# Blogged policies > Current legal and privacy documents for Blogged's autonomous SaaS blogging platform. Owner and operator: BoostYard LLC Address: 16192 Coastal Highway, Lewes, DE 19958, United States Effective date: August 20, 2026 Contact: hi@blogged.dev Policy center: https://blogged.dev/policies # Privacy Policy Canonical URL: https://blogged.dev/policies/privacy This policy explains the personal information Blogged collects, why it is used, who receives it, how long it is kept, and the choices available to you. ## 1. Scope and our role Blogged is a product owned and operated by BoostYard LLC, a Delaware limited liability company. In this policy, “Blogged,” “we,” “us,” and “our” mean BoostYard LLC. This Privacy Policy applies to Blogged's marketing website, documentation, account and workspace experience, support communications, billing relationship, and the services used to research, create, optimize, schedule, host, and measure customer content. It does not replace the privacy notice of a Blogged customer whose published blog you visit. Blogged is a controller or business for account, billing, support, security, and marketing-site information that it determines how to use. When Blogged hosts a customer's blog or processes its subscribers, leads, content, private knowledge, analytics, or publication instructions, the customer is normally the controller or business and Blogged acts as its processor or service provider. The Data Processing Addendum governs that processing. ### Customer blogs The customer decides what to publish, what forms and calls to action to use, whether to add analytics or advertising tags, and what privacy notice applies to its readers. Direct privacy requests about a customer's blog should normally go to that customer first. ## 2. Information we collect | Category | Examples | Sources | | --- | --- | --- | | Account and workspace | Name, work email, authentication identifiers, profile details, workspace membership, role, and SaaS URL | You, your workspace administrator, Firebase Authentication, and Google Sign-In when selected | | Customer content and instructions | Product descriptions, strategy, topics, briefs, drafts, posts, revisions, sources, uploaded documents, knowledge facts, competitors, images, brand settings, publication schedules, prompts, and feedback | You, authorized workspace members, customer-approved public sources, and product workflows | | Publishing and integration data | Domains, DNS verification state, blog settings, Search Console property data, OAuth scopes and encrypted tokens, tracker IDs, custom code, webhook settings, and delivery results | You, your connected services, your website, and service providers | | Billing and commercial | Plan, usage, trial eligibility, subscription status, invoices, billing address, tax status, promotion codes, payment outcome, and Stripe customer or subscription identifiers | You, your workspace, and Stripe. Blogged does not receive full payment-card numbers | | Support and communications | Messages, requests, survey or feedback responses, billing-notice delivery, bounce and complaint status, and related account context | You, your team, and communications providers | | Device, usage, and security | IP address, browser and device data, timestamps, page or feature interactions, logs, error details, authentication events, rate-limit records, and anti-abuse signals | Your browser, device, network, and Blogged systems. Some rate-limit records store a one-way hash of the IP address | | Customer-blog reader data | Subscriber email, lead-form data, consent or preference state, on-site searches, reader feedback, CTA views and clicks, campaign parameters, and page-level engagement events | Readers of customer blogs, under the customer's configuration and instructions | Please do not submit government identifiers, payment-card data, health information, biometric data, precise location, or other sensitive personal information to prompts, briefs, knowledge, uploads, custom code, or support unless Blogged has expressly agreed in writing that the use is supported. ## 3. How we use information - Provide and operate accounts, workspaces, projects, the Editor, Knowledge, Assets, Competitor Watch, Blog Site, Insights, and Autopilot. - Scan customer-directed public sources, perform web research, generate and review content and images, maintain knowledge provenance, and run publication safeguards. - Host blogs, serve previews, connect domains, publish or unpublish posts, process forms, deliver customer-configured webhooks, and measure content performance. - Authenticate users, maintain permissions, secure credentials, prevent fraud and abuse, rate-limit public endpoints, debug failures, and preserve service reliability. - Administer trials, subscriptions, taxes, invoices, plan allowances, cancellations, payment recovery, and transactional billing notices. - Answer support requests, communicate service and policy changes, and improve product usability and performance. - Meet legal obligations, enforce agreements, resolve disputes, and protect Blogged, customers, readers, and the public. Where the GDPR or UK GDPR applies, the usual legal bases are performance of a contract, legitimate interests in operating and securing a business service, compliance with law, and consent where consent is required, including for certain cookies or connected services. You may withdraw consent without affecting processing that occurred before withdrawal. ## 4. AI, research, and autonomous publishing Blogged sends the instructions and context needed for a task to Google Cloud's Vertex AI services. That context may include customer prompts, briefs, product facts, excerpts from approved sources, draft content, feedback, and image instructions. In production, Blogged uses Vertex AI under Google Cloud terms. Google states that it does not train or fine-tune its AI models on customer data without permission or instruction, although limited logging may occur for security and abuse monitoring under its terms. Blogged uses Exa to search the public web for research and competitor context. Search queries should not contain personal or confidential information. Results and source excerpts may be stored with the relevant research, knowledge, or draft record so a customer can review provenance and publication decisions. Full Autopilot can schedule and publish content when the customer has enabled it and the configured direction, eligibility, and governance checks pass. Assisted mode waits for human review. Blogged records workflow state, approvals, holds, revisions, and publication evidence to operate these controls and investigate failures. ## 5. Google account and Search Console data If you connect Google Search Console, Blogged requests the scopes displayed during Google's authorization flow. Blogged uses that access to list and verify properties, read search performance and URL inspection information, synchronize reports, and, only when the granted scope allows and you request it, submit a sitemap. OAuth tokens are encrypted at rest. Disconnecting the integration revokes the token with Google and removes the active connection from Blogged. ### Limited use Blogged's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Google user data is not used for advertising, sold, or used to train generalized AI models. ## 6. How information is disclosed - Service providers. Blogged uses providers for cloud hosting, authentication, storage, AI processing, public-web search, payment processing, transactional email, analytics, security, and related infrastructure. The current list is on the Subprocessor List. - Your workspace. Owners, admins, editors, and viewers receive access according to their role. Workspace owners and admins control membership and may access or export customer data within the product. - Customer-directed recipients. Blogged sends data to a tracker, custom script, lead webhook, connected Google property, domain provider, or other integration when the customer configures or requests that transfer. - Readers and the public. Published posts, author details, sources, media, blog settings, and other content selected for publication become public. Private previews use short-lived links but should still be shared carefully. - Professional advisers and authorities. Blogged may disclose information to auditors, insurers, lawyers, accountants, regulators, courts, or law enforcement when reasonably necessary and legally permitted. - Business transactions. Information may be transferred in connection with financing, due diligence, a merger, acquisition, reorganization, insolvency, or sale of assets, subject to appropriate confidentiality and notice requirements. Blogged does not sell personal information for money. Blogged does not use customer content, private knowledge, Google user data, or customer-blog subscriber and lead data to advertise third-party products. After analytics consent, Google Analytics 4 and Microsoft Clarity process pseudonymous interaction data on Blogged's own marketing, documentation, and account surfaces for product analytics. Advertising storage, ad-user-data consent, ad personalization, Google signals, and ad-personalization signals remain disabled in Blogged's configuration. Each provider may also operate as an independent controller under its terms. ## 7. Customer-controlled trackers, forms, and webhooks A customer may add Google Analytics, Google Tag Manager, Meta Pixel, LinkedIn Insight Tag, TikTok Pixel, or custom head code to its published blog. The customer decides whether to use those tools and is responsible for a lawful basis, notice, consent, vendor terms, and honoring reader choices. Custom code executes in the blog page and may collect or disclose information independently of Blogged. When enabled by the customer, Blogged's blog cookie banner describes the configured tag categories and stores the reader's accept or decline choice in local storage for 180 days. Do Not Track and Global Privacy Control disable customer-configured tags by default unless the customer deliberately overrides that setting. Blogged's first-party, aggregated reporting continues to honor those signals. Customer-configured lead webhooks can send subscriber or lead details to the customer's endpoint. After delivery, the recipient's privacy practices govern its copy. Blogged applies destination validation and delivery controls, but the customer remains responsible for the endpoint, recipient, and requested fields. ## 8. Retention and deletion Blogged keeps personal information for as long as needed to provide the service, maintain an active business relationship, comply with law, resolve disputes, protect security, and enforce agreements. Retention depends on the record and its purpose rather than one blanket period. - Account, workspace, project, content, knowledge, asset, publication, and integration records generally remain while the account or relevant project is active. Archiving a project pauses active work but is not deletion, and its published blog can remain online. - Short-lived previews expire after their configured lifetime. Operational jobs, leases, idempotency records, and some execution traces expire under service-specific schedules when they no longer support recovery or audit needs. - Billing, tax, invoice, contract, fraud-prevention, payment-recovery, and suppression records may be kept for legal, accounting, security, or deliverability obligations after service ends. - Unsubscribed customer-blog readers remain marked unsubscribed so the customer does not contact them again. Authorized customer users can permanently delete subscriber records in the product. - Deletion from active systems may not immediately remove encrypted backups, disaster-recovery copies, or records that law requires Blogged to retain. Those copies remain protected and age out under normal cycles. Because the current product supports project archive and restore rather than full self-service account erasure, contact Blogged to request deletion of an account or workspace. Blogged will verify authority and explain any data that must be retained or that belongs to another workspace member or customer. ## 9. Security Blogged uses technical and organizational safeguards designed for the nature of the service, including role-based workspace access, server-enforced tenant boundaries, encryption in transit, managed cloud encryption at rest, encrypted Search Console tokens, restricted secret storage, audit and revision records, rate limits, webhook destination validation, and monitoring. No internet service can guarantee absolute security. You are responsible for protecting account credentials, assigning the minimum necessary workspace role, reviewing who can publish or configure executable code, and notifying Blogged promptly of suspected unauthorized access. ## 10. International transfers Blogged and its providers may process information in the United States and other countries where they operate. Those countries may have different privacy laws from your location. Where required, Blogged uses contractual protections such as the European Commission's Standard Contractual Clauses, the UK transfer addendum, provider data-processing terms, or another lawful transfer mechanism. More detail appears in the Data Processing Addendum and Subprocessor List. ## 11. Your privacy rights Depending on your location and Blogged's role, you may have rights to access, know, correct, delete, restrict, object to, or receive a portable copy of personal information, withdraw consent, opt out of certain disclosures, and appeal a decision. You may also complain to your local data-protection authority. Blogged will not discriminate against you for exercising a privacy right. Send a request to hi@blogged.dev. Describe the account, workspace, blog, or email address involved and the right you want to exercise. Blogged may verify identity and authority before acting. If Blogged processes the information only for a customer, it may direct the request to that customer or help the customer respond. ## 12. California privacy notice The table in Section 2 describes the categories of personal information collected during the preceding 12 months, the sources, and representative data elements. Sections 3 and 6 describe business purposes and recipient categories. Blogged may collect identifiers, customer records, commercial information, internet or electronic activity, professional information, approximate location derived from IP address, audio or visual content a user uploads, and inferences used to provide product strategy or security. Blogged does not intentionally collect sensitive personal information for inferring characteristics. Blogged has not sold personal information for money. It has disclosed identifiers, commercial information, internet activity, and customer-directed content to service providers for the business purposes described here. To exercise rights to know, access, correct, delete, or obtain portability, use the contact method in Section 11. Analytics on Blogged's own surfaces remains off until the visitor explicitly allows it, and advertising consent remains denied. A Global Privacy Control signal is treated as an opt-out signal on supported analytics and customer-blog tracking surfaces. Blogged does not knowingly sell or share personal information of anyone under 16. ## 13. Children Blogged accounts and autonomous content services are for business users who are at least 18 or the age of legal majority where they live. Blogged does not knowingly create accounts for children. Customer blogs are public websites controlled by customers; customers are responsible for ensuring their content, forms, trackers, and audience practices are appropriate for their intended readers. ## 14. Changes and contact Blogged may update this policy as the service, providers, or law changes. The effective date at the top identifies the current version. Material changes will receive additional notice when required by law or when they materially change how existing account or Google user data is used. For privacy questions or requests, contact BoostYard LLC at hi@blogged.dev or write to: BoostYard LLC, Attn: Privacy, 16192 Coastal Highway, Lewes, DE 19958, United States. --- # Terms of Service Canonical URL: https://blogged.dev/policies/terms These Terms govern Blogged accounts, autonomous content workflows, hosted blogs, subscriptions, integrations, and customer responsibilities. ## 1. Agreement and eligibility These Terms of Service are a binding agreement between you and BoostYard LLC, a Delaware limited liability company that owns and operates Blogged. In these Terms, “Blogged,” “we,” “us,” and “our” mean BoostYard LLC. If you create or use an account, click to accept, purchase a subscription, or use the service after these Terms are presented, you accept these Terms, the Privacy Policy, the Acceptable Use Policy, and the Data Processing Addendum where it applies. You must be at least 18 or the age of legal majority where you live. If you use Blogged for a company or other organization, you represent that you have authority to bind it. In that case, “you” and “Customer” mean that organization. The service is intended for business use, not personal, family, or household use. ## 2. The service Blogged is an autonomous content and blog-publishing platform for SaaS companies. Depending on configuration and plan, it can scan approved public sources, maintain product knowledge, research the market, propose topics, generate and edit posts and images, apply SEO and GEO controls, schedule publication, host a public blog, connect domains, collect subscribers or leads, and report search and reader signals. Features, limits, availability, and workflows may change as Blogged improves the service. Current product pages, documentation, the selected plan, and any signed order form describe the service you receive. If an order form conflicts with these Terms, the order form controls for that conflict. ## 3. Accounts, workspaces, and authority - Provide accurate account and billing information and keep it current. - Protect credentials, use appropriate authentication, and notify Blogged promptly of suspected compromise. - Use workspace roles carefully. Owners and admins can manage members, billing, projects, integrations, trackers, webhooks, and other consequential settings. - You are responsible for actions taken through your account and by people you invite, except to the extent caused by Blogged's breach of these Terms. - Disputes about control of a workspace, domain, source, or company account may require documentation. Blogged may preserve the status quo while authority is verified. ## 4. Autopilot and publication authority Assisted Autopilot creates drafts that wait for human review. Full Autopilot can plan, generate, schedule, and publish without a person approving each post after you activate it and approve the governing Content Direction. You authorize Blogged to perform the actions enabled by your selected mode, schedule, content direction, publication policy, and settings. - Review product facts, strategy, sources, content directions, brand settings, calls to action, forms, and publication controls before activating autonomous publication. - Use holds, pauses, review rules, and role permissions when content requires human approval. - Monitor the dashboard and weekly or service notices. A safeguard reduces risk but is not a legal, factual, regulatory, brand, or professional review. - You remain the publisher and are responsible for content published to your hosted or custom domain, including content published through Full Autopilot. ## 5. Customer content and permissions As between you and Blogged, you retain ownership of content, data, trademarks, logos, documents, images, instructions, and other material you submit or direct Blogged to process (“Customer Content”). You grant Blogged a worldwide, non-exclusive, limited license to host, copy, transform, analyze, transmit, display, publish, and otherwise process Customer Content only to provide, secure, support, and improve the service for you, comply with law, and exercise rights under these Terms. You represent that you have the rights, notices, lawful bases, and permissions needed for Customer Content and for Blogged to process it as instructed. This includes private uploads, product and competitor material, reader or subscriber data, logos, screenshots, testimonials, tracking code, webhook data, and content imported from another system. Do not submit confidential information that should not be used in generation, research, support, or publication workflows. Access labels and publication controls reduce accidental use but do not replace your own information-classification and approval process. ## 6. Generated output and editorial responsibility Subject to third-party rights and applicable law, Blogged does not claim ownership of the new text or images generated for you. You may use exported and published output under these Terms. Generated output can be inaccurate, incomplete, outdated, similar to output provided to others, or unsuitable for your circumstances. Sources and content scores are decision support, not a guarantee. - Verify material claims, quotations, pricing, comparisons, citations, dates, legal statements, and calls to action before relying on them. - Do not present AI-generated content as professional legal, medical, financial, safety, employment, or regulatory advice. - Review for intellectual-property, privacy, publicity, confidentiality, consumer-protection, advertising, and industry-specific obligations. - Use exact uploaded or approved assets when product fidelity matters. Reference-guided image generation does not guarantee exact reproduction. ## 7. Research, sources, and crawling You may direct Blogged to scan your site, approved sources, and approved competitor sites. You authorize the identified BloggedBot crawler to access publicly reachable pages within the configured scope. Blogged does not bypass authentication, paywalls, or technical access controls. Its robots.txt handling is described on the About BloggedBot page. You are responsible for choosing lawful sources and using research results lawfully. A public page is not automatically free of copyright, database, contract, privacy, or publicity restrictions. Citations, links, or source excerpts do not transfer ownership of the underlying material. ## 8. Hosted blogs, domains, forms, and trackers - You control blog content, branding, navigation, forms, calls to action, cookie-banner settings, trackers, and custom code. You must publish your own accurate privacy and cookie notices for readers. - You authorize Blogged to serve published content through a hosted Blogged subdomain, a verified custom subdomain, or another supported publishing setup you configure. - You must control or have permission to use each custom domain. DNS, registrar, proxy, certificate, or third-party configuration outside Blogged remains your responsibility. - Custom code executes on public pages. You are responsible for its security, legality, disclosures, and behavior. Blogged may disable code that threatens the service or other users. - You are responsible for the destination, security, authorization, and privacy terms of each lead webhook or customer-selected integration. - If you collect emails or leads, you are responsible for consent, notices, marketing law, suppression, honoring unsubscribe and deletion requests, and downstream use. ## 9. Third-party services Blogged relies on third-party infrastructure and offers optional connections to third-party services. Their terms and privacy practices govern your direct use of them. Blogged is not responsible for a third party's service, changes, suspension, data, or acts. You authorize Blogged to exchange the information needed to provide a connection you enable. Google Search Console access is limited to the authorized property and scopes. Stripe handles payment credentials, checkout, tax, invoices, and the billing portal. Customer-added analytics and advertising vendors receive data under the customer's configuration, not because Blogged uses that data for its own advertising. ## 10. Plans, trials, fees, and taxes Paid plans are subscriptions billed in advance at the interval shown at checkout. Prices, included projects, post allowances, product limits, multi-project discounts, promotion terms, and add-ons are shown before purchase or in an order form. Usage beyond an included allowance may require an add-on or plan change rather than silently creating an overage charge. An eligible customer may receive the trial shown at checkout. A payment method is required. Unless canceled before the stated trial end, the selected paid subscription starts and Stripe charges the amount disclosed at checkout plus applicable tax. Trial eligibility may be limited by person, email, Stripe customer, payment instrument, workspace, or prior use to prevent repeated trials. Fees exclude taxes unless checkout says otherwise. Stripe calculates applicable sales tax or VAT from billing information and supports eligible tax IDs. You are responsible for taxes, duties, and accurate billing details, other than taxes on Blogged's net income. Except where law requires otherwise or an order form states otherwise, fees already paid are non-refundable and unused plan capacity does not roll over or convert to cash. Blogged may correct a billing error, duplicate charge, or service failure with a refund or credit at its discretion without creating an ongoing obligation. ## 11. Renewal, cancellation, and payment failure Subscriptions renew automatically at the selected interval until canceled. You can cancel from workspace billing settings. Cancellation normally takes effect at the end of the current paid period, and access continues until then. Canceling during a trial prevents the first paid renewal when completed before the deadline shown in the product. If payment fails, Blogged may provide a limited recovery period while Stripe retries. Access may be restricted or end if payment is not recovered. Canceling or losing paid access does not automatically delete Customer Content. A project may become read-only, be archived, or retain its published blog as the product indicates. Contact Blogged if you want data deleted rather than retained. Blogged may change future prices by giving legally required notice. A price change applies no earlier than the next renewal after the stated effective date, unless you separately agree to an immediate plan change. ## 12. Acceptable use You must follow the Acceptable Use Policy. You may not use Blogged to violate law or rights, deceive readers, distribute malware or spam, exploit children, create dangerous professional advice, access systems without authorization, manipulate search through abusive schemes, or interfere with the service. You are responsible for users, Customer Content, custom code, trackers, forms, and integrations under your account. ## 13. Confidentiality and security Each party may receive non-public information that a reasonable person would understand to be confidential. The receiving party will use it only to perform or exercise rights under the agreement, protect it with reasonable care, and disclose it only to people and providers who need it and are bound to protect it. This does not cover information that is public without breach, already lawfully known, independently developed, or lawfully received without restriction. A party may disclose confidential information when law requires it, if legally permitted after giving reasonable notice and assistance. Blogged's Data Processing Addendum contains additional personal-data commitments. You must use the service in a manner consistent with its documented security controls. ## 14. Blogged technology, marks, and feedback Blogged and its licensors own the service, software, workflows, designs, models or model access, documentation, trademarks, and related intellectual property, excluding Customer Content and generated output allocated to you above. These Terms give you a limited, non-exclusive, non-transferable right to use the service during the subscription for your internal business and customer-facing blog operations. If you provide suggestions or feedback, you grant Blogged a perpetual, irrevocable, worldwide, royalty-free right to use it without restriction or attribution. This does not give Blogged the right to identify you publicly or use Customer Content as a testimonial without permission. Send copyright, trademark, privacy, or other rights complaints to hi@blogged.dev with the URL, the protected work or right, your authority, a good-faith explanation, and accurate contact information. Blogged may remove or restrict disputed content while reviewing a complete notice and may notify the customer who supplied it. ## 15. Suspension and termination Blogged may suspend access, generation, publication, integrations, or public delivery when reasonably necessary to address a security threat, unlawful content, an Acceptable Use Policy violation, nonpayment, material breach, third-party service restriction, legal demand, or risk to other customers. When practical, Blogged will limit the suspension and give notice and an opportunity to cure. Either party may terminate for a material breach that is not cured within a reasonable written cure period, or immediately when the breach cannot be cured. You may end the commercial relationship by canceling all subscriptions and ceasing use. Sections that by their nature should survive will survive, including payment obligations, confidentiality, ownership, disclaimers, indemnity, liability limits, and dispute terms. ## 16. Disclaimers To the maximum extent permitted by law, the service, generated output, research, scores, recommendations, preview environments, and third-party integrations are provided “as is” and “as available.” Blogged disclaims implied warranties of merchantability, fitness for a particular purpose, title, non-infringement, and any warranty arising from course of dealing or usage of trade. Blogged does not promise uninterrupted service, specific rankings, indexing, citations by AI systems, traffic, leads, revenue, conversion, publication frequency, factual accuracy, legal compliance, or that generated output is unique or free of third-party rights. SEO, GEO, Search Console, and reader analytics report signals and support decisions; they do not control search engines, AI systems, readers, or market outcomes. ## 17. Indemnity To the maximum extent permitted by law, Customer will defend and indemnify Blogged and its personnel against third-party claims, damages, losses, and reasonable costs arising from Customer Content, a customer blog, a customer-directed source or integration, Customer's breach of these Terms or the Acceptable Use Policy, or Customer's violation of law or another person's rights. Blogged will give prompt notice, reasonable cooperation at Customer's expense, and control of the defense to Customer, provided no settlement admits fault by or imposes obligations on Blogged without consent. ## 18. Limitation of liability To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, exemplary, punitive, or consequential damages, or for lost profits, revenue, goodwill, opportunities, or data, even if advised they were possible. This exclusion does not limit Customer's payment obligations or misuse of Blogged intellectual property. To the maximum extent permitted by law, each party's total aggregate liability arising from the service and agreement will not exceed the fees Customer paid or owed to Blogged for the affected service during the 12 months before the event giving rise to liability. Nothing limits liability that cannot lawfully be limited, including liability for fraud, willful misconduct, or death or personal injury caused by negligence where applicable law prohibits a limit. ## 19. General terms Neither party is liable for delay caused by events beyond its reasonable control, except payment obligations. You may not assign the agreement without Blogged's consent, except with a merger, reorganization, or sale of substantially all relevant assets if the assignee accepts the agreement. Blogged may assign it in connection with the same types of transaction or to an affiliate. The parties are independent contractors, and there are no third-party beneficiaries unless a law says otherwise. The governing law and forum stated in a signed order form or other written agreement apply. If no written agreement specifies them, applicable conflict-of-law and jurisdiction rules determine governing law and forum. The United Nations Convention on Contracts for the International Sale of Goods does not apply where its exclusion is permitted. Notices to Blogged must be sent to hi@blogged.dev or to BoostYard LLC, Attn: Legal, 16192 Coastal Highway, Lewes, DE 19958, United States. Blogged may send notices to the account email, through the product, or on the service. If a provision is unenforceable, it will be limited to the minimum extent necessary and the rest remains effective. A waiver must be explicit and is not a continuing waiver. These Terms and incorporated policies, plus any order form, are the complete agreement about the service. ## 20. Changes to these Terms Blogged may update these Terms. The date at the top identifies the current version. Material changes will receive reasonable advance notice when practicable and as law requires. Changes do not retroactively rewrite accrued payment obligations or a signed order form. Continued use after the effective date constitutes acceptance where law permits; if you do not agree, stop using the service and cancel before the change takes effect. --- # Cookie Notice Canonical URL: https://blogged.dev/policies/cookies This notice describes storage and tracking on Blogged's own surfaces and explains the separate controls available to customers on published blogs. ## 1. What this notice covers BoostYard LLC owns and operates Blogged. This notice covers cookies, browser storage, pixels, scripts, and similar technologies on Blogged's marketing website, documentation, and account experience. It also explains how Blogged's optional consent controls work on customer-published blogs. A customer's own privacy and cookie notice governs the trackers and custom code that customer chooses. ## 2. Blogged website and account technologies | Technology | Purpose | Duration or control | | --- | --- | --- | | Firebase Authentication browser storage | Keep users signed in, refresh authentication, and protect account access | Persists according to authentication state and is cleared when the user signs out or clears site data | | Interface and tenant preferences | Remember local product choices, active workspace context, and interface state | Varies by preference; clear it through browser site-data controls | | Google Analytics 4 | Measure page views, acquisition, navigation, button and form interactions, scroll depth, web performance, signups, logins, and verified subscription outcomes | Off until you select Allow analytics. Google analytics cookies and Blogged's shared choice are limited to 180 days | | Microsoft Clarity | Understand page rendering and aggregated interactions such as clicks, scrolls, navigation, and session behavior so Blogged can improve usability | Off until you select Allow analytics. Blogged remembers that choice for 180 days across its marketing, documentation, and account subdomains | | Security and rate-limit records | Protect public endpoints and accounts from abuse | Usually server-side rather than a browser cookie; retained only as needed for security and operational purposes | Blogged loads fonts from Google Fonts and may serve public media from an external content-delivery host. Those providers receive ordinary request data such as IP address, user agent, requested URL, and timestamp. The Google Analytics tag uses measurement ID G-457QMK65WY only after analytics consent. ## 3. Google Analytics 4 and Microsoft Clarity Google Analytics 4 measures page views across blogged.dev, app.blogged.dev, and docs.blogged.dev. On the marketing and account surfaces it also measures button, navigation, outbound-link, download, form, signup, login, checkout, verified subscription, scroll-depth, and Web Vitals events. Blogged sends a surface and low-cardinality route group for reporting, retains public campaign parameters on marketing pages, and removes application query values and dynamic identifiers from URLs before measurement. It does not send form values, passwords, email addresses, entered websites, workspace identifiers, customer content, or raw dashboard button labels. Clarity may set first-party cookies such as _clck and _clsk and Microsoft-domain cookies used for operational analytics and browser recognition. It can collect rendered page and interaction data, but form input text is masked by Clarity. Blogged sets a surface label so marketing, documentation, and account activity can be separated in analysis. Blogged does not request either analytics tag until you select Allow analytics. If you allow it, Blogged grants analytics storage while keeping Google and Microsoft advertising storage denied; Google ad-user-data consent, ad personalization, Google signals, and ad-personalization signals also remain disabled. Blogged remembers the combined choice for 180 days across blogged.dev, app.blogged.dev, and docs.blogged.dev. You can withdraw your choice by deleting Blogged, Google Analytics, and Clarity cookies through your browser or contact Blogged with a privacy request. ## 4. Customer-published blogs A Blogged customer may configure Google Analytics 4, Google Tag Manager, Meta Pixel, LinkedIn Insight Tag, TikTok Pixel, or custom code on its blog. Blogged does not add those tools to a customer blog unless an owner or admin configures them. The customer is responsible for its notices, lawful basis, consent configuration, and vendor accounts. | Customer-blog state | What happens | | --- | --- | | No configured tags or custom code | Blogged does not inject third-party tracking tags. First-party service and aggregated product analytics may still operate as described by the customer's notice | | Tags configured, banner off | Configured tags can load when the page loads, subject to Do Not Track and Global Privacy Control unless the customer has deliberately overridden that default | | Banner on, no choice yet | GA4 loads with Consent Mode v2 storage denied; Meta initializes with consent revoked; GTM, LinkedIn, TikTok, and custom code are withheld until acceptance | | Reader accepts | Consent is granted to configured providers and deferred tags or custom code load | | Reader declines | Consent remains denied and deferred tags or custom code do not load | ## 5. Customer-blog consent storage The optional customer-blog banner stores the reader's choice in local storage under blogged:cookie-consent:v1. The choice expires after 180 days, after which the banner asks again. Local storage is specific to the browser and site. Private browsing, clearing site data, or using another device may cause the banner to return. When a browser sends Do Not Track or Global Privacy Control, customer-configured tags are disabled by default and the Blogged banner is not shown because it has nothing to request. A customer can deliberately override the tag gate in settings, but remains responsible for doing so lawfully and disclosing that choice. ## 6. Your choices - Use the accept or decline controls when a customer blog displays the Blogged cookie banner. - Enable Global Privacy Control or supported browser tracking protection. - Block or delete cookies and local storage in browser settings. Authentication and saved preferences may stop working until restored. - Use vendor-specific controls for Google, Meta, Microsoft, LinkedIn, TikTok, or customer-added custom tools. - Contact hi@blogged.dev for a request about Blogged's own surfaces, or contact the customer for a request about its published blog. ## 7. Changes to this notice Blogged will update this notice when its storage, analytics, or customer-blog consent behavior materially changes. The effective date at the top identifies the current version. --- # Acceptable Use Policy Canonical URL: https://blogged.dev/policies/acceptable-use This policy sets boundaries for content, autonomous publishing, crawling, custom code, forms, integrations, and use of Blogged infrastructure. ## 1. Core principles This policy is issued by BoostYard LLC, the owner and operator of Blogged, and forms part of the Terms of Service. Use Blogged to create accurate, useful, lawful content for a business audience. Apply the same care to autonomous actions that you would apply to work performed by an employee or contractor. You are responsible for the people, content, settings, sources, trackers, forms, custom code, and integrations under your account. ## 2. Illegal, abusive, or harmful activity You may not use Blogged to create, facilitate, promote, publish, or distribute: - Content or conduct that violates applicable law, sanctions, court orders, or another person's legal rights. - Child sexual abuse material, sexual exploitation, grooming, or content that endangers minors. - Credible threats, targeted harassment, doxxing, stalking, extortion, or instructions intended to cause physical harm. - Hateful conduct that attacks or dehumanizes people based on protected characteristics, or support for violent extremist organizations. - Malware, phishing, credential theft, evasion, exploitation, destructive code, or instructions intended to compromise systems. - Trafficking, illegal weapons, controlled substances, fraud, money laundering, or other criminal activity. ## 3. Deception, impersonation, and rights - Do not impersonate a person or organization, fabricate customer evidence, forge endorsements, or conceal a material commercial relationship when disclosure is required. - Do not publish false claims presented as fact, fake quotations, fake reviews, defamatory allegations, or manipulated comparisons intended to mislead. - Do not infringe copyright, trademark, patent, database, privacy, publicity, confidentiality, contractual, or other rights. - Do not upload or direct Blogged to reuse data, images, documents, logos, or personal information without appropriate authority. - Do not use subscriber, lead, feedback, Search Console, or analytics data for discrimination, surveillance, or purposes outside the notice and consent given to the individual. ## 4. High-impact and professional decisions Blogged is not designed to make or replace professional decisions. Do not use generated content or automated publication as the sole basis for legal, medical, financial, employment, housing, education, credit, insurance, immigration, safety-critical, or similarly high-impact advice or decisions. Qualified human review and legally required disclosures must come before publication or reliance. ## 5. SEO, GEO, email, and communications Legitimate SEO, GEO, internal linking, structured data, and content optimization are intended uses. The following are not: - Cloaking, doorway pages, hidden text, link schemes, parasite hosting, mass-generated low-value pages, fake structured data, or other tactics primarily intended to deceive search or answer systems. - Unsolicited bulk email, unlawful marketing, purchased lists without permission, suppression-list evasion, or misleading sender identity. - Automated comments, forum spam, referral spam, fake traffic, fake clicks, or manipulation of analytics and conversion events. - Content designed primarily to poison an AI system, manipulate citations deceptively, or misrepresent consensus or authority. ## 6. Crawling and research - Only direct Blogged to domains and public sources you are authorized to research for a legitimate business purpose. - Do not use Blogged to bypass authentication, paywalls, access controls, rate limits, geographic restrictions, or technical protections. - Do not use the service to assemble sensitive personal profiles, scrape private information, identify anonymous people, or build a general-purpose personal-data database. - Respect source licenses, website terms, database rights, privacy, and applicable text-and-data-mining restrictions when using research results. ## 7. Platform and security abuse - Do not probe, scan, test, or exploit Blogged or another customer's systems without prior written authorization. - Do not circumvent plan limits, trial eligibility, role checks, publication holds, quotas, rate limits, billing controls, or security safeguards. - Do not reverse engineer the service except where law expressly allows it, extract model components or training data, or use output to build a competing foundation model in violation of provider terms. - Do not overload infrastructure, automate abusive requests, distribute credentials, resell account access without written permission, or interfere with another user's service. - Do not place secrets, malicious code, credential-harvesting forms, unauthorized pixels, or unsafe destinations in custom head code, calls to action, forms, or webhooks. ## 8. Enforcement Blogged may investigate suspected violations and preserve relevant records. It may block a source or destination, hold publication, remove or restrict content, disable a tracker, custom script, webhook, integration, project, or account, or suspend service when reasonably necessary. Blogged considers severity, intent, history, impact, and whether a violation can be cured. Illegal or urgent threats may be reported to appropriate authorities. If you believe an enforcement decision is wrong, email hi@blogged.dev with the workspace, affected content or feature, and relevant context. An appeal does not require Blogged to restore content or access while a material risk remains. ## 9. Reporting misuse Report abuse, unlawful content, security concerns, or rights violations to hi@blogged.dev. Include the public URL or workspace context, the nature of the concern, supporting evidence, your authority or relationship to the issue, and a reliable way to contact you. Do not include more sensitive personal information than necessary. --- # Data Processing Addendum Canonical URL: https://blogged.dev/policies/data-processing This DPA governs personal data Blogged processes for a customer and includes GDPR, UK GDPR, and US state privacy commitments. ## 1. Scope and incorporation This Data Processing Addendum (“DPA”) forms part of the agreement between the customer identified in the applicable Blogged account, checkout record, invoice, or order form (“Customer”) and BoostYard LLC, the Delaware limited liability company that owns and operates Blogged (“Blogged”). It applies when Blogged processes Customer Personal Data to provide the service. It becomes effective when Customer accepts the Terms of Service, purchases or uses the service, or signs an order form that incorporates it. “Customer Personal Data” means personal data, personal information, or equivalent regulated information contained in Customer Content that Blogged processes on Customer's behalf. “Data Protection Law” means privacy and data-protection law applicable to that processing, including the GDPR, UK GDPR and Data Protection Act 2018, and applicable US state comprehensive privacy laws. Other defined terms have the meanings in the Terms of Service or applicable Data Protection Law. ## 2. Roles and documented instructions Customer is the controller or business and Blogged is the processor or service provider for Customer Personal Data. If Customer is itself a processor, Blogged acts as Customer's subprocessor. Customer instructs Blogged to process Customer Personal Data to provide, secure, support, and improve the contracted service for Customer; follow settings, user actions, configurations, support requests, and order forms; use approved subprocessors; and comply with law. Blogged will process Customer Personal Data only on documented instructions unless law requires otherwise. If legally permitted, Blogged will tell Customer before processing required by law. Blogged will promptly inform Customer if an instruction appears to violate applicable Data Protection Law and may pause the affected processing while the parties resolve it. ## 3. Customer responsibilities - Comply with Data Protection Law and give lawful, fair, and transparent instructions. - Provide required notices and obtain any consent or other lawful basis for Customer Personal Data, including reader, lead, subscriber, tracking, webhook, and uploaded-source data. - Use appropriate workspace roles, publication settings, consent controls, and security features. - Respond to data-subject requests and regulatory inquiries as controller, with Blogged's assistance under this DPA. - Do not submit special-category, sensitive, criminal-offense, children's, payment-card, health, biometric, or government-identifier data unless the service expressly supports it and the parties agree appropriate safeguards in writing. - Assess whether autonomous publication, AI processing, international transfers, and customer-selected integrations are appropriate for Customer's use case. ## 4. Confidentiality and personnel Blogged will ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations and receive access only as needed for their responsibilities. Blogged will provide appropriate privacy and security direction to personnel with such access. ## 5. Security measures Considering the state of the art, implementation cost, processing scope and risk, Blogged will maintain technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. | Area | Measures | | --- | --- | | Access control | Firebase Authentication; workspace and site role checks; server-enforced tenant isolation; restricted admin and service-account access; least-privilege controls for sensitive collections | | Encryption and secrets | TLS in transit; managed cloud encryption at rest; AES-256-GCM encryption for Search Console tokens; Secret Manager for production credentials; no full payment-card storage by Blogged | | Application security | Input validation; destination and redirect validation; SSRF protections for webhooks and crawling; response-size and crawl bounds; rate limiting; one-way hashing for selected tokens and IP rate-limit keys | | Reliability and recovery | Managed backups and recovery capabilities; idempotency and lease controls; retry and dead-letter workflows; publication holds; revision history; operational monitoring and logs | | Data minimization | Role-limited views; masked public responses; server-only subscription tokens and rate-limit records; bounded OAuth scopes; purpose-specific AI and research context | | Governance | Provider reviews and contractual protections; incident response; access revocation; change and deployment controls; customer-visible permissions and publication governance | Blogged may update measures as technology and risk evolve, provided the overall protection of Customer Personal Data is not materially reduced during the service term. ## 6. Subprocessors Customer gives general written authorization for Blogged to use the subprocessors on the current Subprocessor List. Blogged will require each subprocessor that processes Customer Personal Data to protect it under written terms materially consistent with the relevant obligations in this DPA. Blogged remains responsible for its subprocessors to the extent required by applicable Data Protection Law. Blogged will post a new or replacement subprocessor on the Subprocessor List before authorizing it to process Customer Personal Data when reasonably practicable. Customer may object within 15 days after the posted effective date on reasonable data-protection grounds. The parties will work in good faith on a commercially reasonable alternative. If none is available, Customer may stop using the affected feature or terminate the affected service without penalty other than fees accrued before termination. Customer-selected analytics, pixels, custom code, lead webhooks, and other integrations are Customer's recipients and not Blogged subprocessors merely because Blogged enables the connection. Customer is responsible for diligence and agreements with those recipients. ## 7. Data-subject and compliance assistance Taking into account the nature of processing and information available, Blogged will provide reasonable assistance for Customer to respond to data-subject requests and meet obligations concerning security, breach notification, data-protection impact assessments, and regulator consultations. If a data subject contacts Blogged about Customer Personal Data, Blogged will direct the request to Customer unless law requires Blogged to respond directly. Customer may request assistance at hi@blogged.dev. If a request requires unusual engineering, extensive retrieval, or third-party costs beyond the standard service, Blogged may charge reasonable fees after giving an estimate, unless Data Protection Law prohibits the charge. ## 8. Personal data incidents Blogged will notify Customer without undue delay after becoming aware of a confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data processed by Blogged (“Personal Data Incident”). Notification does not admit fault or liability. As information becomes available, Blogged will describe the nature of the incident, affected data and people where reasonably identifiable, likely consequences, measures taken or proposed, and a contact for follow-up. Blogged will take reasonable steps to contain, investigate, mitigate, and remediate the incident and will reasonably assist Customer's legally required notices. Customer controls notices to its data subjects and regulators unless law requires Blogged to notify directly. Unsuccessful attempts, routine blocked activity, service interruptions without compromise, and incidents caused solely by Customer or a customer-selected integration are not Personal Data Incidents under this DPA, although Blogged may still share useful security information. ## 9. Return and deletion During the service term, Customer can access, export, unpublish, unsubscribe, disconnect, archive, or delete supported records through product controls. On termination or written request, Blogged will delete or return Customer Personal Data within a reasonable period, at Customer's choice and subject to product capabilities, unless law requires retention. Deletion does not require immediate removal from encrypted backups, immutable security records, billing and tax records, legal holds, or logs that cannot reasonably isolate one customer's data. Remaining copies will stay protected, will not be used for another purpose, and will be deleted or rendered inaccessible under normal retention cycles. Project archive is reversible and does not count as a deletion instruction. ## 10. Information and audits Blogged will make information reasonably necessary to demonstrate compliance with this DPA available on request, including this DPA, security-measure summaries, subprocessor information, and relevant independent provider reports available to Blogged. Customer may conduct one audit per 12-month period, and additional audits after a material Personal Data Incident or when a regulator requires one. Audits should first use documents and remote interviews. Any on-site inspection requires reasonable advance notice, must occur during business hours, cannot expose another customer's data or compromise security, and must be performed by an independent auditor bound by confidentiality. Customer pays its audit costs. Blogged may charge reasonable costs for unusually burdensome assistance unless a material Blogged breach is found or law prohibits the charge. ## 11. International data transfers Blogged may process Customer Personal Data in the United States and other locations shown on the Subprocessor List. Where a transfer from the EEA, Switzerland, or United Kingdom requires safeguards and no adequacy decision applies, the parties incorporate the applicable European Commission Standard Contractual Clauses approved by Decision 2021/914, using Module Two when Customer is a controller and Module Three when Customer is a processor. The UK International Data Transfer Addendum applies to restricted UK transfers, and Swiss law adaptations apply to restricted Swiss transfers. For the SCCs, docking is optional; Option 2 general authorization applies with the notice period in Section 6; optional independent dispute resolution language does not apply; and the law and supervisory authority are determined by the SCCs based on Customer's establishment or representative. Annex details are in Section 13. If a later lawful transfer mechanism replaces these clauses, the mechanism that provides valid protection applies. ## 12. US state privacy terms For Customer Personal Data subject to the CCPA or another US state comprehensive privacy law, Blogged acts as a service provider or processor. Blogged will not sell or share Customer Personal Data, retain, use, or disclose it outside the direct business relationship or permitted business purposes, combine it with personal information from another source except as law permits, or use it for targeted advertising. Blogged will provide the same level of privacy protection required by applicable law and notify Customer if it can no longer do so. Customer may take reasonable steps to stop and remediate unauthorized use and may monitor compliance through Section 10. Blogged certifies that it understands and will comply with the restrictions in this Section. The parties will apply equivalent controller-processor terms required by Colorado, Connecticut, Virginia, Utah, and other applicable state laws. ## 13. Processing details and SCC annexes | Item | Details | | --- | --- | | Parties | Customer and its contact are identified in the account, checkout record, invoice, or order form. Blogged and its contact are identified in the same record and at hi@blogged.dev. Customer is exporter; Blogged is importer when the SCCs apply | | Subject and duration | Processing Customer Personal Data to provide Blogged for the term of the agreement plus the limited return, deletion, backup, security, and legal-retention period described in this DPA | | Nature and purpose | Collecting, storing, organizing, retrieving, analyzing, generating, transforming, hosting, publishing, transmitting, securing, supporting, deleting, and otherwise processing data for autonomous content operations, blog hosting, analytics, forms, billing administration, and customer-directed integrations | | Data subjects | Customer users, workspace members, prospects or contacts included by Customer, customer-blog readers, subscribers, leads, feedback authors, content authors, and people appearing in Customer Content or approved public research | | Personal data | Identity and contact data; account and role data; Customer Content; source, research, prompt, knowledge, draft, image, and publication data; domain and integration data; subscriber and lead data; reader events and feedback; device, log, security, and support data | | Sensitive data | Not intended. Customer must not submit sensitive or special-category data unless expressly supported and agreed in writing. If agreed, additional safeguards will be documented before processing | | Frequency | Continuous or on demand according to Customer's use, settings, connected services, and autonomous publication schedule | | Retention | For the service term and as described in Section 9 and the Privacy Policy. Operational records may have shorter service-specific lifetimes; legally required, security, suppression, and backup records may remain longer | | Subprocessors | The current Subprocessor List states provider, purpose, data categories, and primary processing location. Duration is the period each provider is needed to provide the relevant feature | | Security | The measures in Section 5, together with the provider-specific measures incorporated through subprocessor agreements | ## 14. Precedence, changes, and contact If terms conflict, the SCCs control for a restricted transfer, then this DPA, then the order form, then the Terms of Service. Liability under this DPA is subject to the agreement's liability terms except where Data Protection Law prohibits that limitation. Blogged may update this DPA to reflect law, regulatory guidance, or service changes, but will not materially reduce protection of Customer Personal Data during an active term without notice. Questions, objections, audit requests, and data-protection notices should be sent to hi@blogged.dev or to BoostYard LLC, Attn: Privacy, 16192 Coastal Highway, Lewes, DE 19958, United States. --- # Subprocessor List Canonical URL: https://blogged.dev/policies/subprocessors This list identifies the core providers that may process customer personal data for Blogged and separates them from customer-selected trackers and integrations. ## 1. How to read this list BoostYard LLC owns and operates Blogged and appoints the subprocessors listed here to process Customer Personal Data when delivering the service. The list reflects providers configured in production as of the effective date. Provider locations describe primary entities or infrastructure and do not promise that support, resilience, or onward processing occurs only in one country. Provider terms and lawful transfer mechanisms apply. ## 2. Core subprocessors | Provider | Purpose | Data involved | Primary location | | --- | --- | --- | --- | | Google LLC and Google affiliates | Firebase App Hosting, Cloud Run, Firestore, Cloud Storage, Authentication, logging, queues, domain services, Vertex AI generation and image processing, Google Sign-In, customer-authorized Search Console access, and consent-gated Google Analytics 4 product analytics | Account and workspace data, Customer Content, prompts and output, files and images, integration tokens, search performance, logs, device data, customer-blog data, and pseudonymous product interaction and performance events | United States and Google Cloud locations. Firebase Authentication is US-only; other Firebase and Google Cloud services may use global infrastructure | | Stripe, Inc. and applicable Stripe affiliates | Checkout, subscriptions, trials, invoices, tax calculation, promotion codes, payment recovery, and billing portal | Customer and billing identifiers, business name, email, billing address, tax ID, payment method and outcome, plan and subscription records | United States and other locations described by Stripe | | Exa Labs, Inc. | Public-web search and retrieval for customer-directed research, competitor discovery, evidence, and claim validation | Search queries, domains, public-source context, and retrieved public web results. Queries are not intended to include personal or confidential information | United States | | Plus Five Five, Inc. (Resend) | Transactional trial, billing, payment-recovery, bounce, and complaint email processing | Recipient email, message content, message identifiers, delivery status, bounce and complaint details | United States and Resend's listed subprocessors | | Microsoft Corporation | Microsoft Clarity product, documentation, and marketing-site interaction analytics | IP-derived location, device and browser data, rendered page data, navigation, clicks, scrolls, session and interaction events. Form input text is masked by Clarity | United States and Microsoft processing locations | ## 3. Customer-directed services The following services are not Blogged subprocessors merely because a customer configures Blogged to load or contact them. They are recipients selected and controlled by the customer, and the customer must maintain the appropriate account, terms, disclosures, lawful basis, and data-processing arrangement: - Google Analytics 4 and Google Tag Manager - Meta Pixel - LinkedIn Insight Tag - TikTok Pixel - Any custom head code, script, pixel, analytics, chat, advertising, or embedded service added by a customer - Any lead webhook, CRM, automation endpoint, or other customer-configured recipient - A customer's registrar, DNS, reverse proxy, content-delivery, or domain provider ## 4. Public website resources Blogged's public marketing pages load fonts from Google Fonts and currently reference public media served from a Cloudflare R2 delivery domain. These resources receive ordinary network request data. Google is already listed above. Cloudflare's role for that public asset is content delivery rather than processing private Customer Content. ## 5. Changes and objections Blogged will update this page when it authorizes a new or replacement subprocessor to process Customer Personal Data. Under the Data Processing Addendum, a customer may object on reasonable data-protection grounds within 15 days after the posted effective date. Email hi@blogged.dev with the workspace, affected provider, and specific grounds for the objection. A provider may change its legal entity, infrastructure, or own subprocessors. Blogged links to provider terms in its internal vendor records and reviews material changes as part of its service-provider management. Contact Blogged if you need the current provider legal documentation for procurement or a transfer assessment.