Privacy Policy

Controller: BLINKHOST LTD (CAC 9479867), 09 Ije Avenue, Abakaliki, Ebonyi State, Nigeria. Privacy contact: privacy@blinkhost.me.

1. Scope and roles

This policy covers BlinkHost websites, accounts, control plane, support, billing and platform operations. BlinkHost is a controller for account, commerce, security and its own service-usage data. For personal data a customer submits through a deployed application, customer database or customer-selected application telemetry, BlinkHost generally acts as processor under the Data Processing Addendum; the customer remains responsible for its notices, lawful basis and visitor choices.

2. Data we process

• Identity and account: name, email, provider identifiers, memberships and settings.
• Commerce: billing identity and address, country, tax identifier, plan, invoice, non-secret transaction references, amount and payment status. Payment-card data is handled by the payment processor.
• Platform content: projects, connected-repository identifiers and permissions, Git references and committed source selected for import or build, artifacts, project assets, preview-session data, domains, configuration, database content, encrypted secrets, support messages and customer-provided data.
• Technical and usage: IP address, device and browser information, timestamps, technical identifiers, authentication and security events, source-control webhook and operation status, feature use, preview, build and runtime diagnostics, uploaded-file security scan results, performance and errors.
• Customer application telemetry: tenant-scoped logs, metrics, traces, runtime-policy decisions and real-user performance measurements that the customer activates for a project.
• Communications: support correspondence and delivery/preferences evidence.

Do not place secrets, payment-card data or unrelated sensitive personal data in support, feedback or log fields.

3. Purposes and lawful bases

We process data to create accounts and provide requested service (contract or pre-contract steps); secure the service, scan uploads for malware and platform threats, prevent abuse and improve reliability (legitimate interests and legal duties); bill, account and respond to authorities (contract and legal obligation); send service communications (contract or legitimate interests); and run non-essential analytics or marketing only with consent where required. We document balancing where legitimate interests are used.

4. Sharing and service providers

We disclose personal data only as needed to operate and secure the service, provide infrastructure, email and database services, process payments, perform source collaboration you authorise, follow lawful instructions, protect rights or comply with law. A connected source provider receives only the repository operations requested under the permission you granted. We require service providers to protect personal data consistently with their role and our legal obligations. We do not sell personal data or use customer content for third-party advertising. Contact privacy@blinkhost.me for information about relevant provider categories and transfer safeguards.

5. International transfers

Our service providers process data in Nigeria and other countries where they operate. We assess destination and recipient risk and use an applicable lawful mechanism, contractual safeguards and supplementary technical controls as required by the Nigeria Data Protection Act 2023. Contact us for relevant safeguard information.

6. Retention and deletion

We keep data only as long as needed for the stated purpose, active service, security, disputes and legal duties. Product and customer-application telemetry follow disclosed plan retention. We verify and report the scope of deletion. Removal from a product view does not by itself establish removal from related records, protected recovery copies or provider systems; we explain applicable retention and limitations when handling a request. Billing and acceptance evidence may be retained for tax, accounting, fraud and legal periods. A documented legal hold may temporarily preserve a narrow scope. Internal retention schedules are reviewed at least annually.

7. Security and incidents

Measures include tenant-scoped authorisation, least-privilege access, managed identities, encryption in transit and at rest, secret isolation, uploaded-file validation and malware scanning, audit logging, monitoring, backups and incident procedures. Customers remain responsible for their users, application configuration and lawful content. Report a suspected security or privacy issue to security@blinkhost.me or privacy@blinkhost.me.

8. Your rights

Subject to applicable law, you may request information and access, correction, deletion, restriction, objection, portability, withdrawal of consent and review of a significant solely automated decision. We may verify identity, authority and scope. We may retain information where law permits or requires and will explain a refusal or limitation. Email privacy@blinkhost.me. You may complain to the Nigeria Data Protection Commission or another competent supervisory authority.

9. Cookies and analytics

Essential cookies and similar storage support sessions, CSRF protection, checkout continuity and preferences. Customer real-user monitoring is separate from BlinkHost account analytics, disabled by default and activated by an authorised customer for each project. We do not use third-party advertising cookies.

10. Children and automated decisions

BlinkHost is not directed to children, and account holders must be legally able to contract. Automated security and operational checks help detect risk, but we do not intentionally make solely automated decisions producing legal or similarly significant effects without applicable safeguards.

11. Changes and contact

We publish each version and effective date and give reasonable notice of material changes. Contact BLINKHOST LTD at 09 Ije Avenue, Abakaliki, Ebonyi State, Nigeria or privacy@blinkhost.me.

Connected-source collaboration records

When customers use source collaboration, templates or Agency handoffs, BlinkHost processes the participating account identifiers, access scope, invitations, acknowledgements, reviews, template and version identifiers, handoff decisions, security results and related activity records needed to provide, secure and evidence those features.

Short-lived presence data is removed when it is no longer needed for the active session. Recoverable collaboration history follows the retention included with the workspace plan. Source reviews, approvals, security attestations and handoff records may be retained for the service term and a reasonable period afterwards for security, disputes, legal compliance and establishment or defence of claims. Customer-requested evidence export files expire from BlinkHost download storage after seven days; a customer's downloaded copy is under that customer's control. Narrow records may be preserved longer where required by law or a documented legal hold.

Live editing and presence data

To provide live co-editing, BlinkHost processes the project and document identifiers, participating account display names, access roles, short-lived presence and cursor information, edit acknowledgements, synchronized document updates and recovery records. Presence expires shortly after a participant leaves. A browser may keep unacknowledged edits in that browser profile until they are accepted or the browser data is removed.

Acknowledged edit history follows the retention stated in the workspace plan and may be consolidated into integrity-checked checkpoints. Access, security and audit records may be retained for the periods described elsewhere in this Policy, including where reasonably needed for security, disputes or legal obligations.

Marketplace and referral information

For a Microsoft Marketplace order, BlinkHost receives and uses the subscription, offer, plan, purchaser-tenant and purchaser-object identifiers, lifecycle status, quantity, timestamps and reconciliation evidence needed to activate, provide, secure and account for the service. Microsoft separately processes purchasing, payment, invoicing, tax and payout information under its own applicable terms and privacy notice.

For an approved referral programme, BlinkHost processes the referral code, referring and referred workspace identifiers, attribution time, verified activation and paid-conversion state, benefit decision and fraud-prevention evidence. A Marketplace order or referral does not by itself provide permission for unrelated marketing.

Files uploaded through customer applications

When a customer application uses Hosted Object Storage, BlinkHost processes the files, related metadata, technical identifiers and security-scan results needed to receive, protect, store and deliver them. The BlinkHost customer determines why the application collects those files and who may access them. End users should direct requests about the content and use of their files to the operator of that application; BlinkHost supports the operator in responding as required by applicable law.

Function payloads and results

When a customer configures an asynchronous function, BlinkHost processes the submitted payload, execution result, technical identifiers, logs, timing, resource-use measurements, and retry status needed to deliver and operate the function. Payloads and results are stored privately for a bounded period and deleted under the published retention schedule. The BlinkHost customer determines the purpose and lawful basis for Personal Data submitted by its application.

Product feedback, evidence and public testimonials

When you submit feedback, BlinkHost processes the experience details and the identity, contact information and evidence you choose to provide to understand the product, respond where permitted, investigate issues and improve the service. The form separately records any optional permission to use an attributed or anonymous excerpt on specified public channels. Nothing is published automatically. We retain the notice version, choices and an audit record so we can honour and demonstrate those instructions.

Evidence uploads are private by default and may be quarantined, scanned, reviewed and deleted for security. Remove credentials and unrelated personal information before uploading. You can withdraw optional public-use permission through the private link supplied after submission or by contacting privacy@blinkhost.me. Withdrawal stops future eligible display and contact; a restricted record may be retained where necessary to demonstrate the withdrawal, protect rights or comply with law.

Release compatibility guidance

To provide release and migration guidance, BlinkHost processes declared CLI, SDK, runtime, manifest and dependency versions together with bounded evidence already supplied through an authenticated build, deployment or CLI session. A compatibility finding records its evidence source and confidence. BlinkHost does not perform unrelated background inspection of customer source merely to produce a version notice.

Routine release changes remain in the dashboard, documentation and CLI. BlinkHost may send an operational email when confirmed evidence shows that a security update, required migration or retirement deadline affects a project or CLI session associated with the account. This information is used to provide, secure and support the service, not for advertising. Compatibility observations follow the applicable project and operational-evidence retention controls and are removed or de-identified when no longer needed.

Idam AI assistance

When you ask Idam to plan, investigate or work on a project, BlinkHost processes your request, the project information prepared for that task, any saved project guidance included with it, and the source files you select and authorise for sharing. Depending on the action, the task may also include earlier requests and replies, generated proposals, and results from authorised tools. These records can contain personal data you or other authorised users supply. We use them to provide the requested assistance, maintain task history and continuity, and operate, secure and account for the service. Do not include credentials or unrelated sensitive personal information.

When you attach files from your device, Idam prepares supported text, images or selected video frames as context for your request. It does not execute uploaded files. When you choose voice transcription, your recording is sent to Azure OpenAI to produce text that you can review and edit before submitting it. Original uploads and recordings are discarded after processing. Prepared attachment context and transcripts that you do not submit expire after 24 hours; submitted context follows the retention of its task.

Idam sends the task content needed for model processing to Microsoft's Azure OpenAI service. Microsoft states that prompts and responses for these Azure-hosted models are not available to OpenAI or other customers and are not used to train foundation models without permission or instruction. Idam does not submit this content for model training. Microsoft's service may analyse prompts and responses for abuse and retain flagged content for review by authorised Microsoft personnel. BlinkHost does not represent Idam as a zero-data-retention service. See Microsoft's data privacy documentation.

Idam currently uses Azure global model deployments. Inference may take place in any geography supported by the relevant global deployment; the location of BlinkHost's Azure resource does not confine inference to that region. The international-transfer provisions of this Policy apply. Contact privacy@blinkhost.me before submitting content that requires a specific processing location or provider-retention arrangement.

Submitted requests and replies are saved so that you can reopen eligible conversations. Saved project guidance can be included in future tasks, and a follow-up or workflow can contain copies of earlier content. Clearing guidance changes its use for later work but does not recall requests already sent to the model. Removing content from one task does not by itself remove copies in other tasks, workflows, project records or downloaded exports.

When you use internet research, Idam sends a public search query through Azure Foundry to Bing. Private project context is excluded from search requests. Microsoft processes search queries, related service metadata and search results under the Microsoft Privacy Statement. Bing search processing is separate from the Azure OpenAI data protections described above; Microsoft acts as an independent controller for that processing. Idam keeps the grounded answer and its references with your task. Opening a cited website is subject to that site's privacy practices.

When you connect an external service through MCP, Idam can send authorised tool arguments to that service and use its responses for your task within the permissions granted. Your organisation controls the connection and can revoke access. The external service's terms, charges and privacy practices apply separately. Sign-in takes place in your own browser; connection credentials are stored encrypted and excluded from ordinary task messages and analytics. Revoking a connection prevents further authorised use but does not recall information already sent or undo completed actions.

The shared preview browser processes the generated application, session controls, annotations and captures needed to show and verify its behaviour. Private sign-in is kept outside this shared view. Avoid putting secrets or unrelated personal information in application content, annotations or visible screens. Restricted internal analytics use bounded operational metadata, such as task identifiers, timings, capabilities, outcomes and usage amounts, to measure reliability and improve the service. Default analytics exclude raw prompts, source files, attachments, credentials and private sign-in content; access to task content remains subject to the applicable permissions.

Idam keeps separate records for usage, credit reservations and charges, security, approvals and prevention of duplicate execution. These records can remain after task content is removed where needed for accounting, security, disputes or legal duties. Protected database backups, worker recovery copies and separately created restore copies require their own retention and deletion handling. Provider records are subject to the provider's applicable processing and retention terms. Contact privacy@blinkhost.me for an access, export or deletion request; we verify your authority and the affected scope and explain any retained categories or limitations. A completed task-content removal must not be understood as confirmation of immediate erasure from every system or backup.