanx to enrich your profile with information from third-party marketing databases or give an organization access to your account, Projects, personal conversations, or purchases.

Receiving information from an external source does not create an independent lawful basis for any use of it. The relevant purposes, lawful bases, access restrictions, retention periods, and rights described in this Policy apply to that information.

Where Bleanx is required to provide information about personal data obtained other than from the individual concerned, it supplies the information required by law, including the categories of data, their source and, where applicable, whether they originated from publicly accessible sources, within the required periods and subject to lawful exceptions.

You may contact support@bleanx.org about your personal data and applicable rights without creating an account. This does not restrict other available ways to exercise those rights.

_2. How We Use Your Information

Purposes and Limits: Bleanx uses the data described in Section 1 only for the specific purposes set out below, to the extent necessary for the relevant purpose and in accordance with applicable law.

Where the GDPR applies, the lawful basis is determined for the relevant processing operation. Bleanx's possession of data, its receipt from another user or provider, acceptance of the Terms of Use, or reading this Privacy Policy does not authorize the use of all data for any purpose.

Processing remains subject to the restrictions in the Terms of Use and this Policy, including access rules, separate permissions for external AI processing and search, and the prohibition on Bleanx itself using data for model training or independent product development. The narrowly scoped exceptions for provider processing of transmitted search queries, payment data, and email-delivery metadata apply only to the respective data, recipients, and purposes expressly described in this Policy and Section 4 of the Terms. They do not extend to other data or authorize such use by Bleanx itself.

Account Administration and Access: Bleanx uses the information described under "Account and Profile Information" to create and administer your individual account, verify sign-in through Google or Apple, maintain authenticated access, display the profile you provide, and apply your selected settings.

We also use access information associated with your account to provide the features available to you and enforce the limits of your role and permissions. These operations do not give the Project Owner or other participants access to your personal conversations, account settings, or billing data.

When administering individual accounts and determining how they are provided, Bleanx acts as a controller of personal data: it determines the purposes and essential means of that processing. This description applies to those operations, not automatically to all content that users place in Projects.

Where the GDPR applies, processing your personal data that is objectively necessary to create and administer your account and provide the requested access under our contract with you is based on Article 6(1)(b), performance of a contract. Before a contract is concluded, that basis applies only to necessary steps taken at your request to enter into the contract.

Optional profile information does not become mandatory for registration or core functionality merely because it is listed in this Policy. If you provide it for a selected profile feature, it is used for that feature, not unrelated purposes.

Limits of the Contractual Basis: Performance of a contract is a lawful basis only to the extent necessary for the relevant contractual service. Merely describing processing in the Terms of Use does not make it necessary for performance of a contract.

A contract with the Project Owner or another user does not automatically provide a basis under Article 6(1)(b) for processing the personal data of every employee, partner, investor, or other individual mentioned in the materials. The particular purpose, Bleanx's role, and an appropriate lawful basis for the relevant processing must be considered for that data.

Performance of a contract does not replace the separate permissions required for external AI processing and search. Those transmissions take place only while the necessary permissions are active; citing a contractual basis does not permit Bleanx to override a refusal or withdrawal of permission.

Content Storage and Requested Operations: Bleanx uses the data described under "Project Information, Collaboration and Personal Content" to provide the corresponding features: storing and organizing Project materials, displaying saved Section values and Output, carrying out authorized changes, maintaining the supported version information and Journal events, and providing exports available to the relevant user.

Processing is limited to the content and associated information necessary for the particular action. Storing and displaying previously generated Output does not mean training an AI model on that content or authorize its use for independent product development.

Actions are carried out within the user's role, granted access, and relevant feature settings. The technical ability to process material does not mean that any user is entitled to request its viewing, modification, or export.

Collaboration and Personal Content: Bleanx uses information about participation, invitations, requests, roles, and permissions to grant, change, and end access under the rules of the relevant Project. Journal information is used to display supported actions and changes in accordance with its visibility rules.

Personal Ask and AI Dialogue content is processed to provide the relevant user with their personal interactions and saved history. Direct messages are processed to deliver them to the intended recipient and make the correspondence available to its participants. These categories do not become shared Project content.

The Project Owner manages Project access but does not, by virtue of that role, acquire authority to instruct disclosure of other users' personal conversations, account settings, or billing data. Placing material in a shared Project and intentionally contributing material from a personal conversation are governed by Section 1 of this Policy and the Terms of Use.

These provisions do not expand permissible AI context or replace separate permissions for external AI processing and search. Bleanx's own actions for security, the handling of violations, and compliance with law are limited to the corresponding purposes and lawful bases described separately.

Processing on Instructions: Where a user or another appropriate controller determines the purpose and essential parameters of processing personal data in supplied content, and Bleanx stores, organizes, displays, makes authorized changes to, or transmits that content solely on that controller's documented instructions, Bleanx acts as a processor of personal data for those operations.

Instructions may be expressed through authorized persons' use of supported features and settings within the applicable contractual processing terms. An instruction does not authorize unlawful processing, expand access rights, or replace separate permissions where required.

Project Owner is a product role, not an automatic designation of a controller under data protection law. The controller is identified by who actually makes the relevant decisions about processing. Ownership of materials under the Terms of Use does not, by itself, determine that role.

Where a user acts on behalf of another controller, their actual authority and the corresponding processing chain are taken into account. A work email address does not establish that authority or give an organization access to the account or materials.

This classification does not automatically extend to Bleanx's own processing purposes, including the administration of individual accounts described above.

Responsibilities and Requests: Processing on instructions is subject to binding contractual terms defining the subject matter and limits of processing, instructions, and the parties' obligations. The controller ensures an appropriate lawful basis for the relevant use of personal data. A processing agreement and a license in materials do not, by themselves, replace that lawful basis.

Bleanx retains its own processor obligations, including following lawful instructions, confidentiality, appropriate security measures, properly engaging other processors, and assisting with the exercise of individuals' rights. Contractual processing terms cannot remove mandatory safeguards.

An individual may contact Bleanx about their personal data at support@bleanx.org without registering. Where a request concerns data processed on behalf of another controller, Bleanx assists that controller in handling it within Bleanx's obligations. Bleanx handles questions about its own processing itself.

Processing on instructions does not exclude the data from the safeguards described in this Policy or permit an inquiry to be left without appropriate handling merely because the individual is not a Bleanx user.

Data Processing Addendum: Data Processing Addendum 2.0

Processing by Bleanx as a processor or subprocessor is governed by the Data Processing Addendum (DPA), Version 2.0, annexed to the Terms of Use. The Terms, this Policy and the DPA are made available together with the same initial effective date. The DPA describes the processing scope, documented instructions, confidentiality and security, subprocessors, assistance, return and deletion, and international-transfer requirements. It is made available with the Terms and accepted through the same act, without a separate signature, additional checkbox, or corporate tariff, subject to valid party identification and authority. It does not remove the safeguards described in this Policy, expand access rights, or replace separate AI, search, or other legally required permissions. Bleanx's own controller processing remains subject to the corresponding purposes and lawful bases in this Policy.

Support, Service Communications and Related Records

Handling Inquiries and Bleanx's Role: Bleanx uses the information described under "Your Communications with Us" to receive and consider an inquiry, carry out the corresponding request, respond, and communicate the outcome. Processing is limited to information necessary for the particular matter.

When independently organizing support, handling complaints, and fulfilling its own contractual and statutory obligations, Bleanx acts as controller. Where a particular operation involving customer content is performed on the documented instructions of the appropriate controller, the processing-on-instructions arrangements described above and the applicable DPA govern that operation.

An inquiry does not give Bleanx or a mail provider unrestricted access to the account or all of the user's materials. Additional information and verification of identity or authority are requested only to the extent necessary and proportionate. Not having an account does not prevent an inquiry or the exercise of applicable rights.

Lawful Bases for the Particular Purpose: Where the GDPR applies, support and communications objectively necessary to perform a contract with the individual concerned, or to take steps at that individual's request before entering into a contract, are based on Article 6(1)(b).

Processing necessary to fulfil a specific legal obligation, such as handling a personal data rights request, is based on Article 6(1)(c) where the relevant obligation is laid down in applicable Union or Member State law. An obligation under another country's law does not, by itself, establish a basis under Article 6(1)(c) GDPR and must be assessed separately.

Handling inquiries from representatives and individuals with whom Bleanx has no contract, maintaining necessary correspondence, and protecting rights in connection with inquiries may be based on Article 6(1)(f), but only where the processing is necessary for those legitimate interests and an assessment establishes that the individual's interests or fundamental rights and freedoms do not override them.

These are purpose-specific bases, not interchangeable alternatives for any use of the data. They do not authorize marketing, model training, analysis of feature popularity, or product development contrary to the Terms of Use and this Policy. A contract with one person does not automatically cover the personal data of everyone mentioned in that person's inquiry.

Necessary Service Communications: Bleanx uses necessary contact details and information about the relevant event to send service confirmations and notices concerning accounts and security, purchases and Subscriptions, cancellation and withdrawal from a contract, acceptance of a price or the Terms, changes to terms, and the handling and outcomes of inquiries and complaints.

These messages are not conditional on marketing consent and are not used to deliver advertising disguised as a mandatory notice. Bleanx does not currently send marketing messages; any future introduction of marketing is subject to the separate rules and separate consent described under "Service Messages and Marketing Consent".

Incoming support correspondence is processed through Google Workspace, and the designated service-email delivery is provided through Resend. Each provider receives data only for the relevant operation and within the limits described in Section 3. The limited exception for email-delivery metadata does not extend to the contents of support correspondence.

A technical delivery status is not treated as proof that an email was read. Failure to deliver a confirmation does not invalidate an otherwise valid notice already submitted by the user or suspend applicable time limits.

Related Records and Limits on Use: Bleanx maintains necessary records of an inquiry and its handling, including when it was received, the matter concerned, the action requested and performed, the decision, and messages sent. Records evidencing acceptance of a price or terms identify the relevant version and the user's action, rather than recording an unrestricted history of the user's behaviour.

Bug reports and accompanying materials are used only to diagnose, reproduce, correct, and verify correction of the reported error. They are not used for model training or development of new features and are not transmitted through provider feedback channels incompatible with these restrictions.

Complaint materials do not become shared Project content. Communicating a decision does not automatically disclose the entire complaint, attachments, or the reporting person's contact details to another user. Any necessary disclosure remains subject to the limits described under "Reports of Violations and Moderation Decisions".

Records are retained only to the necessary extent and on the corresponding lawful basis under Section 7. Closing an inquiry does not mean that every associated record is immediately erased, but neither does it authorize indefinite retention of all correspondence and attachments.

Security, Fraud Prevention and Handling of Violations

Protecting Accounts and Operation of the Services: Bleanx uses necessary account and authentication information, IP addresses, technical records of requests, errors, and security events, and information about actions and transactions relevant to the event being examined to protect accounts and the Services against unauthorized access, attacks, fraud, and abuse.

These data are also used to identify and resolve failures, investigate incidents, and assess the effectiveness of protective measures. The scope of data is limited to the relevant task. This does not authorize analysis of users' interests, feature popularity, or the business content of Projects for product development.

A technical anomaly, unsuccessful sign-in, or temporary protective restriction does not, by itself, establish that a user has breached the Terms. Reaching an applicable resource limit does not, by itself, constitute abuse.

Reports, Content Review and Response Measures: To apply content and conduct rules, Bleanx processes information about the relevant message, material, account, or action, the report received, and the circumstances necessary to consider it.

Processing includes the proportionate filtering measures for objectionable User Content provided for in the Terms, consideration of identified violations and reports, necessary response measures, and review of decisions. This does not mean prior manual review of every document, Section change, or message, or guarantee detection of every violation.

Access to content during a review is limited to what is necessary for the particular task. Receiving a report does not grant a general right to examine all of the user's Projects and personal conversations and does not, by itself, establish a violation.

The grounds for restrictions, notices, and ways to challenge decisions are governed by Section 1 of the Terms. Review decisions are taken under the supervision of an authorized and appropriately qualified member of staff and are not based solely on automated processing. Reports and review materials remain outside shared Project content.

Roles and Lawful Bases: When determining its own measures to protect the Services, prevent fraud, and enforce conduct rules, Bleanx acts as controller for the corresponding processing. Protection of customer data performed on behalf of the appropriate controller remains within the scope of the DPA; describing an operation as security does not remove those data from its safeguards.

Where the GDPR applies, necessary processing to protect users and the Services and prevent abuse may be based on Article 6(1)(f), following an assessment of necessity and the balance between the legitimate interests pursued and the individual's interests, rights, and freedoms.

Processing to fulfil a specific obligation under applicable Union or Member State law is based on Article 6(1)(c). An Apple requirement or a reference to the Terms does not, by itself, constitute such a statutory obligation. Lawful bases are determined for the particular operations and do not authorize unrelated processing purposes.

Access Limits, Records and Individual Rights: Access to data for these purposes is limited to authorized persons and necessary providers, to the extent required for the relevant task and subject to appropriate confidentiality obligations. Technical logs do not contain excessive Project or personal-conversation content or active secret access credentials.

Records of reviews and incidents are used for the corresponding protective task, fulfilment of mandatory requirements, and necessary evidence of measures taken. They do not become an indefinite dossier and are not used for model training or independent product development, including after aggregation or de-identification.

Where processing is based on legitimate interests, an individual may object on grounds relating to their particular situation. Bleanx stops that processing unless it demonstrates compelling legitimate grounds that override the individual's interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defence of legal claims.

Data is not automatically disclosed to government authorities merely because a suspicion arises or a request is received. Verification of the authority and lawful basis, limits on the necessary scope of disclosure, and international-transfer rules apply.

Retention periods, deletion, access to personal data, and mandatory incident notifications are governed by the corresponding sections of this Policy and applicable law. This block does not limit Bleanx's own liability for breach of its data protection obligations.

AI Generation and External Search

Purposes and Data Used for AI Actions

When you initiate an available AI action, Bleanx uses necessary inputs and context to create, supplement, or analyze Section content, prepare the summaries provided for by the relevant feature, or respond in the AI modes of Ask or AI Dialogue.

Performing the action involves processing the selected model, user-provided inputs, the context of the relevant feature, the Output being generated, and necessary technical information about execution. Processing also takes place before a result is saved; accepting or rejecting a proposal does not mean that the data was not processed beforehand.

Context is prepared for the particular task under Section 1 of this Policy and the Terms of Use. In the designated scenarios it may include relevant information from Contours to which the participant has no direct access. This does not mean sending the entire Project with every request or including other users' private conversations.

Bleanx uses the external AI providers identified in Service Providers for the corresponding available models. The recipient depends on the model actually used and the way the feature is provided. This does not mean that every request is sent to all providers.

The result is displayed and saved under the rules of the relevant feature. Display, saving, and AI-origin marking do not confirm the accuracy of the result or change the allocation of rights in it.

Roles, Contractual Basis and Separate Permissions

To administer a requested AI action, including identifying the initiating account, selected model, and permitted feature, Bleanx uses the user's necessary personal data to perform its contract with that user. Where the GDPR applies, processing that is objectively necessary for that purpose is based on Article 6(1)(b).

Where content is processed on the documented instructions of the appropriate controller, Bleanx acts as a processor or subprocessor within the arrangements described above and the applicable DPA. The controller ensures a lawful basis for the corresponding use of personal data; the DPA and a license in materials do not replace that basis.

A contract with the person initiating the action is not an automatic lawful basis for processing the data of everyone mentioned in the inputs, context, or results. Their data is processed with regard to the relevant role, lawful basis, necessary scope, and those individuals' rights.

Before transmitting data to an external AI provider, Bleanx discloses the recipient, categories of data transmitted, and purpose, and obtains separate express permission from the initiating user. Transmission takes place only while that user's permission for external AI processing is active. This personal feature permission is checked for the user initiating the action, not automatically for every author of material used as context. A contributor's refusal or withdrawal of their personal AI permission does not, by itself, exclude shared Project content from other authorized users' permitted AI actions. The context limits in Section 1 and the choices and personal data safeguards in Section 5 continue to apply.

External search in a supported AI scenario requires both active permissions: external AI processing and external search. Acceptance of the Terms or DPA, holding a Subscription, or being the Project Owner does not replace those permissions.

A separate permission for a feature is not blanket consent under the GDPR from all individuals mentioned. Where particular processing relies on consent, the applicable requirements for that consent and its withdrawal must be met. Referring to performance of a contract does not permit Bleanx to bypass refusal of the relevant external transmission.

External Search: Two Query Scenarios

External search is an optional feature, used only in supported scenarios when enabled and with the necessary permissions, to obtain external information for the corresponding response or result.

For Section generation, search is used only for Sections designated as suitable for it. Bleanx prepares a purpose-limited query from general business information, rather than sending the search provider the entire Project or full AI context. Query preparation is designed to exclude personal, confidential, and sensitive information, but is not an absolute guarantee of its absence from every query.

In Ask with web search, Bleanx may clean up and shorten your question when preparing a search query. The query transmitted to the search provider may therefore differ from your original question. In some cases, external search is not performed; enabling search does not mean that a search will be run for every question. This preparation does not guarantee anonymization or the absence of personal, confidential, or sensitive information from the transmitted query. Do not include personal or confidential information, including personal data about other people, in questions for web search.

When external search is performed in either scenario, the corresponding query is sent to the external search provider identified in Service Providers. The results and links received are used to perform the corresponding task and may then be processed by the selected AI provider to prepare the response.

This feature does not involve continuous background scanning of the business, creating a marketing profile, or maintaining an independent database of information about users or other individuals.

Independent Use of Search Queries

The search provider's applicable terms permit it and relevant providers involved in its search service to retain and use transmitted queries for their own research, service improvement, and model-training purposes. Bleanx discloses this before external search is enabled.

This exception is limited to the transmitted search queries themselves. It does not permit Bleanx to separately supply underlying Project materials, full AI context, or private histories for those purposes. It does not change the no-training restrictions applicable to the engaged AI model providers or authorize Bleanx itself to train models or independently develop products using user data.

A recipient's independent use is not treated as processing solely on instructions merely because the query was sent through the Services. Where a query contains personal data, Bleanx ensures the necessary lawful bases for disclosure, permissions, contractual safeguards, and international-transfer conditions.

Acceptance of the DPA or enabling search does not authorize a transfer incompatible with mandatory requirements. If the necessary conditions are not met for the personal data concerned, it is not transmitted through that flow. This does not relieve Bleanx of its own duties to minimize and protect data.

Withdrawal of Permissions, No Training and Retention

You may withdraw permission for external AI processing or external search through an accessible method to stop the corresponding future transmissions for actions you initiate. This does not, by itself, exclude your shared Project contributions from other authorized users' permitted AI actions, as explained in Section 5. Withdrawing search permission does not automatically withdraw AI permission; however, search in a supported AI scenario is not performed without both necessary permissions.

Refusal or withdrawal does not, by itself, delete the account, Projects, or saved content, or remove available rights to viewing, manual work, and export. Actions that require an absent permission are not performed.

Withdrawal does not automatically erase data already received by a provider. Applicable rights to erasure, restriction, and other data protection remain available. Bleanx fulfils its own obligations rather than placing all responsibility for requests on the user.

Bleanx does not use data from these actions to train or improve AI models or for independent product development, including after aggregation, de-identification, anonymization, or another transformation. Operational resource accounting and necessary technical logs are not an exception to this prohibition.

AI providers are engaged under contractual terms and settings that exclude model training and independent product development using the application data supplied. Optional data-sharing or feedback programs permitting such use are not enabled. Limited processing to provide the service, maintain security, prevent abuse, and comply with law remains subject to the applicable agreements and requirements.

A no-training restriction does not mean that a provider retains no data. Recipients, international transfers, retention periods, and deletion arrangements are described in the corresponding sections of this Policy. The narrow search exception applies only within the limits described above.

Payments, Subscriptions and Resource Accounting

Fulfilling Purchases and Providing Access: Bleanx uses the information described under "Payment, Billing and Resource Information" to arrange a requested purchase, verify confirmed payment, associate it with the relevant account, and provide the purchased access or separately purchased Usage Credits.

The information is also used to administer the Subscription, carry out cancellation and permitted re-enabling of recurring payments, provide a new Subscription purchased after an earlier one ends, process Apple-managed plan changes, track authorized renewal attempts and retries, resolve unpaid invoices and pending cancellation requests, apply confirmed payment events without duplicate entitlements, and correct errors in providing purchased entitlements. Necessary status checks enforce the one-paid-Subscription-per-account rule across web and Apple. There is no change of plan within an active direct web Subscription. Processing follows the purchase channel: direct web purchases through Stripe and purchases through Apple are not treated as a single payment process.

Bleanx acts as controller for its own administration of purchases and Subscriptions. Where the GDPR applies, processing personal data objectively necessary to perform a contract with the relevant user, or take steps at that user's request before entering into a contract, is based on Article 6(1)(b).

Authorization of recurring charges, acceptance of a price, or a plan change is not blanket consent to any use of personal data. Describing processing in this Policy does not authorize a charge, automatic top-up, or resumption of a Subscription beyond the applicable payment authorization and user-confirmation requirements under the Terms.

Necessary Accounting for Allowances and Usage Credits: Bleanx processes necessary information about the applicable plan, monthly period or one-time Welcome Allowance, the percentages remaining of the separate AI and web-search allowances, and the quantity and remaining balance of separately purchased Usage Credits.

Information about the initiating account, selected model, consumption category, and relevant action is used to check resource availability, account for consumption correctly, display the remaining resources, and verify a calculation when a user makes an inquiry. The prescribed related actions in the initially initiated operation are taken into account.

Consumption is attributed to the initiating user. It does not become the Project Owner's expense or shared Team consumption merely because the action concerns a collaborative Project.

Necessary accounting for the resources provided is part of performing the contract with the relevant user. It is operational processing, not analysis of interests, feature popularity, or behaviour for product development.

The need to verify a calculation does not, by itself, authorize retention of the entire Project, full AI context, or personal history as part of financial records. Data is limited to what is necessary for accounting and verification. The prohibition on Bleanx itself using data for model training or independent product development remains applicable, including after aggregation or de-identification.

Purchase Location and Tax Verification: For direct web purchases, Bleanx uses the information provided about country, Canadian province or territory, and billing address, together with necessary payment and technical information, including the IP address, within the verification described in Section 1.

The purposes of verification are distinguished: to establish that the purchase was made from a country or region available for direct purchase at that time, prevent improper payments, and determine the applicable tax treatment. Those availability rules do not automatically apply to purchases through Apple.

An IP address is not treated as conclusive evidence of usual residence. The user may correct information and request review of an erroneous purchase-eligibility determination. Verification does not involve continuous tracking of movements.

Where the GDPR applies, data necessary to arrange the requested purchase is processed on the contractual basis. Additional processing to prevent fraud is assessed separately under Article 6(1)(f), including necessity and the balance of interests and rights.

Processing to fulfil a specific tax or other mandatory obligation under applicable Union or Member State law is based on Article 6(1)(c). An obligation under United States law or another country's law outside the EU does not, by itself, establish that basis. A separate permissible basis is determined for the corresponding processing, including legitimate interests only where the conditions for that basis are met.

Refunds, Payment Disputes and Financial Records: Bleanx uses necessary information about the purchase, confirmed payment, service provided, relevant unused paid balance, previous refunds, and a dispute relating to the transaction to assess the claim, determine the amount due, and complete the settlement.

The process follows Sections 5–7, 12, and 18 of the Terms and applicable mandatory rights. Verification does not suspend mandatory time limits or require restoration of a deleted account. The percentage of AI or web-search use does not replace the calculation by duration of service provided for in the Terms when a user lawfully withdraws from a monthly Subscription.

Ordinary performance of a contractual claim, fulfilment of a specific statutory obligation, and processing for the establishment, exercise, or defence of legal claims each have their corresponding separate lawful bases. For the last purpose, legitimate interests are relied upon only where processing is necessary and proportionate and an appropriate assessment of the balance of rights has been made.

After completion of a purchase, cancellation of a Subscription, or account deletion, Bleanx retains only limited records necessary for settlements, mandatory financial and tax recordkeeping, or specific legal claims. Their scope and retention periods are determined separately under Section 7. The existence of a financial record does not authorize retention of all user materials and correspondence.

Access to this information is limited to the relevant task; it does not become shared Project content. The limited exception for Stripe's and Apple's independent processing of payment data retains its established boundaries and does not permit Bleanx itself to train models or independently develop products using application data.

Marketing and Purpose-Specific Consent

No Current Marketing Messages: Bleanx does not currently send marketing messages. Necessary service messages are processed under "Support, Service Communications and Related Records" and are not used to deliver advertising disguised as a mandatory notice.

If marketing communications are introduced, Bleanx will use necessary contact information for the particular disclosed communications only after the recipient gives separate, voluntary, specific, informed, affirmative consent. Where the GDPR applies, that processing is based on Article 6(1)(a).

Creating an account, making a purchase, contacting support, accepting the Terms or DPA, or granting AI or search permissions does not constitute marketing consent. Refusing marketing does not restrict account creation, support, purchases, or access to the Services.

Consent to receive messages does not authorize analysis of Projects, personal conversations, or resource-consumption histories to select advertisements. Nor does it authorize advertising tracking or disclosure of those materials to advertising partners.

Purpose-Specific Consent: Where Bleanx relies on consent for processing, before obtaining it Bleanx clearly explains the purpose, necessary categories of data, recipients, and how to withdraw consent. Consent is expressed through a separate affirmative action, not silence, a preselected checkbox, or merely continuing to use the Services.

Consent for one purpose does not automatically extend to another. If new or changed processing requires consent, Bleanx obtains the necessary consent before that processing begins. Merely adding a description to this Policy does not replace consent.

Acceptance of a contract, permission for a particular feature, and consent as a lawful basis for processing are distinguished. Separate permissions for external AI processing and search continue to operate under the rules already described in this Policy.

This subsection does not create a way to bypass the prohibition on Bleanx itself using data for model training or independent product development, or expand the agreed exceptions for external providers.

Withdrawal and Necessary Records: Consent may be withdrawn at any time, free of charge and by a method no more difficult than giving it. Withdrawal does not affect the lawfulness of processing carried out on the basis of valid consent before its withdrawal.

For any future marketing emails, each message will identify Bleanx and include a one-click unsubscribe option. Unsubscribing will not require account deletion, Subscription cancellation, or mandatory contact with support. Contacting support@bleanx.org remains an additional way to communicate your choice.

After an unsubscribe request, Bleanx stops the corresponding marketing processing. Necessary service messages and processing for other independent purposes may continue on the applicable lawful bases described in this Policy, but may not be used to circumvent the unsubscribe request.

Bleanx retains only necessary records to demonstrate that consent was given and to give effect to its withdrawal: the purpose to which the choice related, when it was expressed or withdrawn, and the action by which that occurred. The lawful bases and retention periods for those records are determined separately under Section 7; the records do not authorize indefinite retention of a person's entire behaviour history or account content.

De-identification, Aggregation and Limits on Use

No Additional Purposes or Rights: Removing identifiers, pseudonymizing, aggregating, anonymizing, or otherwise transforming data does not, by itself, create a new processing purpose or give Bleanx additional rights to use the original or transformed information.

The prohibition on Bleanx itself using data to train, fine-tune, or improve AI models, or for independent research and product development, also applies to information derived from such transformations. That information is not used to circumvent the prohibition on analyzing user behaviour or feature popularity for product development.

The narrowly scoped exceptions for independent processing of search queries, payment data, and service email-delivery data by the relevant providers apply only within the limits already described. Transforming data does not expand the recipients, data categories, or purposes covered by those exceptions, or give Bleanx itself equivalent rights.

When Information Remains Personal Data: Removing a name, replacing it with a code, or combining records does not, by itself, establish that the information is anonymous.

If, in the relevant processing, Bleanx can identify an individual directly or indirectly using means reasonably likely to be used, including available additional information, Bleanx continues to treat that information as personal data.

Anonymity is assessed by the actual possibility of identification in the particular processing circumstances, not by the name of a technical method or a system label. While information remains personal data, the applicable requirements concerning lawful bases, access, protection, retention, and the exercise of individuals' rights continue to apply.

Even where information has genuinely ceased to be personal data, this does not remove the restrictions on use established by the Terms and this Policy, rights in materials, or applicable confidentiality obligations.

Permitted Operations, Protection and Deletion: Where such transformations are used, they are performed only to the extent necessary for the operational purposes already described and permitted, subject to the corresponding lawful basis and, for processing on instructions, documented instructions and the applicable DPA.

This block does not authorize retention of an entire Project, personal history, or correspondence for possible future de-identification. Transforming data is not a general basis for extending retention or replacing erasure that Bleanx is required to perform. The applicable retention and deletion rules remain in effect.

Bleanx does not attempt to identify anonymous users or reconstruct their profiles from data presented as anonymous, aggregated, or otherwise non-identifying, or assist others in doing so.

Transforming materials does not transfer ownership of them to Bleanx, authorize their publication or disclosure for third parties' independent purposes, or expand other users' access.

Essential Technologies and Account Access Across Devices

Necessary Technologies and Their Purposes: Bleanx uses the technical information and essential storage described in Section 1.B to process requests, provide authenticated access, maintain the operation and security of the Services, and resolve technical failures.

In the web application, localStorage is used for sign-in and maintaining an authenticated session. This technology is not used for analytics, advertising, or tracking behaviour on other websites. The categories of data, storage purpose, and available controls are described under "Essential Browser Storage".

Necessary technical processing remains limited to the corresponding operational purpose and applicable lawful basis described in this Section. Labels such as "performance" or "functionality" do not create additional permission to study user behaviour, train models, or independently develop products using application data.

No Analytics or Advertising-Related Device Matching: Bleanx does not use visitor or user-behaviour analytics on bleanx.com or in bleanx.ai, including Google Analytics or Webflow Analyze, or use cookies, pixels, or similar technologies for analytics or advertising tracking.

Bleanx does not match your activity on third-party websites or other parties' applications across devices to create an advertising profile, or engage technology partners to carry out such matching.

When you sign in to the same Bleanx account from different devices, information is associated with that account to provide authorized access to its data, features, Subscription, and resources. This is account functionality, not advertising tracking. Signing in from another device does not expand access rights to Projects, other users' private conversations, or other restricted data.

Necessary security checks and resource accounting retain their separate purposes and limits. They are not used as a hidden substitute for analytics or advertising profiling.

Essential Storage Does Not Replace Other Permissions: Where applicable rules on storing information on a device permit an exemption from prior consent, Bleanx relies on it only for storage or access strictly necessary to provide a service expressly requested by the user. The exemption does not extend to unrelated purposes and does not arise merely because localStorage is used instead of a cookie.

An exemption from consent for essential storage does not remove the duties to explain the processing clearly and ensure an appropriate lawful basis, safeguards, and limited retention of personal data.

Signing in and using essential storage do not replace separate permissions to transmit data to external AI providers or search, or consent to any future marketing messages. Management of locally stored browser data and the consequences of deletion are described in Section 1.B. Deleting such data does not, by itself, delete an account or cancel a Subscription.

_3. Disclosing Your Information

Recipients and Service Providers — Scope and Safeguards

Purpose-Limited Disclosure: Bleanx discloses personal data within the purposes, lawful bases, and circumstances described in this Policy. Each recipient receives only the information necessary for the corresponding operation. Naming a recipient or category of recipients does not mean that all user data is disclosed to each of them.

To provide the Services, Bleanx engages providers of cloud infrastructure and data storage, authentication, AI generation and external search, payments, service email and support, and necessary technical maintenance and protection. Their involvement is limited to the functions they actually perform and the corresponding categories of data.

Disclosure does not expand the permitted AI context, access to Projects and personal content, or rights to use materials. Separate permissions for external AI processing and search remain required under this Policy; listing providers or accepting the Terms or DPA does not replace those permissions.

The general category of service providers does not authorize disclosure for advertising, behavioural analytics, model training, or product development contrary to this Policy and the Terms.

Processing on Instructions and Recipients' Own Purposes: Where a provider processes personal data on Bleanx's behalf, that processing is governed by binding contractual terms and documented instructions within the relevant task.

Where Bleanx itself processes data on behalf of the appropriate controller, engaging another processor is subject to the applicable DPA, the necessary controller authorization, and the prescribed notice and objection procedure. A general list of providers in this Policy does not replace those requirements.

A recipient's role is determined for the particular processing, not merely by the name of the company or service. The same recipient may perform different functions; holding those roles does not authorize transfers of data or permissions to use it between those functions.

Processing for a recipient's own purposes is not treated as processing solely on instructions. It is described separately and remains limited to the corresponding data, purposes, and applicable requirements. The narrowly scoped exceptions for search queries, payment data, and service email-delivery metadata retain their previously stated boundaries.

Neither a provider's own terms nor its inclusion in a list gives Bleanx itself permission to train models or independently develop products using application data.

Provider Safeguards and Bleanx's Responsibilities: Bleanx engages processors that provide sufficient guarantees of appropriate personal data protection. Binding terms cover the confidentiality of authorized persons, limits on access and purposes, security, engagement of further processors, assistance with individuals' rights and incidents, and return or deletion of data where applicable.

When sharing user data with engaged providers, Bleanx ensures protection equal to that provided by this Policy and required under applicable Apple rules. A reference to a recipient's policy does not, by itself, replace necessary contractual and technical safeguards.

Engaging a provider does not relieve Bleanx of its own obligations or liability under applicable law and the Terms. The recipient's own obligations also remain in effect.

International transfers, retention periods, and deletion remain subject to the corresponding sections of this Policy, applicable agreements, and law. Naming a provider does not mean that it retains no data, processes data in a particular region, or erases all its records at the same time as a Bleanx account is deleted.

Error Reporting — Sentry

Bleanx uses Sentry, provided by Functional Software, Inc., for reports about technical errors in bleanx.ai. Sentry receives and stores the error reports and associated technical information necessary for diagnosis and correction, subject to the minimization and access restrictions in Section 1.B. This integration concerns only the web application; it does not cover the macOS application or the public website at bleanx.com. Session Replay, recording users' actions and behavioural analytics are not used.

Sentry processes the entrusted reports on Bleanx's behalf. For Bleanx's own organization of operational diagnosis, Bleanx acts as controller. To the extent a diagnostic operation involves Covered Personal Data processed on the appropriate controller's documented instructions, Sentry is a subprocessor for that operation under the applicable DPA. The diagnostic role does not give Sentry general access to Projects or personal histories or create a new exception for model training or independent product development.

The selected storage region for these reports is the United States, as described in Section 4. Binding processing terms, international-transfer safeguards, retention and deletion remain subject to this Policy and the applicable DPA. Naming Sentry does not replace those requirements or authorize unnecessary disclosure.

Service Email Delivery — Resend

Bleanx has selected Resend, provided by Plus Five Five, Inc., to deliver service emails on Bleanx's behalf. These include confirmations of Subscription cancellation, acknowledgements of withdrawal from a contract, confirmations of acceptance of a price or the Terms of Use, notices of changes and security, decisions on complaints, and the applicable annual California notice described in Section 21 of the Terms of Use.

For this delivery, Resend receives the recipient's email address, including an Apple-provided private relay address where supplied, the service message, and only the account, purchase, or complaint-related information necessary for that message, together with necessary technical delivery information. These service emails do not contain Project materials. Providing data for delivery does not give Resend general access to the recipient's Projects, private AI histories, or other account content.

Resend uses Amazon Web Services infrastructure, including Amazon Simple Email Service (Amazon SES), for email delivery. AWS is involved through Resend's processing chain; this description does not mean that Bleanx directly engages AWS for this email-delivery service.

Bleanx determines the purposes of these account, contractual, security, and complaint-related communications and acts as controller for the corresponding processing. Resend processes the information entrusted for delivery on Bleanx's behalf. That operation is distinct from processing customer content on instructions under the DPA. Any processing for a recipient's own purposes is separately qualified according to the actual processing and applicable law, within the limited exception below.

Limited Use of Email Delivery Data: Resend and the infrastructure providers involved in its email-delivery chain, including Amazon Web Services / Amazon SES, may process service delivery data under their applicable terms and privacy notices, including for operating and optimizing their email-delivery services, subject to applicable law. This exception is confined to sender and recipient addresses, delivery statuses, bounces and delivery failures, and technical transmission metadata. It is not a general exception for every category a provider calls usage data or service data.

The exception does not authorize reuse of email subjects, bodies, attachments, or information extracted from that content beyond processing necessary for delivery. It does not extend to Project materials, User Content, Output, personal Ask or AI Dialogue content, direct messages, or Bleanx's allowance and consumption records, including transformed information derived from those materials or records. The listed sender and recipient addresses are delivery metadata, not permission to inspect or reuse the underlying correspondence for independent optimization, model training, or product development.

This exception does not permit Bleanx itself to train models or independently research, develop, or improve products or features using application data. It does not authorize marketing, tracking recipients' email opens or clicks, or unrelated profiling. Bleanx's own obligations concerning lawful disclosure, minimization, confidentiality, security, international transfers, retention, and individuals' rights remain applicable. A reference to provider terms does not replace a required lawful basis, permission, or binding processing arrangement.

Support Mailbox — Google Workspace (Gmail)

Bleanx uses Google Workspace (Gmail) to host support@bleanx.org. This mailbox receives support inquiries, complaints, refund requests, requests for access to or deletion of data and account deletion, arbitration opt-out notices, statements of withdrawal from a contract, and voluntary bug reports. Google processes the sender's contact details, email addresses, necessary message headers and transmission information, the correspondence, and attachments supplied to that mailbox to provide the mailbox service on Bleanx's behalf.

Unlike the outbound service emails described above, a support inquiry or attachment may contain Project materials or other personal data that the sender supplies to explain the matter. Only materials supplied or otherwise lawfully required for handling the inquiry are processed for that purpose; using the mailbox does not give Google general access to the sender's Bleanx account, all Projects, or private AI histories. The limits under "Your Communications with Us", including the restrictions on voluntary bug reports, remain applicable.

For Bleanx's own administration of support, complaints, and contractual or statutory notices, Bleanx acts as controller and Google provides the relevant mailbox processing on its behalf. To the extent a particular support operation involves Covered Personal Data processed on a customer's documented instructions, the applicable DPA and subprocessor requirements also apply to that operation. The applicable Google Workspace processing agreement, including the Cloud Data Processing Addendum, governs entrusted mailbox processing; it does not remove Bleanx's own obligations or individuals' rights.

Google's role as the support-mail provider is separate from its roles as an AI-model provider and a sign-in provider. Sign-in through Google does not give Bleanx access to the user's Gmail mailbox. The Resend delivery-data exception does not extend to Google Workspace or the contents of support correspondence. Use of this mailbox does not authorize Bleanx to use correspondence or attachments for model training or independent product development, or to introduce additional AI or other processing inconsistent with the Terms and this Policy. Retention, deletion, and international transfers remain subject to the corresponding provisions of this Policy and applicable law.

No Disclosure for Advertising

Bleanx does not disclose personal data to advertising networks or other advertising partners to promote Bleanx or third-party products or services, to retarget individuals based on their use of the Services, to create advertising audiences, or for advertising profiling.

If Bleanx introduces marketing communications in the future, separate consent to receive those communications will not, by itself, authorize disclosure of data to advertising networks, tracking of the user, or analysis of their Projects, private correspondence, or consumption history to select advertising. The limits in Section 2 apply.

This provision does not prevent necessary processing by the disclosed providers for authentication, infrastructure, AI, search, payments, email, and support. The narrowly scoped exceptions for search queries, payment data, and service email-delivery metadata retain their established boundaries. They do not give Bleanx permission to disclose data for advertising purposes or itself use application data for model training or independent product development.

We may disclose your information to other third parties, including other users, in the following circumstances:

Sharing with Other Users and Access Boundaries

Project Access: Bleanx makes Project content available to its owner and other authorized users in accordance with their roles, individually granted permissions, and Project settings. The Project Owner grants, changes, and revokes Team participants' and Reviewers' access and determines which Contours are accessible to each of them.

Materials contributed to a shared Project, including saved Output and any personal data they contain, are accessible to the relevant participants within those rules. Contributing material to a Project does not give access to its author's entire account, other Projects, or personal content.

Information about participation, roles, and supported Journal events is disclosed only within the scope of the relevant feature and the visibility rules described in Section 1. A Reviewer does not receive access to the shared Project Journal. The fact that Bleanx processes information about a participant does not make all of that information available to the others.

Direct access to an underlying Contour and information in an available AI result are distinct. As described in Contextual Use of Project Information, available Output and summaries may reflect information from Contours that are not accessible to the participant. This does not provide direct access to those Contours or override limits on processing and disclosure of personal data.

Shared access is not public publication of a Project. Bleanx does not provide anonymous access to Project content to an indeterminate group of people.

Personal AI Interactions and Direct Messages: Personal Ask and AI Dialogue content, including saved questions and responses, is not disclosed to the Project Owner, Team participants, or other Reviewers merely because of their role or participation in the same Project.

Among users, direct Dialogue messages are accessible to the sender and intended recipient. If the Project Owner participates in the correspondence, they access it as a participant, not by virtue of owning the Project.

If a user intentionally contributes material from a personal interaction as Project content, the Project access rules apply to the contributed material. The remaining personal history does not become shared content.

These provisions govern access between users. They do not exclude necessary and proportionate processing by Bleanx and engaged providers for permitted operational tasks, support, security, and compliance with law, but only within the purposes, lawful bases, and safeguards of this Policy.

Changes to Access and Limits on Further Use: Changing or revoking permissions limits further access through the Services to the corresponding extent. Ending participation in a Project does not, by itself, delete earlier contributions or reverse the allocation of rights in materials that has already taken effect. The effects of deleting a Project or account and permissible retention are governed separately by the Terms and the retention and deletion provisions of this Policy.

Revoking access does not automatically delete copies that a recipient previously obtained lawfully, for example through permitted export. This does not give the recipient a right to retain, use, or disclose those copies contrary to the Terms, confidentiality obligations, or applicable law.

Access or export does not transfer ownership of materials to the recipient or, by itself, authorize their independent commercial exploitation, publication, or licensing.

A work email address, shared email domain, employment relationship, or users' affiliation with the same organization does not give that organization or its personnel automatic access to a user's account, Projects, personal interactions, or purchases.

Granting Project access does not replace a lawful basis required to disclose personal data about individuals mentioned in the materials. A user's obligations do not relieve Bleanx of its own obligations; controller and processor roles are determined for the particular operations, as described in Section 2 and the applicable DPA.

Invitations and Access Requests

Personal Invitations and Requests: A Project Owner with active paid-plan access may invite a new Team participant under Sections 2 and 5 of the Terms. The owner enters the intended recipient's email address and receives an invitation link to share with that person directly. This process does not involve Bleanx automatically sending an invitation email.

Bleanx processes the specified email address, the association of the invitation with the Project and its owner, the invitation's status, and the information necessary to verify it and match it to the appropriate account.

The recipient uses their own account and an available sign-in method. If they do not yet have an account, they complete the ordinary registration process. Creating an invitation does not create an account for the recipient or constitute their acceptance of the Terms.

Before a user joins another person's Project, Bleanx displays the Project Owner's name in the joining interface to identify the owner. Acceptance of the contribution-rights rules takes place at registration as described in Section 1 of the Terms; no separate confirmation of those rules is requested at joining.

Team participation begins after the relevant user successfully accepts the invitation. In the Reviewer scenario, an authenticated user submits a personal access request; access to Project content begins only after the Project Owner accepts the request and only within the granted scope. A Project Owner on Explorer cannot issue new Team invitations. Reviewer requests may be accepted on all plans, including Explorer. The owner's move to Explorer does not itself revoke the access of previously admitted Team participants or Reviewers or erase their Project-related personal AI Dialogue histories. The capability to issue new Team invitations becomes available again with the owner's active paid-plan access. Existing roles, permissions, and the separate effects of actual revocation or loss of access remain governed by the Terms.

An invitation or access-request link is not public access to a Project and does not replace authentication or the granting of the relevant access rights.

Profile Information Visible to the Project Owner: When the Project Owner enters another person's email address to create an invitation, the owner sees only the email address they entered, not the name or profile image of the corresponding Bleanx account. The name and profile image become available to the Project Owner only after that user accepts the Team invitation or submits a Reviewer access request.

At that point, Bleanx provides the Project Owner with the information necessary to identify the participant or consider the request: the email address associated with the action, the profile name, and the profile image if supplied.

Before the user accepts the invitation or submits the request, Bleanx clearly explains which information will become available to the Project Owner. Submitting a Reviewer request may disclose that information to the owner for consideration, but does not, by itself, give the applicant access to Project content.

Further visibility to other participants is governed by the shared-access rules. Accepting an invitation or submitting a request does not disclose personal AI conversations, private correspondence, purchases, or the user's other Projects.

Invitee Data and Rights: A user providing another person's contact details must have an appropriate lawful basis and the necessary authority to provide them and permit their intended use, including consent where required by applicable law.

Bleanx uses invitation and access-request information for the corresponding access process and necessary associated operations, not to create a marketing contact database. Receiving an invitation, submitting a request, or joining a Project is not consent to marketing and does not replace separate permissions for external AI processing and search.

The inviting user's responsibilities do not replace Bleanx's own obligations. Where applicable, Bleanx ensures that the individual receives the information required about personal data obtained from another source, including the source, processing purposes, recipients, and available rights, within the required periods and subject to lawful exceptions.

An individual may contact support@bleanx.org about their personal data without creating an account or accepting an invitation. Information about expired, revoked, or unaccepted invitations is retained only to the necessary extent and for a justified period under this Policy's retention rules.

Legal Requests and Protection of Rights

Requests from Authorities and Mandatory Disclosure: Bleanx may disclose necessary information to a competent court, government authority, or supervisory authority where disclosure is required or permitted by applicable law and the corresponding legal conditions are met.

Before disclosure, Bleanx verifies the authenticity of the request, the requesting authority's powers, the lawful basis, scope, and applicable time limits. Receiving a request, including a law-enforcement or national-security request, does not automatically result in access to data.

Where applicable law requires reporting identified circumstances, including legally specified cases of suspected criminal offences involving a threat to the life or safety of individuals, Bleanx provides the required information to the necessary extent and within the required periods.

A suspicion, complaint, or breach of the Terms does not, by itself, mean that all account data must be disclosed to authorities. Access to materials and disclosure are limited to the corresponding lawful basis and task.

Protection of Rights, Safety and Legal Claims: Bleanx may disclose information relevant to a particular matter where necessary and proportionate to protect individuals' rights or safety, protect the Services, prevent fraud, or establish, exercise, or defend legal claims.

Recipients may include competent authorities, courts, engaged professional advisers, and participants in the relevant proceedings, but only within their task, the applicable lawful basis, and procedural requirements. Professional advisers receive access subject to appropriate confidentiality obligations.

Where possible, the task is carried out using relevant records, extracts, or materials from which excessive information has been removed, rather than disclosing the entire account, all Projects, or private correspondence.

Protection of a payment claim concerns only amounts that may actually be due under the contract and law. This block does not create a new debt, turn uncovered AI or search consumption into indebtedness, or provide general authorization to disclose the user database for debt collection.

Lawful Bases and Requests from Foreign Authorities: Where the GDPR applies, the lawful basis is determined for the particular disclosure. Compliance with an obligation laid down in Union or Member State law falls under Article 6(1)(c). Necessary protection of rights, fraud prevention, and the establishment, exercise, or defence of legal claims may be based on Article 6(1)(f), following an assessment of necessity and the balance of interests and individual rights.

Article 6(1)(d) applies only where necessary to protect an individual's vital interests, not merely Bleanx's commercial interests. For special categories of personal data and data relating to criminal offences, the applicable conditions of Articles 9 and 10 are also met.

A foreign authority's request does not, by itself, replace the lawful basis for processing or the conditions for an international transfer. Where the GDPR applies, Bleanx separately assesses the requirements of Chapter V, including Article 48. A reference in a request to foreign law or national security does not remove that assessment.

Where Bleanx processes data on instructions, its applicable obligations to the appropriate controller and the DPA requirements also remain in effect. This block does not give Bleanx a general right to disregard documented instructions.

Notice, Limited Retention and Preserved Rights: To the extent permitted by law and possible without missing a mandatory compliance deadline, Bleanx gives the affected user prior written notice of required disclosure and a reasonable opportunity to seek protection or contest it. Applicable mandatory notification rules, prohibitions, and exceptions remain in effect. When processing on instructions, Bleanx also provides the required notices to the appropriate controller.

Bleanx takes reasonable measures to limit disclosure and preserve confidential treatment of the materials supplied. Participation in proceedings does not automatically entitle a person to receive the entire complaint, all attachments, or other individuals' contact details.

Records of a request, its assessment and disclosure, and materials necessary for a particular legal claim are retained to a limited extent and for a justified period. The grounds for continued retention are reviewed; when they cease to apply, the applicable deletion rules take effect. The possibility of a future dispute does not, by itself, authorize indefinite retention of the entire account.

These provisions do not authorize model training, independent product development, or advertising use of data, expand the agreed provider exceptions, or limit Bleanx's own liability or individuals' mandatory rights.

Business Transactions and Continuity of Data Protection

A Specific Transaction and Necessary Disclosure: If Bleanx is involved in a merger, acquisition, financing, reorganization, sale of its business or part of it, or a corresponding insolvency proceeding, personal data may be disclosed only to the extent necessary for the specific lawful transaction, on an appropriate lawful basis and in compliance with applicable requirements.

Recipients may include relevant prospective or actual acquirers, investors, their professional advisers, and authorized participants in the proceeding. Participation in negotiations or an interest in Bleanx does not, by itself, give them access to all user data.

This block does not authorize the standalone sale of the user database, Project materials, personal conversations, or consumption history for advertising, model training, development of third-party products, or other incompatible purposes.

Due Diligence and Access to User Materials: During pre-transaction due diligence, Bleanx primarily uses information about the company itself and the minimum relevant documents and extracts, limiting disclosure of personal data and removing excessive information.

Project materials and personal content are not provided to a prospective buyer or investor merely because that person wishes to assess Bleanx's business. Any necessary access is assessed separately in light of rights in materials, confidentiality, the lawful basis for processing, and the applicable DPA. A non-disclosure agreement does not, by itself, create a right of access.

Data that Bleanx processes on behalf of another controller is not used for independent transaction-review purposes in circumvention of documented instructions or contractual restrictions.

Recipients of due-diligence materials are given access only for the relevant task, subject to necessary confidentiality and security safeguards. Copies are returned or deleted when they are no longer needed, except for limited retention on a separate lawful basis.

Continuity of Protection and Rights: If, as a result of the transaction, provision of the relevant Services and processing of data pass to another legal entity, Bleanx ensures that the transfer is properly documented and that applicable obligations concerning data protection, confidentiality, and limits on purposes of use are preserved.

The transaction does not, by itself, remove the prohibition on model training and independent product development using application data, expand the narrowly scoped provider exceptions, or give the recipient additional rights in user content.

A buyer of Bleanx's business does not become the owner of User Content or Output merely as a result of that purchase. The allocation of rights in materials and individual access permissions remain governed by the applicable Terms.

International transfers, processing on instructions, the engagement of subprocessors, retention, and deletion remain subject to the corresponding requirements and agreements. A change in service provision does not restart a retention period or permit restoration of data that must be deleted.

Information, Required Consent and Separate Export Procedures: When the responsible operator or the relevant processing arrangements change, Bleanx and the new responsible operator provide affected individuals with the required information within the applicable periods, including who processes the data, how to contact them, what data is transferred, for which purposes, and how to exercise their rights.

Where consent is required for a transfer or change in processing, it is obtained before the relevant action. General wording in this Policy, notice of the transaction, or continued use of the Services does not replace required consent.

This block is not independent consent by the user to transfer their contract to another person. Requirements for transferring contractual rights and obligations and changing the Terms are assessed separately under the contract and applicable law.

Available rights to obtain data, export, delete an account, cancel a Subscription, and receive refunds remain governed by the Terms and mandatory law. A business transfer does not mean that the user has requested switching to another service or deletion of data.

Export and switching to a provider selected by the user are governed separately by Sections 1 and 12 of the Terms, not by this block concerning business transactions.

_4. International Data Transfers

International Processing and Its Limits: Bleanx Inc. is a company incorporated in the United States. In providing the Services, personal data may be processed outside the country in which an individual is located in connection with Bleanx's operations and the recipients described in Section 3.

That processing is limited to the corresponding purposes, data categories, and authorized operations. Describing international processing does not authorize disclosure of any data to any recipient or unrestricted selection of processing countries.

In determining the arrangements for international processing, Bleanx takes account of the actual locations of data storage and processing, backup copies, and remote access. A provider's place of incorporation or the location of one server does not, by itself, identify the entire processing geography.

International processing does not expand Project access rights, permissible AI context, or permissions to use materials. Separate permissions for external AI processing and search remain required.

Safeguards for the EEA, United Kingdom and Switzerland: Bleanx is not certified under the EU-U.S. Data Privacy Framework, its UK Extension, or the Swiss-U.S. Data Privacy Framework, and does not rely on its own participation in those frameworks as a basis for transfers.

Where a transfer is subject to specific international-transfer restrictions, the required conditions are met before it begins. If the transfer is not covered by an applicable adequacy decision, an appropriate binding contractual or other legally permitted mechanism is used.

For transfers subject to Chapter V GDPR, this may include the applicable European Commission standard contractual clauses where they are legally eligible, or another permitted Article 46 mechanism with any required approvals. Clauses under Decision (EU) 2021/914 are not relied on outside their legal scope, including where the importer's relevant processing is already directly subject to the GDPR and those clauses are not an eligible transfer instrument. An alternative mechanism must then be established, including any required supervisory-authority authorization for individually agreed clauses.

A restricted transfer under UK law requires an appropriate UK mechanism, such as the applicable International Data Transfer Agreement or UK Addendum to eligible EU standard contractual clauses, with the necessary assessment and safeguards. EU clauses alone do not satisfy that requirement. For transfers governed by Swiss law, an eligible mechanism under the Federal Act on Data Protection is used, such as recognized standard contractual clauses with the necessary Swiss adaptations and safeguards.

The mechanism is selected for the particular exporter, importer, their roles, and processing operations. It must cover the corresponding data and onward transfers, with the required information and annexes completed and binding on the correct parties. The choice of Delaware law in the Terms does not displace mandatory provisions of an applicable transfer instrument or individuals' rights under it.

A provider's public contract page, a general reference to standard contractual clauses in this Policy, or a user's acceptance of the Terms does not, by itself, establish that the required transfer instrument has been executed or is applicable.

Assessment and No Blanket Consent to Unprotected Transfers: When relying on contractual safeguards, Bleanx conducts the required assessment of transfer conditions, including relevant destination-country laws and practices, possible access to the data, and the parties' ability to fulfil their obligations. Supplementary technical and organizational measures are implemented where necessary.

A contractual promise alone is insufficient where the required protection cannot be ensured in the particular circumstances. In that case, the affected transfer does not begin or is suspended, and further processing, return, or deletion is arranged lawfully.

Accepting the Terms, DPA, or this Policy, holding an account, selecting an AI model, or granting AI or search permission is not blanket consent to transfer data without the required safeguards. Derogations for specific situations are not used as a routine substitute for the mechanism required for ordinary service operations. Where a statutory derogation applies, its particular conditions must be met.

For processing on instructions, documented instructions, the applicable DPA, and subprocessor requirements remain in effect. An international transfer does not create an additional exception to the restrictions on model training, product development, or retention.

Transfer Information and Copies of Safeguards: Bleanx discloses the countries or territories, recipients, and protection mechanisms relevant to the corresponding processing in this Policy and associated recipient information.

You may contact support@bleanx.org to obtain information about transfers applicable to your data and a copy of the relevant contractual safeguards. An account is not required. Trade secrets, other individuals' data, and sensitive security details may be protected when documents are supplied, but such restrictions are not used to conceal the substance of the applicable safeguards.

International processing does not remove applicable rights of access, rectification, erasure, restriction, objection, or complaint. Foreign-authority requests are handled under Legal Requests and Protection of Rights, rather than being fulfilled automatically merely because data is located abroad.

Service Providers and Processing Locations

Service Providers is Bleanx's single public provider register on bleanx.com, accessible with this Policy. It identifies the providers, their separate roles, functions and relevant data, and processing locations and geographic limits, including the selected application, email and diagnostic regions. The applicable version also forms part of DPA Schedule C. Bleanx retains prior versions and records the version and effective date relevant to the processing arrangement.

Service Providers register: Service Providers 2.0

A primary deployment or sending region does not determine every backup, technical record, onward-processing or remote-access location. The register does not enlarge the purposes, access permissions or independent-use exceptions in this Policy and the Terms. Bleanx ensures the required binding processing arrangements and transfer safeguards for the actual operations under this Section and DPA Schedule D.

Adding or replacing a subprocessor follows DPA Section 6, including written notice at least 14 calendar days before the proposed subprocessor first processes the affected data and the applicable objection procedure. Updating the register alone does not replace that notice. Changes to purposes, permissions or other contractual and privacy rules remain subject to their own notice, acceptance and consent requirements, including Section 14 of this Policy and Section 22 of the Terms.

Remote Administrative and Support Access

Authorized Bleanx personnel and engaged contractors may remotely access personal data from different countries, but only to the extent necessary to perform an authorized operational, support, security, or compliance task. Access is limited according to responsibilities and need, subject to appropriate confidentiality obligations and technical and organizational security measures.

The location of Bleanx’s primary infrastructure does not mean that administrative or support access is available only from the United States. Where access by a contractor acting as a separate recipient, including a separate legal entity, constitutes an international transfer, the applicable transfer requirements and safeguards in this Section also apply. Where the contractor acts as a processor or subprocessor, the applicable processing agreement, instructions, and authorization requirements remain in effect.

Remote access does not expand permitted purposes, Project access rights, or rights to use content. This description does not limit any information about recipients, destinations, or safeguards that Bleanx must provide under applicable law.

Relationship to Transfer Safeguards

The locations described above do not, by themselves, establish a lawful transfer mechanism. Restricted transfers associated with these operations remain subject to the applicable safeguards described in this Section and, where relevant, the DPA. Provider documentation and contractual arrangements do not expand Bleanx’s permissions to use data or remove its own obligations.

You may contact support@bleanx.org for information about transfers relevant to your personal data and copies of the applicable contractual safeguards, subject to the proportionate protections described above. This contact route supplements, rather than replaces, information that must be provided proactively under applicable law.

_5. Your Choices

Managing Your Choices and Permissions

Available Controls and Support

You may manage the settings and permissions provided by the Services through the corresponding features. Before you give permission, Bleanx clearly explains the relevant processing, the information transmitted and its recipients, and the consequences of refusal or withdrawal.

Contacting support@bleanx.org is an additional way to communicate your choice, obtain assistance, or exercise applicable rights. It is not a mandatory preliminary step for using the available settings or self-service features.

Creating an account or accepting the Terms does not replace separate permission or consent where required. Not having an account does not prevent you from contacting Bleanx about your personal data.

Feature settings, consent as a lawful basis for processing, and rights under personal data protection law serve different purposes. A choice in one of these processes is not automatically treated as a choice in all the others.

Separate Permissions for External AI and Search

Your personal AI permission governs external processing for actions you initiate. Data may be transmitted to an external AI provider for such an action only while your permission is active. Refusing or withdrawing it stops the corresponding future transmissions for your actions, but does not turn off AI for other users of a shared Project. Shared Project content, including your contributions, may remain permitted context for AI actions initiated by other authorized users with the necessary active permissions of that initiating user. The context limits in Section 1 apply; joining a Project does not, by itself, make private histories or correspondence shared context.

You may withdraw the relevant permission through an accessible and understandable method to stop the corresponding future transmissions for actions you initiate. Withdrawing search permission does not, by itself, withdraw AI permission. External search in a supported AI scenario requires both active permissions: external AI processing and external search. Search does not take place if either required permission is absent.

Refusal or withdrawal limits the actions requiring the missing permission. It does not, by itself, delete your account, Projects, or saved content, or prevent available viewing, manual work, and export within your access rights.

Withdrawing permission does not automatically cancel a Subscription, constitute a refund request, or delete your account. Those actions follow their separate features and the Terms, without limiting mandatory rights.

Withdrawal does not mean automatic destruction of data already transmitted to a provider. These personal feature settings do not remove applicable rights to erasure, restriction, objection, withdrawal of consent, or other personal data protection. Bleanx fulfils its own obligations and assists with the relevant requests within its processing role. You do not need to restore a deleted account to contact Bleanx about your personal data.

Withdrawal of Consent, Objections, and Other Lawful Bases

Where processing is based on consent, you may withdraw that consent at any time, free of charge and by a method no more difficult than giving it. Where consent was given through the interface, Bleanx does not require you to contact support to withdraw it. Withdrawal does not affect the lawfulness of processing based on valid consent before its withdrawal.

After withdrawal, Bleanx stops the processing based on that consent. Other independent processing operations may continue only with their own applicable lawful basis, for an already disclosed purpose, and to the extent necessary. This does not allow Bleanx to circumvent withdrawal merely by relabelling the same processing or relying on a general provision of the Terms.

Where the GDPR applies and processing is based on legitimate interests, you may object on grounds relating to your particular situation. Bleanx stops that processing unless it demonstrates compelling legitimate grounds overriding your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defence of legal claims.

Bleanx retains only the information necessary to demonstrate the giving of permission or consent and to give effect to its withdrawal, including the relevant purpose, choice, date, and action. The scope, lawful bases, and retention periods for those records are determined separately; this is not permission to retain a complete behavioural history or all account content.

Neither consent nor a change of settings creates an exception to the prohibition on Bleanx's use of data for model training or independent product development. Applicable rights and request procedures are also described in Section 6, and retention and deletion in Section 7.

Email Communications

Necessary Service Emails: Bleanx currently sends only messages necessary to provide, administer, and protect the Services. These may concern your account and security, purchases and payments, your Subscription, support inquiries and complaints, changes to terms, and mandatory notices.

These messages do not depend on marketing consent. While your account or Subscription remains active, you cannot opt out of genuinely necessary service messages, except where applicable law or the rules of the relevant platform provide for an opt-out or other choice. Merely labelling a message as "service-related" or "non-promotional" does not make it necessary or permit circumvention of the rules for marketing communications.

Marketing Consent: Bleanx does not currently send marketing messages. If it introduces such communications, they will be sent only after separate, voluntary, specific, informed consent expressed by an affirmative action. Creating an account, accepting the Terms, making a purchase, contacting support, or submitting a complaint or bug report does not constitute that consent. Marketing consent is not a condition of obtaining support, creating an account, or making a purchase.

Unsubscribing: Each marketing email will clearly identify Bleanx as the sender and provide an understandable, free, one-click unsubscribe option. You will not need to sign in, explain your reasons, or contact support to use it. You may also withdraw marketing consent or communicate your decision to unsubscribe at any time through support@bleanx.org. Bleanx stops the corresponding marketing communications and gives effect to any applicable right to object to processing for direct marketing. Where Article 21(2) and (3) GDPR applies, that objection requires no explanation of personal circumstances or balancing of interests, and the data is no longer processed for that direct-marketing purpose.

Effects of Unsubscribing: Unsubscribing from marketing does not limit your access to the Services or the handling of your inquiries, cancel your Subscription, or delete your account. It does not stop necessary service messages that Bleanx is entitled or required to send, subject to mandatory user rights. Subscription cancellation and account deletion follow their separate procedures under the Terms.

App Notifications and Device Settings

Managing Notifications

In Bleanx applications actually made available to users, notifications operate subject to the permissions and settings of the relevant operating system. You may allow or disable them through the system settings on your device without having to contact support.

Refusing notifications or later disabling them does not remove access to the application's core functionality within your plan and access rights. Bleanx does not require you to enable notifications as a condition of ordinary use of the application.

This provision applies to the relevant released version of an application and does not mean that applications for every platform are already available. It does not provide for SMS or MMS messaging.

Notification Content and Marketing Consent

Push notifications do not contain confidential Project materials, private correspondence, or sensitive personal data. Their content is limited to what is necessary for the relevant notification.

Bleanx does not currently send marketing notifications. If promotional push notifications are introduced, they will be sent only after separate, voluntary, specific, informed, and express consent obtained through a clear explanation in the application's interface. A method to opt out of those messages will be available within the application.

A general operating-system permission to display notifications is not, by itself, consent to marketing. Consent to marketing emails is not automatically treated as consent to promotional push notifications.

What Changing Notification Settings Does Not Do

Disabling notifications does not, by itself, cancel your Subscription, delete your account, Projects, or messages, or constitute a refund request.

Necessary service emails and other mandatory communications are governed separately by Email Communications and the Terms. Disabling push notifications does not relieve Bleanx of its obligation to deliver notices required by law or contract through an appropriate method.

Permission for notifications does not replace separate permissions for external AI processing and search, provide additional access to content, or authorize Bleanx to use data for model training or independent product development.

Browser Privacy Signals — Do Not Track and Global Privacy Control

No Tracking Regardless of Browser Settings

Your browser or an extension may transmit privacy preference signals, including Do Not Track and Global Privacy Control (GPC). Their purposes and legal effects differ.

As described in Sections 1–3, Bleanx does not use behavioural analytics or advertising tracking and does not correlate your activity on third-party websites or in other applications to create an advertising profile.

These restrictions apply whether or not your browser transmits Do Not Track or another privacy signal. You do not need to enable such a signal for Bleanx's prohibition on advertising tracking to apply to your data.

Third-Party Collection and External Sign-In Pages

Third parties cannot collect personal information about your online activities over time and across different websites through Bleanx's Website or Services.

When you sign in through Google or Apple, you temporarily leave Bleanx for the sign-in provider's own pages. The provider's collection and processing on those pages are governed by its own applicable privacy policy and rules and applicable law. This is not collection through Bleanx.

This distinction does not exclude the authentication information exchanged between Bleanx and your chosen sign-in provider, as described in Sections 1 and 3, or remove Bleanx's own obligations concerning that exchange.

Legally Recognized Opt-Out Signals

Where applicable law requires Bleanx to honor a legally recognized opt-out signal, including GPC, Bleanx recognizes and gives effect to a valid signal as the corresponding request. Depending on the applicable law, this may constitute an opt-out of the sale of personal data, sharing for cross-context behavioural advertising, or use for targeted advertising.

The opt-out applies to the browser or device and associated information, and to an account or user known to Bleanx, to the extent required by law. You are not required to sign in, repeat the request through support, or provide additional explanations for the signal to take effect within its applicable scope.

The absence of a signal is not consent to processing, does not cancel a previously expressed opt-out, and does not authorize activities prohibited by this Policy. Necessary information about an opt-out is used only to give effect to it and demonstrate compliance with applicable requirements.

Separate Settings and Rights

A browser opt-out signal does not, by itself, request deletion of your account or Projects, cancel your Subscription, or request a refund. It also does not mean that all processing necessary to operate the Services, maintain security, or meet mandatory requirements must stop.

Separate operations outside the scope of the applicable opt-out may continue only for disclosed purposes, on appropriate lawful bases, and to the extent necessary. Permission for a feature, acceptance of the Terms, or a narrowly scoped provider exception does not permit Bleanx to circumvent a legally binding opt-out.

Permissions for external AI processing and search, notification settings, withdrawal of marketing consent, and erasure requests are governed separately. Neither the presence nor the absence of a browser signal creates permission for Bleanx to use application data for model training or independent product development.

Cookies and Essential Browser Storage

Technologies and Their Purposes

As described in Section 1.B, Bleanx's web application uses localStorage, the browser's local storage, for sign-in and maintaining authenticated access. It holds service information necessary for the relevant session.

Bleanx does not use cookies, pixels, or similar technologies for behavioural analytics, advertising, or tracking activity on third-party websites or in other parties' applications.

Where applicable law permits strictly necessary storage of or access to information on a device without prior consent, Bleanx relies on that exemption only to the extent necessary to provide a service expressly requested by the user. The name of the technology, such as localStorage rather than a cookie, does not, by itself, create that exemption.

The absence of a requirement for separate consent does not remove the duties to disclose the processing, limit it to the corresponding purpose and a justified duration, and protect personal data.

Browser Controls

You may use the available settings in your browser to delete or restrict locally stored website data. The controls available depend on the browser.

Deleting or blocking information necessary for an authenticated session may require you to sign in again or prevent authentication. This is a technical consequence of restricting essential storage, not a requirement to agree to analytics, advertising, or other optional processing.

You may contact support@bleanx.org for help with managing this data. Contacting support is not a mandatory step for using the available browser settings.

What Clearing Browser Data Does Not Do

Deleting locally stored browser data does not, by itself, delete your account, Projects, or other information stored on Bleanx's servers or by external recipients, or cancel your Subscription. Account deletion, the exercise of personal data rights, and Subscription management follow their separate features and rules.

Clearing browser storage does not replace withdrawal of permission for external AI processing or search, or constitute an unsubscribe request for any future marketing communications. Use the methods described in this Section for the corresponding choice; support remains an additional channel.

Using essential storage is not consent to unrelated processing purposes and does not give Bleanx permission to train models or independently develop products using application data. The rules on browser privacy signals also apply separately.

_6. Your Privacy Rights

Access to Personal Data, Export and Portability

Right of Access and Processing Information

Your personal data rights are determined by the law applicable to the relevant processing. A paid Subscription or the role of Project Owner is not a condition for exercising those rights. Anyone whose personal data Bleanx processes may contact support@bleanx.org without creating or restoring an account.

Where the GDPR applies, you have the right to obtain confirmation of whether your personal data is being processed, access to that data, and a faithful, intelligible copy. The data is accompanied by the information required by law: processing purposes, categories of data, recipients, retention periods or the criteria used to determine them, available rights and how to lodge a complaint, information about the source of data not obtained from you, and applicable safeguards for international transfers.

If the relevant processing involves automated decision-making covered by applicable law, the required information about it is also provided, including meaningful information about the logic involved, its significance, and the envisaged consequences.

Where Bleanx acts as controller, it is responsible for handling the request itself. Where data is processed on behalf of another appropriate controller, Bleanx assists with fulfilment of the request within its role and the applicable DPA. This does not permit an inquiry to be left without appropriate handling merely because the requester is not a user of the Services.

Complete Export and Access Boundaries

In Settings > Account, selecting "Export all user data" immediately generates a complete package of your account data and all Projects you own. It includes your profile, settings, saved personal Ask and AI Dialogue histories, purchase history, the content and structure of your own Projects, associated metadata, applicable AI-origin indicators, and other data within the scope provided by the Terms and applicable rights.

Structured data is provided in JSON together with the necessary files and explanations. The same complete export is available through a documented, protected programmatic interface using an access key that you create and may revoke. You may use it yourself or authorize a destination provider to retrieve the data on your behalf.

Separate export of a Project you own remains available through Settings > Project in Markdown, PDF, and JSON. Export of individual Modules available to a Team participant or Reviewer follows Section 1 of the Terms.

Support at support@bleanx.org is an alternative channel for obtaining data and resolving export issues. You are not required first to use the export function or repeat a valid request already received. When fulfilling an access request, Bleanx provides the necessary information about processing together with the corresponding copy of personal data.

Participation in another user's Project does not entitle you to obtain that entire Project or export other users' private conversations, settings, or purchases. However, your personal data is not excluded from an applicable access request merely because it is contained in another user's Project, correspondence, or a security log.

To protect other individuals, confidentiality, and security, Bleanx applies necessary and proportionate safeguards, for example by providing extracts relating to the requester or redacting excessive information. These safeguards are not a basis for automatically excluding all shared materials or technical records. Obtaining a copy does not transfer ownership of other persons' materials or Bleanx Content.

Portability and Switching to Another Service

Where the conditions of Article 20 GDPR are met, you have the right to receive personal data concerning you that you have provided to a controller in a structured, commonly used, machine-readable format and transmit it to another controller without hindrance. This right applies to automated processing based on consent or a contract.

Within the scope provided by law, it covers not only information entered manually but also data observed through use of the service. It does not mean that every inference or result independently generated by the system is automatically data provided by you.

At your request, Bleanx transmits the data covered by that right directly to another controller where technically feasible, with necessary verification of authority and safeguards for the data.

The narrower conditions of Article 20 do not reduce the scope of the complete export promised by Bleanx in the Terms. Providing one package does not mean that all of its contents are personal data or fall under the same statutory provision.

Downloading data, creating or using an export key, or making an ordinary request for a copy through support does not, by itself, cancel a Subscription, delete your account or Projects, or start a period after which they will be deleted.

Organized switching to another provider under the EU Data Act is a separate process governed by Section 12 of the Terms. Its transition periods do not postpone fulfilment of an applicable GDPR request or restrict ordinary self-service export.

Rectification and Completion of Personal Data

Right to Rectification and How to Request It

Where the GDPR applies, you have the right to obtain rectification of inaccurate personal data concerning you without undue delay. Taking into account the purposes of processing, you also have the right to have incomplete personal data completed, including by providing a supplementary statement or explanation.

You may use the available controls for editing the relevant data or contact support@bleanx.org, identifying the information you consider inaccurate or incomplete and the correction or addition requested. Bleanx requests further explanations or supporting information only to the extent necessary and proportionate.

A request does not require a paid Subscription or the creation or restoration of an account. The absence of an editing control available to you does not remove your applicable right to rectification.

Where Bleanx acts as controller, it considers the request and fulfils its own obligations. Where the relevant data is processed on behalf of another appropriate controller, Bleanx ensures the necessary coordination with that controller and assists with fulfilment of the request within its role and the applicable DPA.

Personal Data in Projects, Output, and Historical Records

The right to rectification may concern personal data in profiles, purchase and inquiry records, Project materials, saved Output, personal conversations, and technical records, depending on the particular information and the purposes of its processing.

The fact that material belongs to another Project Owner does not exclude an individual's applicable rights in personal data contained in it. At the same time, a request does not grant the requester additional access or independent editing rights in another user's Project or transfer rights in the materials.

Information originating in an AI result is not, for that reason alone, excluded from rectification. Warnings about possible errors in Output and the user's obligation to verify results do not replace Bleanx's own obligations.

Accuracy is assessed in light of the purpose of the record. A faithful record that a particular action or statement actually occurred is distinct from using an assertion contained in that record as a currently accurate fact.

Where lawful retention of a historical record is necessary, rectification may be accompanied by a linked clarification or addition that enables its content to be understood correctly. However, marking a disagreement does not replace correction of an established inaccuracy where correction is required. This provision does not create indefinite retention of historical records.

Mere disagreement with an assessment, opinion, or forecast does not automatically mean that the record must be rewritten. Factual errors, incorrect attribution of a statement to an individual, and material incompleteness are considered separately; information is not excluded from protection merely because it is described as an opinion.

Implementing Corrections and Notifying Recipients

When fulfilling a request, Bleanx considers not only the identified field but also other affected records within the scope of the request and its own obligations, including saved summaries and Output. Changing an underlying Section is not automatically treated as correcting separately stored inaccurate information.

Bleanx takes the necessary measures to prevent an established inaccuracy from continuing to be used as a currently accurate fact in the affected processing, including the relevant AI context. The method of fulfilment depends on the nature of the data, legal requirements, and Bleanx's role; this is not a promise to regenerate the entire Project automatically.

Required rectification is not conditional on purchasing a plan or Usage Credits, initiating paid AI generation, or enabling external search. A request does not give Bleanx additional permission to use data for model training or independent product development.

Where the accuracy of personal data is contested, the right to obtain restriction of its processing for the period needed to verify that accuracy remains available when the conditions of applicable law are met.

Where Article 19 GDPR applies, Bleanx, within its obligations, communicates the rectification to each recipient to whom the relevant personal data was disclosed, unless this proves impossible or involves disproportionate effort. At the individual's request, information about those recipients is provided. The notification is limited to necessary information and does not automatically disclose the entire request or unrelated materials.

For processors acting on its behalf, Bleanx arranges the necessary actions through the corresponding contractual relationships. Notifying an independent recipient does not mean that Bleanx technically controls all of that recipient's records or guarantees simultaneous changes to every external copy. Bleanx's own obligations remain in effect.

Erasure of Personal Data and Account Deletion

Right to Erasure and How to Request It

Where the GDPR applies, you have the right to obtain erasure of personal data concerning you without undue delay in the circumstances provided by law. These include where the data is no longer necessary for the purposes of processing; consent on which processing was based has been withdrawn and no other lawful basis exists; the conditions for erasure following an objection to processing are met; the data was processed unlawfully; or erasure is required to comply with a legal obligation.

You may use the available controls to delete the relevant data or contact support@bleanx.org. A request does not require a paid Subscription or the creation or restoration of an account. Additional information and identity verification are requested only to the extent necessary and proportionate.

A request to erase particular personal data does not, by itself, request deletion of your entire account or all Projects, or cancellation of your Subscription. Bleanx takes account of the scope of the request and does not require deletion of the entire account where the required erasure of the relevant data can be carried out separately.

Where Bleanx acts as controller, it considers the request and fulfils its own obligations. Where data is processed on behalf of another appropriate controller, Bleanx ensures the necessary coordination and assists with fulfilment of the request within its role and the applicable DPA.

Account Deletion and Personal Data in Retained Materials

You may delete your account through Settings > Account > Delete account. Before your final confirmation, Bleanx explains the consequences. On confirmation, your account, Projects you own, and personal Ask and AI Dialogue content are immediately deleted from the operational systems, without a recovery period. You do not need to contact support to use this function.

Team participants and Reviewers lose access to the deleted Projects; their own accounts and Projects are not affected. The detailed consequences of deletion, including the ordinary notification arrangements, are set out in Section 12 of the Terms.

Contributions to other users' Projects and messages retained in the other participant's correspondence are handled under Section 12 of the Terms. In the relevant displays, your profile name and image are replaced by the designation "Deleted user". This replacement does not, by itself, mean that all information about you within the materials has been erased or anonymized.

Ownership of material by a Project Owner, a copy held by another participant, or retention of correspondence does not remove applicable personal data rights. Bleanx assesses the need to erase that data in light of its role, applicable law, and other persons' rights, and carries out the required erasure to the corresponding extent.

You do not need to repeat a valid request that already covers the data. Retention of materials does not postpone erasure that Bleanx must carry out independently of an additional request, including under applicable rules of the platform distributing the application.

Account deletion stops future recurring charges for a direct web Subscription without a separate cancellation action. An Apple Subscription is managed separately: before deletion, Bleanx warns you that charges may continue and provides routes to cancel that Subscription and request a refund through Apple. An active Apple Subscription does not prevent immediate account deletion.

You do not need to use your purchased Usage Credits, complete a refund review, or download your data before deleting the account. The recommendation to obtain any export you need before irreversible deletion is not a mandatory condition. Applicable refund rights remain unaffected.

Exceptions, Implementation, and Data Held by Recipients

Erasure may be limited only within the scope of applicable law. Where the GDPR applies, the conditions of Article 17(3) and other permitted statutory restrictions are considered, for example where necessary for the establishment, exercise, or defence of legal claims, compliance with a relevant legal obligation, or protection of freedom of expression and information.

For each retained category, Bleanx determines the necessary scope, specific purpose, lawful basis, and justified retention period. Merely labelling information a "financial record", "security log", or "Project history" does not create a general exception. The possibility of a future dispute does not authorize indefinite retention of the entire account.

If part of a request cannot lawfully be fulfilled, Bleanx explains why, which categories continue to be retained, for what purpose, and for how long or according to which criteria, together with the available ways to challenge the decision. This does not excuse erasure of the remaining data for which there is no basis for retention.

When carrying out erasure, Bleanx considers affected saved summaries, Output, and other records within the scope of the request and its own obligations. Clearing the source field is not automatically treated as erasing the same personal data from separately stored materials. Necessary measures are taken to prevent data subject to erasure from continuing to be used in the affected processing, including the relevant AI context.

Bleanx arranges necessary action by processors acting on its behalf. Where Article 19 GDPR applies, it communicates the erasure to each recipient to whom the relevant data was disclosed, unless this proves impossible or involves disproportionate effort, and informs the individual about those recipients on request.

Deletion of a Bleanx account does not mean simultaneous destruction of every record held by each independent external recipient. This does not remove Bleanx's own obligations or allow necessary action to be replaced by merely advising you to contact the provider yourself.

Residual backup copies are deleted under the limited retention and overwrite schedule described in Section 7. Until deletion, they are protected against ordinary use. If infrastructure is restored, previous deletions are reapplied so that the data is not returned to operational processing.

Retention of limited records or backup copies does not permit their use for new unrelated purposes, model training, or independent product development by Bleanx.

Restriction of Processing

When You May Request Restriction

Where the GDPR applies, you have the right to obtain restriction of the processing of your personal data in the following circumstances:

Accuracy: you contest the accuracy of the data, for the period needed to verify its accuracy.

Unlawful processing: processing is unlawful, but you oppose erasure and request restriction of the use of the data instead.

Data needed for your legal claim: the controller no longer needs the data for the original processing purposes, but you need it for the establishment, exercise, or defence of legal claims.

Pending an objection: you have objected to processing under Article 21(1) GDPR, pending verification of whether the controller's legitimate grounds override yours.

What Happens to Restricted Data

Bleanx marks the data subject to restriction and ensures that the restriction is observed in the affected operations. The data may be stored, but its ordinary use stops.

Apart from storage, processing is permitted only in the circumstances provided by Article 18(2) GDPR: with the data subject's consent; for the establishment, exercise, or defence of legal claims; for the protection of another natural or legal person's rights; or for reasons of important public interest of the European Union or a Member State. Each such operation is limited to the corresponding purpose and necessary scope.

Restriction applies not only to the source field but also to the personal data covered by it in saved Output, Overview / Summary, historical records, and other related records. Such data is not used in ordinary AI generation, search queries, shared access, or exports in circumvention of the restriction.

Merely hiding information on a user-facing screen is insufficient if prohibited use continues in other operations. Bleanx applies necessary targeted measures without restricting unrelated data or functions beyond what is necessary.

Where data must be retained for the individual's legal claim, ordinary deletion processes do not destroy it while the corresponding ground for retention remains. This does not create indefinite retention of the entire account or a recovery period for a deleted account.

Restriction of processing does not give the requester additional access or editing rights in another user's Project. It does not, by itself, cancel a Subscription, delete an account, or mean that the user has breached the Terms. Affected operations may be unavailable to the extent necessary; mandatory user rights remain unaffected.

Acceptance of the Terms, AI and search permissions, or another participant's consent does not permit circumvention of the restriction. The prohibition on Bleanx's use of data for model training or independent product development remains in effect.

Requests, Recipients, and Lifting a Restriction

To request restriction, you may contact support@bleanx.org and identify the relevant data and circumstances. A paid Subscription or the creation or restoration of an account is not required. Bleanx requests clarification and identity verification only to the extent necessary and proportionate.

Where Bleanx acts as controller, it considers the request and fulfils its own obligations. Where data is processed on behalf of another appropriate controller, Bleanx coordinates with that controller and provides the necessary assistance under the applicable DPA. The requester's lack of access to another user's Project is not, by itself, a reason to leave the request unaddressed.

Where Article 19 GDPR applies, Bleanx, within its obligations, communicates the restriction to each recipient to whom the relevant data was disclosed, unless this proves impossible or involves disproportionate effort. At the individual's request, information about those recipients is provided. Notifications contain only necessary information.

Bleanx arranges necessary action by processors acting on its behalf. Notifying an independent recipient does not mean technical control over all of that recipient's systems and does not remove Bleanx's own obligations.

Before lifting a restriction, Bleanx informs the individual who obtained it. The end of the ground for restriction does not automatically authorize any further use: applicable lawful bases, permissions, retention periods, and erasure obligations are assessed separately.

Required fulfilment of a request is not conditional on purchasing a plan, spending Usage Credits, or initiating paid AI generation. Response periods and the procedure for notifying a refusal are governed by the general request-handling procedure in this Section.

Right to Object to Processing

Objections to Processing Based on Legitimate Interests

Where the GDPR applies, you may object at any time, on grounds relating to your particular situation, to processing of your personal data based on the legitimate interests of Bleanx or a third party. This right also covers profiling based on those grounds, if such processing takes place.

On receiving such an objection, Bleanx stops the affected processing unless it demonstrates compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defence of legal claims.

The assessment concerns the particular data, purpose, necessity of processing, and the individual's circumstances. A general reference to "security", "operation of the Services", or "business interests" is insufficient to reject every objection automatically.

Pending verification, the right to obtain restriction of processing under Article 18(1)(d) remains available as described above. Reviewing a request does not permit circumvention of an established restriction.

Objections to Direct Marketing

Bleanx does not currently send marketing messages. Any future marketing is subject to the separate-consent and unsubscribe requirements in Sections 2 and 5.

Where Article 21(2) and (3) GDPR applies, you may object at any time to processing of your data for direct marketing, including related profiling, without giving reasons. After such an objection, the data is no longer used for that direct-marketing purpose.

Bleanx does not balance your refusal against its commercial interests or continue marketing on the basis of previously given consent. Marketing emails remain subject to one-click unsubscribing without sign-in; contacting support@bleanx.org is an additional way to communicate your refusal.

Opting out of marketing does not cancel a Subscription, delete an account, or restrict access to support. Necessary service messages are governed separately and are not used to circumvent an advertising opt-out.

Submitting an Objection and Its Effects

You may send an objection to support@bleanx.org in ordinary language, identifying the relevant processing and, where required, the circumstances of your situation. A paid Subscription, creation or restoration of an account, special form, or reference to a statutory provision is not required. Additional information and identity verification are requested only to the extent necessary and proportionate.

Where Bleanx acts as controller, it considers the objection and fulfils its own obligations. Where data is processed on behalf of another appropriate controller, Bleanx coordinates with that controller and provides necessary assistance under the applicable DPA.

Bleanx informs you of the outcome and the action taken. If processing continues in whole or in part, it explains the applicable reasons and the available ways to complain to a supervisory authority or seek a judicial remedy. Response periods are governed by the general request-handling procedure in this Section.

An objection to particular processing does not, by itself, request deletion of the entire account or cancellation of a Subscription, or constitute a breach of the Terms. Where an objection is upheld, the corresponding processing stops; applicable erasure obligations are fulfilled under the separate erasure rules.

Other independent operations may continue only for disclosed purposes, on appropriate lawful bases, and to the extent necessary. Bleanx may not circumvent an objection merely by relabelling the same processing or retrospectively declaring it necessary for a contract.

Withdrawal of consent and of AI or search permissions follows its own rules. Withdrawing consent does not require reasons relating to your particular situation or a balancing-of-interests assessment. The general right to object under Article 21(1) is not an automatic prohibition on all processing genuinely necessary to perform a contract or comply with a legal obligation. The right to challenge the lawfulness of that processing and other applicable rights remain unaffected.

Where applicable, Bleanx explicitly brings the right to object to your attention, clearly and separately from other information, no later than its first communication with you. Electronic means of exercising the right provided by law remain available.

An objection, its consideration, or a decision not to uphold it does not expand Project access rights or create an exception to the prohibition on Bleanx's use of data for model training or independent product development.

Non-Discrimination and No Retaliation

Exercising Rights Is Not Grounds for a Penalty

Bleanx does not discriminate against an individual or take adverse retaliatory measures because they exercise applicable personal data protection rights, including submitting a request, withdrawing consent, objecting to processing, or complaining to a competent authority.

Exercising such a right is not, by itself, grounds to deny the Services, increase prices, reduce the quality of the Services or support, impose a penalty, reduce an allowance provided under the applicable plan, or cancel separately purchased Usage Credits. Bleanx also does not threaten such consequences to discourage the exercise of a right.

Submitting a request or complaint does not, by itself, constitute a breach of the Terms.

Necessary Consequences of a Choice Are Not a Penalty

This rule does not require an operation to continue using data that has been erased, restricted, or may no longer be used for the relevant purpose following a valid request.

For example, withdrawing permission for external AI processing stops actions that require that permission. Withdrawal does not, by itself, disable available unrelated functions, including viewing, manual work, and authorized export. The consequences follow the rules for the relevant action described in this Policy and the Terms.

If fulfilling a request objectively affects a particular function, Bleanx explains the necessary consequence and limits it to the relevant operation. This does not authorize worsening other service conditions or using a technical dependency as a pretext for pressure.

Carrying out expressly requested account deletion is not a penalty for making a request. However, a request concerning particular personal data does not automatically become a request to delete the entire account or cancel a Subscription.

Safeguards and Complaints

The exercise of rights is not conditional on agreeing to optional or unrelated processing. Individuals may contact Bleanx about their personal data without a paid Subscription or creating or restoring an account.

If you believe that Bleanx has taken an adverse measure because you exercised your rights, you may contact support@bleanx.org. This does not limit your right to contact a competent supervisory authority directly or use other remedies provided by law.

The rules for handling requests, permissible identity verification, and reasoned refusals are governed by the general request-handling procedure in this Section. They are not used to penalize the requester or create unjustified obstacles.

Ordinary plan terms, access permissions, and necessary lawful security measures continue to apply, but they may not be used as a pretext for retaliating against the exercise of personal data protection rights.

Exercising Your Rights and Handling Requests

How to Submit a Request

You may use the available functions of the Services or contact support@bleanx.org to exercise applicable personal data protection rights. Other available contact methods and methods required by law remain available.

You may describe your request in ordinary language. No special form, reference to a statutory provision, paid Subscription, or creation or restoration of an account is required. Explain the action you request and provide the information needed to identify the relevant data. If the scope is unclear, Bleanx helps clarify it without unjustifiably narrowing your rights.

You do not need first to use the export function or repeat a valid request already received through an appropriate channel. Contacting support is not a mandatory preliminary step for available self-service functions.

Bleanx records the date of receipt, the request's content, and its role in the relevant processing. Where Bleanx acts as controller, it fulfils its own obligations. Where it acts as processor on behalf of another appropriate controller, it coordinates with that controller and provides necessary assistance under the applicable DPA rather than leaving the request unaddressed.

Identity Verification and Authorized Representatives

Bleanx applies verification that is necessary and proportionate to the nature of the request and the risk of disclosing or changing another person's data. Where the GDPR applies, additional information to confirm identity is requested where there are reasonable doubts about the requester's identity.

Reliable identification already available is taken into account. A copy of a passport or other identity document is not automatically required for every request. If additional verification is genuinely necessary, Bleanx explains what is required and limits the request to necessary information.

Lack of access to an account does not automatically lead to refusal; suitable alternative means of verification are considered. Do not send Google or Apple passwords or secret access keys. If necessary identification cannot be completed, Bleanx explains this without disclosing data to an unverified person.

You may act through an appropriately authorized representative. Bleanx verifies the representative's authority and, where necessary, the represented individual's identity to the extent and in the form required by applicable law.

Written permission is requested where necessary; it is not a universal requirement for renewed authorization where authority has already been properly established by another legally valid means. A representative receives only information within the scope of their authority.

Project ownership, Team participation, Reviewer status, or membership of the same organization does not, by itself, authorize a person to represent other participants in relation to their personal data.

Verification information is used only for verification and necessary records of that verification, not for profile enrichment, marketing, or product development. Its retention periods are determined separately.

Response Periods

For requests governed by the GDPR, Bleanx acts without undue delay and provides information on the action taken no later than one calendar month after receipt.

Where necessary in view of the complexity and number of requests, the period may be extended by no more than two additional months. Bleanx notifies you of the extension and its reasons within the first month and states the expected response date. An extension is not applied automatically.

Acknowledging receipt is not fulfilment of the request. Internal referral to staff or a processor does not restart the response period. Necessary clarification and identity verification are requested promptly and are not used to cause unjustified delay.

Rules on calculating or suspending a response period apply only to the extent permitted by the relevant legal regime. This Section does not create a general right to suspend the period whenever Bleanx asks an additional question.

If Bleanx does not act on all or part of a request, where the GDPR applies it explains the reasons and available remedies without delay and no later than one month after receipt.

For requests governed by other applicable laws, Bleanx complies with their response periods, acknowledgement requirements, and conditions for extensions. A longer period under one regime does not postpone an obligation that another applicable regime requires to be performed sooner.

This general procedure does not delay the immediate account-deletion process, implementation of a permission withdrawal, cessation of the relevant marketing, or self-service export. EU Data Act switching periods do not replace GDPR request-handling periods.

No Charge and Lawful Limits

The exercise of applicable rights is free of charge except where applicable law expressly permits otherwise. Required fulfilment is not conditional on purchasing a plan, spending Usage Credits, or initiating paid AI generation.

Where Article 12(5) GDPR applies, a reasonable fee reflecting administrative costs or a refusal is permitted only for manifestly unfounded or excessive requests. Bleanx bears the burden of demonstrating that ground. Repeating a request or disagreeing with a previous response does not automatically constitute abuse.

A reasonable fee for further copies of personal data already provided is permitted only in circumstances allowed by law. This does not introduce a charge for ordinary exports through functions Bleanx provides free of charge.

Before applying a permitted fee, Bleanx explains its basis and amount. This Section does not authorize an automatic charge to a payment method or deduction of Usage Credits.

Any refusal or limitation must rely on a specific applicable ground. To protect other individuals, confidentiality, and security, Bleanx provides relevant extracts or redacts unnecessary information where possible rather than refusing the entire request.

Personal data is not automatically excluded from a request because it appears in another user's Project. The procedure does not, however, provide access to that entire Project or additional editing rights.

Responses, Appeals and Necessary Records

Bleanx communicates the outcome clearly and accessibly, explaining the action taken and any lawful limits on fulfilment. Where possible, an electronic request receives an electronic response unless the individual requests another permissible method. Copies of data are provided with necessary security measures.

Where applicable law provides a right to appeal a refusal internally, Bleanx provides an accessible appeal process and information about how to submit an appeal, the applicable periods, and its outcome.

The right to contact a competent supervisory authority directly and use available judicial remedies remains unaffected. An internal support request is not stated to be a mandatory prerequisite for that protection.

Where the GDPR applies, a complaint may be lodged, in particular, with a supervisory authority in the place of habitual residence, place of work, or place of the alleged infringement. The choice of Delaware law in the Terms does not remove those rights.

Bleanx retains only necessary records of receipt, verification, consideration, and fulfilment of a request, including required notifications. Their purposes, access, and retention periods are limited. A request does not justify indefinite retention of the entire account, copies of identity documents, or the affected materials.

Browser privacy signals, including Global Privacy Control, are handled as described in "Browser Privacy Signals — Do Not Track and Global Privacy Control" in Section 5. The restrictions on disclosure for advertising in Section 3 apply regardless of whether a signal is sent.

_7. Data Retention

Retention Principles and Limits

Periods Defined by Data Category and Purpose

Bleanx retains personal data only to the extent necessary and for no longer than required for the specific lawful purposes described in this Policy.

Retention periods are established for the relevant categories of data or, where a precise period cannot be specified in advance, specific criteria for determining it. These take account of the purpose of the record, the event from which the period is calculated, applicable mandatory requirements, and the need for the corresponding processing.

An active account or Subscription does not, by itself, mean that all technical logs, inquiries, attachments, and other records must be retained for the entire life of the account.

Bleanx sets periods for deletion or review of the need for retention. When the relevant need ends and no other applicable ground for retaining the data exists, the data is erased without waiting for a separate request from the individual.

Operational Storage and Limited Retention after Deletion

Storage for the ongoing operation of accounts and Projects is distinct from the limited retention of particular records after content or account deletion.

Deletion of accounts, Projects, and personal content follows Section 6 of this Policy and Sections 1 and 12 of the Terms. General retention provisions do not postpone the agreed immediate deletion of an account from operational systems or create a recovery period.

After deletion, only particular information for which a necessary lawful ground for retention exists may be retained, for example information relating to mandatory financial records, an outstanding refund, a specific complaint or dispute, a legal claim, or a justified security task. For each retained category, the purpose, lawful basis, necessary scope, and retention period are determined, and access is limited to the corresponding task.

The need to retain a payment record or evidence for a particular dispute does not mean that the entire Project, all correspondence, or all account data must be retained. General references to audits, security, possible disputes, or business interests do not create independent authorization for indefinite retention.

Where data must be preserved under a valid restriction of processing, including where needed for the individual's legal claim, the rules under Restriction of Processing apply. Such preservation does not permit ordinary use of the data.

Copies, Providers, and Limits on Further Use

Retention rules take account of the original records and related saved Output, summaries, other copies, and backup systems. Erasing the source field is not automatically treated as erasing information stored separately.

Residual backup copies are handled under a limited deletion and overwrite schedule. Until deletion, they are protected against ordinary use; when infrastructure is restored, previous deletions are reapplied. The specific backup arrangements are addressed separately in this Section.

Bleanx arranges the necessary actions by processors acting on its behalf. Where it processes data on behalf of another controller, the applicable documented instructions and DPA also apply. Retention for external recipients' independent processing is considered separately: this Section does not promise simultaneous destruction of every provider's records or remove Bleanx's own obligations.

Retention, masking, or de-identification does not give Bleanx additional rights to use the data. It is not a general substitute for required erasure or a way to circumvent the prohibition on model training and independent product development.

The confidentiality period under the Terms is not a data retention period and does not extend one.

Retention of Account Data and User Content

Account Data, Subscriptions and Inactivity

Bleanx retains the current profile information, settings, and account and sign-in identifiers necessary to provide your account for as long as the account is maintained, subject to the deletion rules below. This does not extend the retention period for every technical log, inquiry, attachment, or other record associated with the account.

Cancelling or ending a Subscription, moving to Explorer, or exhausting an allowance or purchased credit balance does not, by itself, delete your account or existing Projects, including Projects above the Explorer ownership limit. The owner's move to Explorer does not itself revoke existing Team or Reviewer access; the restriction on new Team invitations is described in Section 5 of the Terms. Separately purchased Usage Credits remain subject to their existing validity and use rules. The duration of a paid Subscription is not the retention period for the account or its content.

Bleanx deletes an account after 24 consecutive months without signing in, unless the account has an active Subscription or a remaining balance of separately purchased Usage Credits. Either exception prevents automatic deletion for inactivity, regardless of whether the Subscription or credits were purchased directly through the web service or through Apple.

Bleanx sends a warning to the email address associated with the account 30 calendar days before the scheduled deletion. The warning identifies the deletion date, explains the irreversible consequences and the available export options, and explains that signing in before deletion prevents deletion for inactivity. A new sign-in restarts the inactivity period. Deletion does not take place before both the 24-month inactivity period and the 30-day warning period have elapsed, and the exceptions are checked again before deletion.

Deletion for inactivity has the same effects on the account, owned Projects, personal content, participation in other Projects, and retained correspondence as account deletion under Section 6 of this Policy and Section 12 of the Terms. Once deletion is carried out, the account, Projects you own, and your personal Ask and AI Dialogue content are removed immediately from operational systems without a recovery period. Applicable refund rights and the rules on limited lawful retention remain unaffected.

The inactivity exceptions do not prevent you from deleting your account yourself while a Subscription is active or purchased Usage Credits remain. They do not authorize indefinite retention of unrelated records or postpone earlier erasure required by law. The inactivity rule is governed by Section 12 of the Terms. Mandatory data-retrieval periods and lawful preservation requirements remain applicable.

Project Content, Saved Output and Journal

Bleanx stores a Project's saved materials, structure, associated files, summaries, and necessary related information to provide that Project, until the relevant content or Project is deleted, subject to earlier required erasure. These retention rules also apply to saved Output without including it in the definition of User Content or changing rights in the materials.

For each Section, the operational system stores only its current saved value and version number, such as v3; it does not retain previous Section values as a version history. The Journal records event notifications and associated event information, not the contents of previous versions. Journal records are retained while the Project exists and are deleted with it, subject to the personal data safeguards below.

When the Project Owner confirms deletion of an individual Project, that Project, its content, associated files, summaries, and Journal are immediately and irreversibly deleted from operational systems. There is no recovery window or restoration of the deleted Project. The Project Owner, Team participants, and Reviewers lose access to it. This does not delete the participants' accounts or other Projects or, by itself, cancel a Subscription.

Clearing a Section value removes that saved value but does not, by itself, erase information separately stored in connected Sections, summaries, or other materials. Applicable rectification, restriction, and erasure obligations extend to affected separately stored personal data as described in Section 6.

AI proposals requiring acceptance are not retained in Bleanx after you reject them or close them without accepting. They do not become a saved Section value or an archive of rejected results. This does not undo an earlier acceptance or the automatic saving of results under the relevant feature's rules in the Terms. Nor does it mean that an external provider has not already processed the request or must erase all its records at the same moment. Provider retention and Bleanx's corresponding obligations are governed separately by this Policy.

Personal Ask and AI Dialogue Histories

Saved personal Ask and AI Dialogue questions, responses, and conversations are retained to provide the relevant user with their personal history, within that purpose and the applicable lawful basis and subject to the relevant deletion events. They do not become shared Project content or become available to the Project Owner or other participants merely because of their role. You may delete your own personal Ask question-response pair using the corresponding control; both the question and response are removed.

Your personal AI Dialogue history associated with a Project is deleted when you leave that Project, lose access to it, or the Project is deleted. This concerns the history associated with that Project, not unrelated personal content in other Projects. Your personal Ask and AI Dialogue content is deleted from operational systems when your account is deleted, without transfer to a Project Owner or other participant.

Withdrawing permission for external AI processing or search stops the corresponding future transmissions for actions you initiate but does not, by itself, erase an otherwise retained personal history. The continued use of shared Project contributions in other authorized users' permitted AI actions is explained in Section 5. Separate deletion events and applicable personal data rights remain effective. Material intentionally contributed from a personal interaction to a Project follows the Project's retention and access rules; this does not make the remaining personal history shared content.

Contributions to Other Projects and Direct Correspondence

Deleting your account does not, by itself, delete contributions you have made to another user's Project or reverse rights already allocated to its Project Owner. Those contributions follow the relevant Project's retention and deletion rules. In the corresponding retained displays, including Journal authorship, your profile name and image are replaced by "Deleted user". That designation does not anonymize all information about you within the materials.

After your account is deleted, direct Dialogue correspondence retained by the other participant remains in that participant's personal correspondence until they delete it using "Delete for me" or their own account is deleted, whichever occurs first, subject to earlier required erasure. Your profile name and image are replaced by "Deleted user". The correspondence remains private to that participant among users and does not become Project content or become accessible to others merely because of a Project role.

This criterion concerns providing the recipient with their own correspondence history, not retaining it for unrelated purposes. Personal data in retained contributions, Journal records, and correspondence may be processed only to the necessary extent, on an appropriate lawful basis, and for a justified period. Where the relevant need ends and no other lawful ground exists, the data is erased without waiting for a new request. Where applicable law or applicable app-distribution rules require earlier erasure, Bleanx carries it out rather than waiting for deletion by the Project Owner or recipient. A valid request already covering the data does not need to be repeated.

The limited lawful-retention exceptions, safeguards for other persons' rights, and rules for processing on instructions in Section 6 and Retention Principles and Limits above apply to this block. Immediate operational deletion is distinct from deletion of residual backup copies and records lawfully retained separately. It does not promise simultaneous destruction of every external provider's records or remove Bleanx's own deletion obligations. Retention does not authorize model training or independent product development prohibited by the Terms and this Policy.

Database Backups, Recovery and Storage Files

Backup Period and Recovery Window

Bleanx uses Supabase for database backups and recovery. The configured retention period for daily database backups is 7 days, and Point-in-Time Recovery (PITR) is enabled with a rolling 7-day recovery window. These periods are not added together as consecutive 14-day retention. The daily-backup parameter does not mean that a separate Daily Backups service continues to run alongside active PITR.

Deletion from the live database does not simultaneously change every previously created backup. As the 7-day recovery window advances, database states preceding deletion pass outside that window. The recovery window concerns available recovery points; it is not a guarantee that every underlying base backup, transaction-log archive, or other residual technical copy is physically destroyed exactly 7 days after deletion of a record. Residual copies remain subject to finite deletion and overwrite arrangements and the safeguards below, not indefinite retention for ordinary account operation.

Restricted Use of Residual Copies

Until deletion, residual backup copies are protected against ordinary operational use. Access is limited to authorized personnel and necessary providers for infrastructure recovery and protection. Data that has been deleted from operational systems is not taken from these copies for ordinary service operation, AI context, search, shared access, or user exports. The restrictions on model training and independent product development continue to apply.

Reapplying Deletions after Recovery

Before restored data is returned to ordinary processing, Bleanx reapplies previous deletions and applicable processing restrictions to the affected content, identifiers, and Storage references. Infrastructure recovery does not reinstate deleted accounts or Projects for users, restore deleted personal histories, create a user recovery period, or restart an expired retention period. Bleanx arranges the necessary actions by its processors within its own responsibilities and, where relevant, the applicable DPA.

Storage Files and Separate Records

Database backups contain metadata and references to Storage objects, not the contents of the files themselves. Bleanx does not currently maintain separate backups of Storage files. When a Storage file is deleted under the applicable deletion process, its contents are immediately removed from operational storage and do not remain in these database backups or a separate Bleanx Storage-file backup. Restoring a database record or reference does not restore the deleted file. Any residual database metadata and references follow the database-backup arrangements above.

These arrangements do not delay the immediate operational deletion described in this Section or establish a common retention period for financial, legal, security, or other records lawfully retained separately, or for every external provider's records. The purpose-specific retention limits, required deletion, and Bleanx's own responsibilities remain applicable.

Inquiries, Choice Records and Unfinished Invitations

Inquiries and Attachments: Bleanx retains inquiries, complaints, voluntary bug reports, supplied attachments, and associated handling records only while necessary to consider the matter, carry out the requested or required action, and verify the outcome. After the matter is closed, only the minimum records needed for a specific applicable obligation or the establishment, exercise, or defence of a substantiated legal claim are retained, until the corresponding ground ends. The need for those records is reviewed; a possible future dispute does not justify indefinite retention of all correspondence.

Attachments and copies of identity or authority documents are not automatically retained for as long as the record of the outcome. When the necessary verification or other specific purpose requiring the original material has been completed, that material is deleted unless a separate lawful ground requires its limited retention. A minimal record that verification occurred may be retained where necessary without retaining the underlying document.

Permissions, Consents and Refusals: Bleanx keeps only the records necessary to give effect to and demonstrate permissions, consents, their withdrawal, objections, and communication opt-outs, including the relevant purpose and notice or terms version, choice, date, and action where necessary. These records are retained only while needed to honour that choice, fulfil a specific applicable obligation, or address a substantiated legal claim, and are then deleted when no corresponding lawful ground remains. A minimal suppression record needed to prevent further messages does not authorize retaining the person's entire account or correspondence. Specific legally required retention of payment and recurring-charge consent records is not shortened by this provision.

Unfinished Invitations and Access Requests: Information about unaccepted, expired, revoked, or otherwise unfinished invitations and access requests is retained only to the extent necessary for a valid access process or a specific related inquiry, security matter, or legal obligation. Unnecessary information is deleted when the corresponding need ends. Information about an accepted invitation or granted access thereafter follows the rules for current participation and access records; it does not acquire an unlimited retention period merely because an invitation was accepted.

Financial, Technical and Provider Records

Financial Records, Purchases and Resource Accounting

Bleanx retains the purchase, Subscription, entitlement, separately purchased Usage Credit and adjustment records needed to provide the purchased service, confirm the user's corresponding rights and balance, and complete the relevant calculations and settlements. Cancellation of a Subscription does not erase the evidence needed to honour an existing purchased balance. Account deletion does not prevent limited retention needed to assess and complete an applicable refund without restoring the account.

Financial and tax documents are retained for the period required by the rule applicable to the particular document and transaction. The starting event follows that rule, such as the relevant tax period, filing, or end of the contract, rather than automatically the date of account deletion. After ordinary settlement, access to records retained only for mandatory recordkeeping or a specific claim is restricted to that purpose. They are deleted when the applicable requirement or justified claim-related need ends, unless another specific lawful preservation requirement applies.

Evidence of affirmative consent to an automatic-renewal or continuous-service Subscription is retained for the period required by the applicable subscription rule. Where California Business and Professions Code Section 17602(a)(6) applies, this is at least three years or one year after termination of the contract, whichever is longer. This is a rule for the relevant consent evidence, not a common retention period for all financial or account data.

A purchase record and the evidence needed to verify a purchased balance are distinct from detailed AI, search and resource-consumption records. Detailed accounting records are retained only while needed to verify the relevant grants, consumption and adjustments or resolve a related calculation question. They do not justify retaining entire Projects, full AI context, requests, responses or personal histories as financial evidence. A specific legally required record is retained separately to the necessary extent.

Technical Logs, Error Reports and Security Records

Technical records of requests, authentication, errors and security events are retained for a limited period necessary for the corresponding operational, security or troubleshooting task. The criteria are the continuing need to verify the relevant request or access, detect and address security threats, and diagnose, correct and verify correction of failures. Retention is assessed from the recorded event; the continued existence of an account, a new sign-in, Subscription renewal or transfer to another storage system does not, by itself, restart or extend it. Bleanx reviews that need and deletes records when it ends.

Where a particular incident or dispute requires preservation, only records relevant and necessary to that matter are retained until it is resolved. Any further preservation must follow a separate applicable legal requirement or valid restriction of processing, with its own scope and end criterion; a general possibility of future disputes does not permit indefinite retention. Access remains limited to the corresponding task.

Error reports from bleanx.ai are also stored in Sentry, in the United States, for the error-diagnosis purpose described in Sections 1.B and 3. The same purpose and deletion limits apply to those reports and any necessary extracted records. A provider's available storage period does not, by itself, authorize Bleanx to retain a report after the relevant need ends. Sentry is not integrated into the macOS application and is not used for Session Replay, recording users' actions or behavioural analytics.

Technical logs, error reports and incident records are not used for behavioural analytics, evaluation of feature popularity, model training or independent product development, including after aggregation, de-identification or other transformation. The restrictions on excessive content and active secret access credentials in Section 1.B continue to apply.

Records Held by External Providers

Retention by a processor acting on Bleanx's behalf is determined for the particular processing operation under the applicable binding agreement, actual service configuration and necessary purpose. Bleanx arranges the required return or deletion and takes necessary steps to verify completion within its responsibilities. Where Bleanx processes data on another controller's instructions, the applicable DPA, documented instructions and mandatory return and deletion requirements also apply. Referring to a provider's policy does not replace those duties.

Independent processing by a recipient is considered separately. The narrowly scoped exceptions for transmitted search queries, payment data and email-delivery metadata retain the data, recipient and purpose limits stated in Sections 2 and 3 and Section 4 of the Terms. They do not extend to Sentry error reports or create an additional exception for model training or independent product development.

Completion of an AI action, withdrawal of a permission or deletion of a Bleanx account does not mean simultaneous destruction of every record held by every recipient. Applicable rights remain available, and Bleanx performs its own required actions rather than making the individual take over those obligations. Provider retention is described using the periods or criteria applicable to the actual processing; an optional provider feature or a general plan description is not treated as Bleanx's configuration. The separate database-backup arrangements above do not set the retention period for these other records.

_8. Security of Your Information

Risk-Appropriate Safeguards

Bleanx implements and maintains technical and organizational measures appropriate to the nature, scope, context and purposes of processing and the likelihood and severity of risks to individuals. These measures protect the confidentiality and integrity of personal data, the availability and resilience of processing systems and services, and the ability to restore availability and access in a timely manner after a physical or technical incident. Encryption and pseudonymization are used where appropriate to those risks.

Access is limited to authorized personnel and engaged providers who need the data for the relevant permitted task, subject to applicable instructions and confidentiality obligations. Bleanx regularly tests, assesses and evaluates the effectiveness of its safeguards and takes necessary corrective measures. These duties do not represent that Bleanx holds a particular certification, has completed an independent security audit, or provides end-to-end encryption. Recovery remains subject to Section 7, including its backup scope and the reapplication of prior deletions and restrictions; it does not reinstate lawfully deleted accounts or Projects.

No Absolute Guarantee; Preserved Responsibilities

No system can be guaranteed to prevent every attack, vulnerability or interruption. This does not release Bleanx from its own duties to protect personal data, respond to incidents and remedy breaches, or from liability for its own acts or omissions under applicable law and the Terms. Engaging a provider does not, by itself, remove Bleanx's responsibilities. This Policy creates no separate exclusion of liability for unauthorized disclosure. Sections 14-16 of the Terms and the applicable DPA remain subject to mandatory rights and remedies, including non-waivable compensation rights under data protection law.

Incidents and Required Notifications

Bleanx investigates reported or detected security incidents, takes necessary measures to contain and remedy them and mitigate their consequences, and documents personal data breaches, their effects and the action taken. A personal data breach may involve accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to personal data, including a loss of availability; not every technical error is such a breach.

Where the GDPR applies and Bleanx acts as controller, Bleanx notifies the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to individuals' rights and freedoms. A notification made later includes the reasons for the delay. Where the breach is likely to result in a high risk to individuals' rights and freedoms, Bleanx also informs the affected individuals without undue delay, subject to the conditions and exceptions in Article 34 GDPR.

Where Bleanx processes affected data on behalf of another controller, it notifies the appropriate Customer or controller without undue delay after becoming aware of the breach and provides the assistance required by the applicable DPA and law, including through the relevant upstream processing relationship. The controller's 72-hour period is not a separate waiting period available to Bleanx as processor or subprocessor. Project ownership alone does not determine the appropriate notification recipient.

An initial required notification is not delayed until the entire investigation is complete. Information not yet available is supplied in phases without undue further delay. Notifications provide the information required for the recipient, including the nature of the breach, likely consequences, measures taken or proposed and a contact for further information. Communications to affected individuals are clear and understandable and include relevant protective recommendations.

Required security communications are not conditional on marketing consent. Bleanx uses the communication methods required by applicable law; a notice posted on the Services is not a substitute for an individual communication unless a lawful exception permits an equally effective public or similar communication. Notification and other incident-response obligations under other applicable laws remain unaffected. You may report a suspected incident or ask security-related questions at support@bleanx.org.

_9. Third-Party Websites/Applications

The Services, including Output and search results, may contain links to websites or applications operated independently of Bleanx. A link does not, by itself, mean that Bleanx endorses the resource, has independently verified its content, or is affiliated with its operator. Likewise, a link to Bleanx from another website or application does not, by itself, establish an affiliation.

If you follow such a link, your use of the external resource and the processing of your data by its operator are governed by that operator's applicable terms and privacy policy, as well as applicable law. We recommend reviewing those terms and policies. Bleanx does not control such independent resources or guarantee the accuracy of their content.

The rules for independent external resources above are distinct from data processing by providers engaged by Bleanx to deliver the Services, including AI, external search, authentication, payments, hosting, storage, and error reporting such as Sentry. That processing remains subject to the corresponding sections of this Policy, the Terms, the applicable DPA where processing on instructions is involved, and applicable law. The external-resource provisions do not provide a disclaimer of Bleanx's responsibility for those processing arrangements.

Bleanx retains its own obligations and responsibility for lawful disclosure, required permissions, appropriate security and data protection, and persons it engages to the extent provided by the Terms and applicable law. Neither a link nor a recipient's status as a third party displaces those obligations or limits mandatory user rights. This Section creates no separate exclusion of Bleanx's liability.

_10. Children's Information

Adults Only: The Services are intended for adults and are not directed at children. To create an account and use features that require authentication, you must be at least 18 years old and have the legal capacity required to enter independently into a contract with Bleanx, as provided in Section 3 of the Terms. This requirement applies to all account users, regardless of their Project role or plan. Consent or involvement of a parent, guardian, employer, or Project Owner does not create an exception.

Handling Underage Accounts: Bleanx promptly examines substantiated reports or reasonable doubts about whether an account user meets the age requirement, using only necessary and proportionate verification under Section 3 of the Terms. If Bleanx confirms that the user is under 18, it discontinues access to the features requiring authentication, stops unlawful collection and use of the user's personal data, and carries out required erasure without undue delay. Bleanx arranges necessary action by processors acting on its behalf and, where it processes data on another controller's instructions, coordinates the required action under the applicable DPA.

Only limited records for which retention is lawfully necessary may be kept under Section 7; that provision is not used to circumvent required erasure. Notices of restrictions, the opportunity to challenge an erroneous decision, and applicable data protection and refund rights remain available under the Terms and Sections 6 and 7 of this Policy.

You may report a suspected underage account or raise a concern about a child's personal data at support@bleanx.org without creating an account. A parent's, guardian's, or another person's report does not automatically entitle them to access the data. Before disclosure, Bleanx verifies identity and any necessary authority in accordance with Section 6 and applicable law, and limits disclosure to the verified scope of authority.

Children's Data in Materials Provided by Adults: Personal data about a child may appear in Project materials or other content supplied by an adult user. This is distinct from a child holding or using a Bleanx account. Such data remains subject to the lawful-basis, data-minimization, security, retention, and individual-rights requirements of this Policy, together with any additional protections required by applicable law for children's data. This provision neither authorizes unrestricted submission of children's data nor represents that such information can never appear in the Services. The responsibilities of the person supplying it do not replace Bleanx's own obligations.

_11. Supervisory Authority

Complaints to Competent Authorities: If you believe that the processing of your personal data infringes applicable data protection law, you may complain to the competent supervisory authority in accordance with that law. This right depends on the law applicable to the processing, not solely on where you are physically located when you complain. Where the GDPR applies, you may lodge a complaint, in particular, with a supervisory authority in the Member State of your habitual residence, place of work, or the alleged infringement.

Official Routes: For the European Economic Area, the EDPB directory of supervisory authorities provides contact details for the national authorities; the EDPB itself does not handle individual complaints. For the United Kingdom, you may use the official complaints route of the Information Commissioner's Office (ICO). For Switzerland, you may report a suspected breach to the Federal Data Protection and Information Commissioner (FDPIC) within its competence.

Each authority's jurisdiction and procedures apply. These links do not designate a single European supervisory authority for Bleanx or promise a particular investigation, outcome, or award of compensation. Rights to approach competent authorities in other jurisdictions remain available under applicable law.

Contacting Bleanx and Other Remedies: You may raise a personal data concern or complaint at support@bleanx.org without creating an account or purchasing a Subscription. Bleanx does not impose a contractual requirement to complete its support process before contacting a competent authority or using an available judicial remedy. Applicable legal conditions and the authority's own procedures remain in effect; the ICO ordinarily asks individuals first to give the organization an opportunity to address their complaint. Section 6 governs related rights, requests, representation, and protection against retaliation. The choice of Delaware law and any applicable arbitration provision do not prevent complaints to regulatory authorities or restrict mandatory rights and remedies.

Where the United Kingdom's data protection complaints requirements apply to Bleanx as controller, Bleanx acknowledges receipt of a complaint within 30 days of receipt, takes appropriate steps to address it, including necessary investigation, without undue delay, and keeps the complainant informed of progress and communicates the outcome without undue delay. The acknowledgement period is not a waiting period before investigation and does not replace or extend the time limits for responding to a data protection rights request under Section 6. Acknowledgement alone does not fulfil such a request.

_12. Additional Information for California Residents

Application of California Privacy Rights

This Section supplements this Policy for California residents. The rights and obligations provided by the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), apply where and to the extent that the CCPA applies to Bleanx's relevant processing of personal information.

This qualification does not limit rights under other applicable laws or reduce Bleanx's general commitments under this Policy.

No Sale or Sharing for Advertising

Bleanx does not sell personal information or share it for cross-context behavioral advertising, as those terms are defined in the CCPA. Bleanx has no advertising partners and does not disclose personal information to third parties for their own direct marketing purposes.

You do not need to take any separate action for these restrictions to apply.

Necessary disclosures to recipients for the purposes described in Section 3 remain subject to the limits stated there. This does not mean that no data is disclosed to external providers or expand the narrowly scoped exceptions for particular recipients described in this Policy.

Information About Processing

Categories and sources of personal data are described in Section 1, processing purposes in Section 2, recipients in Section 3, international transfers in Section 4, and retention in Section 7. This Section does not introduce additional categories of personal data, recipients, or processing purposes.

Rights, Requests and Browser Signals

To exercise applicable rights under the CCPA, use the procedure in Section 6, including its provisions on authorized representatives and non-discrimination. The scope of rights, response periods, and permitted limitations are determined by the applicable law. Conditions stated specifically for the GDPR do not limit rights under the CCPA.

Where provided by the CCPA, you may limit the use and disclosure of sensitive personal information, as defined in that law. Requests follow the procedure in Section 6.

Our response to Do Not Track and legally recognized browser privacy signals, including Global Privacy Control, is described in "Browser Privacy Signals — Do Not Track and Global Privacy Control" in Section 5.

_13. Data Privacy Framework

Bleanx Inc. is not certified under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, or the Swiss-U.S. Data Privacy Framework. Bleanx does not rely on its own participation in those frameworks as a basis for international transfers of personal data.

_14. Changes to Our Privacy Policy

Updates and Published Versions: Bleanx may update this Policy to reflect changes in applicable law, lawfully introduced changes to the Services or personal data processing, or corrections and clarifications. Each revised version is published with its last-updated and effective dates and remains readily accessible through the Website and the Services, including Bleanx applications actually made available. Publication does not, by itself, authorize a new processing purpose, expand permitted uses of data, or override Bleanx's existing obligations.

Notice of Material Changes: For material changes affecting account users, Bleanx sends advance notice by service email to the address associated with the affected account and provides a prominent notice on the Website or in the relevant Services interface. The notice explains what is changing, why, when the changes take effect, their implications for personal data processing and available rights, and where to read the revised Policy. These service emails are delivered through Resend as described in Section 3 and are not conditional on marketing consent.

For visitors without an account, Bleanx provides a prominent notice on the Website. Where individual notification is required, the absence of an account does not allow Bleanx to replace it with publication alone. Notice is given sufficiently in advance for affected individuals to understand the changes and exercise applicable rights, subject to any specific mandatory periods. There is no uniform 30-day notice period for every revision of this Policy; where a change also affects contractual terms, the applicable requirements of Section 22 of the Terms remain binding. Before using personal data for a new purpose, Bleanx provides the required information about that purpose and the associated processing and brings the change to the affected individuals' attention.

Corrections and editorial clarifications that do not change the substance of processing or individuals' rights are reflected in the published text and its revision information without a separate email, unless applicable law requires otherwise. A shorter notice period for a legally required change or an objectively necessary urgent protective measure is used only to the extent permitted by law. Bleanx informs affected individuals as far in advance as possible or, where advance notice is lawfully impossible or prohibited, without undue delay afterwards. This exception does not dispense with prior information or consent where required.

Information Is Not Consent: This Policy provides information about processing. Reading a revised version, silence, signing in, or continuing to use the Services does not constitute separate consent or permission where one is required. Bleanx obtains any necessary new consent or permission before the corresponding processing begins.

An update does not replace the separate permissions for external AI processing and search, override a refusal or withdrawal, or create an exception to the restrictions on model training and independent product development. Changes to contractual terms and the engagement of subprocessors remain subject to the applicable Terms, DPA, and mandatory requirements; publication of a revised Policy does not replace those procedures or retrospectively make unlawful processing lawful.

Contact Us

You may contact Bleanx about personal data processing, this Policy, requests to exercise data protection rights, or privacy complaints using the details below. You do not need to create or restore an account or purchase a Subscription.

Bleanx Inc.
2810 N Church St STE 88757
Wilmington, DE 19802
United States
Email: support@bleanx.org
Telephone: (302) 407-0567

These contact methods supplement, rather than replace, available self-service features and other contact methods provided by the Services, the Terms, or applicable law. A telephone call or postal letter is not required to use the available export, account-deletion, or permission controls. Requests, proportionate identity and authority verification, and response periods are governed by Section 6. Bleanx does not require you to complete its support process before contacting a competent supervisory authority or using an available judicial remedy; the applicable legal conditions and authority procedures described in Section 11 remain in effect.