Privacy Policy

1. Who is responsible

The controller for the processing described in this policy is Getreach Limited, Dimotikis Agoras 20, 6021 Larnaca, Cyprus, registered with the Cyprus Registrar of Companies under number HE 491882.

Contact for all privacy matters: support@blizo.com. Further company details are in our legal notice.

Because we are established in the European Union (Cyprus), the EU General Data Protection Regulation (GDPR) applies to our processing. For users in the United Kingdom, the UK GDPR and the Privacy and Electronic Communications Regulations (PECR) also apply.

2. Our role for customer data

We act as controller for data about our website visitors, report requesters, account users and billing contacts, and for data we need to run, secure and bill the service.

Where a customer uses Blizo to process personal data within its workspace, for example team member details, notes or content that identifies individuals, we act as the customer's processor under our Data Processing Addendum. In that case the customer is responsible for its own processing, and requests about it should be directed to the customer.

3. Personal data we process

Account and workspace data

Name, email address, a hashed password, organization or workspace name, role and membership, language preference, sign-in and email-verification events, and the settings you choose.

Billing data

Company name, billing contact email, billing address and country, tax or VAT ID, plan, billing interval, subscription status, invoices and payment history. Card details are entered directly with Stripe; we receive only a reference and limited card metadata (for example brand and last four digits), never the full card number.

Service content

The domains, brands, competitors, markets, languages, keywords and prompts you configure; the AI answers, citations, sources and metrics we collect for them; content we read from public web pages of the domains involved; reports, notes, briefings and exports you create; and data you connect through integrations (for example the Blizo MCP server or a partner reporting export enabled by your workspace).

Free AI visibility report requests

Name, email address, optional phone number, the website and market you enter, and the resulting report. If you request a report through Getreach and choose to connect it to Blizo, Getreach transfers your name, verified email, verified phone number, onboarding preferences and report with your confirmation.

Technical, usage and security data

IP address, browser and device information, request logs, error logs, security events, bot-protection signals (Vercel BotID) on sign-up and sign-in, and a daily hashed network identifier used to limit automated abuse.

Analytics data (only with your consent)

A pseudonymous device identifier, pages visited, clicks and interactions, referrer and campaign parameters, browser and device data, coarse location derived from the IP address, and masked session recordings. Inputs are masked in recordings, and we strip tokens and email addresses from captured URLs.

Communications

Emails we send you (verification, password reset, trial, billing and service notices, reports), delivery, bounce and complaint events, and messages you send to support.

4. Purposes and legal bases

The legal bases below refer to Article 6(1) GDPR and the equivalent provisions of the UK GDPR.

Where we rely on legitimate interests, you can object at any time (see section 9). Where we rely on consent, you can withdraw it at any time with effect for the future, for analytics via "Cookie settings" in the footer.

We do not send marketing emails without your consent, we do not sell personal data, and we do not make decisions based solely on automated processing that produce legal or similarly significant effects for you.

5. Public websites and AI answers

To measure AI visibility we send questions ("prompts") to AI platforms and search services and store the answers, citations and sources they return. We also read publicly available pages of the domains our customers enter. Prompts consist of business information such as brand, competitor, market and topic names; we do not include your account or contact details in them.

AI answers and public pages can incidentally contain personal data, for example the name of a company founder. We process such data only as part of the business context in which it appears, we do not build profiles of individuals, and we do not use it for any other purpose. We do not use customer content to train our own AI models.

If you believe an answer or page we store contains your personal data and you want it removed, contact support@blizo.com.

6. Service providers and other recipients

We use the service providers below. They process personal data on our behalf under data processing agreements and only as instructed. The same list is published as our subprocessor list.

Other recipients:

• Stripealso acts as an independent controller for some processing, such as fraud prevention and regulatory obligations; see Stripe's privacy policy.
• Getreach. app.getreach.com is operated by Getreach Limited, the same company that operates Blizo. We exchange data with it only when you connect the two services or request a report through Getreach.
• Members of your workspace and people you share report links with can see the workspace or report content.
• Professional advisers (lawyers, accountants, auditors), authorities and courts where required by law, and a successor in the event of a merger or acquisition, subject to this policy.

7. International transfers

We host the application in the EU (Frankfurt). Some providers listed above process data outside the European Economic Area and the United Kingdom, in particular in the United States. We transfer personal data only where an adequate level of protection is ensured, namely:

• an adequacy decision, including the EU-U.S. Data Privacy Framework and its UK Extension for certified recipients;
• the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum (or the UK IDTA) for UK data; and
• supplementary technical and organizational measures where needed.

You can request a copy of the relevant safeguards from support@blizo.com.

8. How long we keep data

• Account and workspace data: for the duration of the customer relationship. After a subscription or trial ends, the workspace remains available read-only for 90 days so you can export your data; afterwards we delete or anonymize it, unless you reactivate your plan earlier.
• Deleted accounts: removed from active systems after deletion is confirmed; residual copies in backups are overwritten in the regular backup cycle.
• Billing records and invoices: for the periods required by tax and commercial law, generally up to seven years after the end of the relevant financial year.
• Free report requests: report links expire after 90 days; expired contact records are then removed by our maintenance process. A reminder cookie that returns you to your report expires after seven days.
• Security and server logs: only as long as needed to detect, investigate and prevent abuse and errors.
• Analytics: until you withdraw consent, and no longer than needed for the analytics purpose under the retention settings of our analytics project.
• Legal claims: where data is needed to establish or defend legal claims, until the matter is resolved.

9. Your rights (EU and UK)

Under the GDPR and the UK GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data rectified;
• have your data erased ("right to be forgotten");
• restrict processing;
• data portability for data you provided to us;
• object at any time to processing based on legitimate interests, for reasons arising from your particular situation;
• withdraw consent at any time, without affecting earlier lawful processing; and
• lodge a complaint with a supervisory authority, in particular in your country of residence or work. Our lead authority is the Office of the Commissioner for Personal Data Protection (Cyprus). In the UK you can contact the Information Commissioner's Office (ico.org.uk).

To exercise your rights, email support@blizo.com from the address linked to your account. We may need to verify your identity and will respond within one month, extendable where permitted by law. Account owners can also export workspace data and request account deletion in the app where available.

10. Notice for United States residents

This section supplements the policy for residents of U.S. states with comprehensive privacy laws, including the California Consumer Privacy Act as amended by the CPRA.

Notice at collection

In the past 12 months we collected the following categories of personal information:

• Identifiers (name, email, IP address, account and device identifiers);
• Commercial information (plans, subscriptions, invoices, payment history);
• Internet or network activity (usage, logs and, with consent, analytics);
• Professional information (company, role, business contact details);
• Approximate geolocation derived from the IP address; and
• Customer records and content you provide to the service.

We collect this information from you, from your use of the service, from Getreach when you connect it, and from public sources and the service providers listed above. We use it for the business purposes described in section 4, disclose it to the service providers in section 6, and keep it as described in section 8. We do not collect sensitive personal information for the purpose of inferring characteristics about you.

No sale or sharing

We do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We do not knowingly sell or share personal information of individuals under 16. We treat a Global Privacy Control (GPC) signal as a request to opt out and keep optional analytics off for that browser.

Your rights

Depending on your state, you may have the right to know and access the personal information we hold, to request deletion or correction, to obtain a portable copy, to opt out of sale, sharing, targeted advertising and certain profiling, and to limit the use of sensitive personal information. We will not discriminate against you for exercising these rights. You or an authorized agent can submit a request to support@blizo.com; we will verify the request using information associated with your account. If we decline a request, you may appeal by replying to our decision; we will respond to appeals within the period required by law.

11. Cookies and analytics

We use strictly necessary cookies and similar technologies to run the service, and optional analytics (PostHog, EU cloud) only after you accept them in our cookie banner. Until then, the analytics library is not loaded. You can change your choice at any time via "Cookie settings" in the footer. Details are in our Cookie Notice.

12. Security

We protect personal data with appropriate technical and organizational measures, including encryption in transit, access controls and least-privilege access, separation of customer workspaces, hashed passwords, encrypted storage of integration secrets, rate limiting, bot protection and audit logging. No method of transmission or storage is completely secure; please report security issues to support@blizo.com.

13. Children

Blizo is a business service and is not directed to children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

14. Changes to this policy

We may update this policy when our service or legal requirements change. The version and date at the top show when it was last changed. We will inform account owners of material changes by email or in the app before they take effect.

15. Contact

Getreach Limited, Dimotikis Agoras 20, 6021 Larnaca, Cyprus
Email: support@blizo.com