Privacy Policy

Blyzaa ("we", "us") operates the blyzaa.com multi-channel marketing platform. This policy explains what personal data we collect, why, and your rights under the GDPR, UK GDPR, CCPA/CPRA, PIPEDA and CAN-SPAM.

1. Data we collect

• Account data: name, email, phone (for verification), hashed password, sign-up source.
• Workspace content: posts, campaigns, contacts you import, uploaded media, brand-training assets.
• Usage & device data: log events, IP, browser, feature usage and AI token counts.
• Payment metadata: plan, billing cycle and last-4 of a card (payments are simulated in preview; no full card data is stored).

2. How we use it

• Provide and secure the service, enforce plan entitlements and fair-use limits.
• Generate AI content via our processors (OpenAI, Anthropic, Google). Your prompts and brand assets are sent to these providers solely to fulfil your request.
• Send transactional email (verification, receipts, reports) and, with consent, marketing.

3. Legal bases

Contract (to deliver the service), legitimate interests (security, product improvement), consent (marketing, cookies) and legal obligation.

4. Your contacts & anti-spam

You are the controller of contacts you import; we process them on your behalf. Every marketing email includes an unsubscribe link and List-Unsubscribe header (CAN-SPAM / CASL). You must have lawful consent to email your contacts.

5. Sub-processors

MongoDB (database), Emergent-managed email & object storage, and the AI providers above. We require appropriate data-protection terms from each.

6. Retention

We keep account data while your account is active and delete or anonymise it within 90 days of closure, unless retention is legally required.

7. Your rights

Access, rectification, erasure, portability, restriction, objection and (CCPA) opt-out of "sale/share". We do not sell personal data. Email privacy@blyzaa.com to exercise these.

8. Security

Passwords are hashed (bcrypt), transport is encrypted (TLS), and sign-in is protected by OTP verification. No method is 100% secure.

9. International transfers & children

Data may be processed outside your region under Standard Contractual Clauses. The service is not directed to children under 16.

10. Changes

We will post updates here and, for material changes, notify you by email.