When you use BLUN, we process the following personal data:
Account data
Email address, name (on registration)
OAuth provider ID (when signing in with Google or other providers)
Selected plan and role information
Usage data
Created agents, conversations, and messages
Cost and usage data (token usage, model calls)
Activity logs (login, data export, setting changes)
Technical data
IP address, browser type and version
Operating system, device type
Access times and pages visited
Payment data
Payment information is processed exclusively by Stripe. We do not store credit card numbers or bank details on our servers.
From Stripe we only receive a reference ID, the payment status, and the amount.
3. Legal bases
Your data is processed on the basis of the following legal grounds in accordance with Art. 6 GDPR:
Art. 6 Abs. 1 lit. a (Consent): For optional features such as newsletters, analytics cookies, and advanced statistics.
Art. 6 Abs. 1 lit. b (Performance of contract): For providing the service, account management, and payment processing.
Art. 6 Abs. 1 lit. f (Legitimate interest): For security measures, fraud prevention, system stability, and improving the service.
4. Cookies
We use the following types of cookies:
Necessary cookies
blun_token: Session cookie for authentication. Without this cookie, the service cannot be used. Expires: at the end of the session.
Analytics cookies
Google Analytics (_ga, _gid, _gat): Set only with your consent. Used to analyze user behavior to improve the service.
Marketing cookies
Google Ads (_gcl_au, _gac_): Set only with your consent. Used to measure advertising campaigns.
You can change your cookie settings at any time using the button at the end of this page.
5. Google Analytics
We use Google Analytics (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to analyze user behavior on our website.
Google Analytics uses cookies to evaluate the use of the website. The information generated is usually transferred to a Google server in the USA and stored there.
IP anonymization
We have activated IP anonymization. Your IP address is truncated within the EU/EEA before being transmitted to Google.
We may use Google Ads conversion tracking to measure the effectiveness of our advertisements. Google sets a cookie when you reach our website via a Google ad.
You can disable personalized advertising in your Google settings:
Data transfers to third countries (USA) are based on standard contractual clauses (Art. 46 Abs. 2 lit. c GDPR) or an adequacy decision (EU-US Data Privacy Framework).
9. Your rights
Under the GDPR you have the following rights regarding your personal data:
Art. 15 - Right of access: You have the right to obtain information about the data stored about you.
Art. 16 - Right to rectification: You can request the correction of inaccurate data.
Art. 17 - Right to erasure: You can request the deletion of your data, unless statutory retention obligations apply.
Art. 18 - Right to restriction: You can request the restriction of processing.
Art. 20 - Right to data portability: You have the right to receive your data in a machine-readable format.
Art. 21 - Right to object: You can object to the processing of your data at any time if it is based on legitimate interest.
You can download all personal data stored at BLUN at any time in a machine-readable JSON format. This includes account data, agents, conversations, messages, cost events, and activity logs.
You can permanently delete your account and all associated data at any time. This includes all agents, conversations, messages, payment references, and activity logs.
We take appropriate technical and organizational measures to protect your data:
SSL/TLS encryption: All data transmissions are encrypted via HTTPS.
Password hashing: Passwords are stored with secure hashing algorithms and never in plain text.
Access control: Access to personal data is restricted to authorized systems and persons.
Regular updates: Servers and software are updated regularly to close security gaps.
Data backup: Regular backups ensure the availability and integrity of the data.
13. Retention periods
Account data: Stored as long as your account is active. After account deletion, all data is removed immediately and permanently.
Usage data: Stored for the duration of account usage.
Payment data: References are retained in accordance with statutory tax retention obligations (7 years under Austrian tax law, BAO).
Activity logs: Stored for a maximum of 12 months for security purposes.
Consents: Records of granted consents are retained for the duration of the business relationship and for 3 years thereafter.
14. Right to complain
If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with the competent supervisory authority:
