BBlogZilla

Privacy Policy

Last updated 27 October 2026

BlogZilla is an AI-assisted blog and content publishing studio operated by GLOWFISH INCUBATOR FZCO, a free zone company registered in Dubai, United Arab Emirates (“Glowfish”, “we”, “us”). Glowfish is the controller of the personal data described here.

This policy explains what we collect, why we collect it, who we share it with, how long we keep it and how you can have it deleted. It covers the BlogZilla web application at blogzilla.me, its API, and the blogs published through it. Our Terms of Service govern your use of the service itself.

In short: we do not sell personal data and we do not use your content to train artificial intelligence models. We do use analytics and advertising-measurement tools from Google, Meta and Mixpanel, and we tell Google and Meta when someone signs up, starts a trial or pays (and Google when someone signs in), so that we can measure our own advertising. Sections 8 to 11 name every service provider, say exactly what is sent, and explain how to opt out.

1. Information we collect

  • Account details — your name and email address. If you sign in with a password, we store only a securely hashed version of it, never the password itself. If you sign in with Google, we receive your name, email address and profile picture from your Google account so we can create and identify your account.
  • Content you create or upload — sites, articles, drafts, keywords, brand guidelines, images and reference documents you add to your workspace, together with the prompts and instructions you give the service.
  • Data from accounts you connect — only where you choose to connect them. See sections 3 and 4.
  • Billing information — your plan, your workspace name, the billing country and any tax registration number you enter in BlogZilla, and records of your payments and of the invoices we issue. Your billing contact details, address and card are entered directly with our payment processor, Stripe: we never receive your card details, and we do not keep the address (we read only its country, to apply the right tax).
  • How you use BlogZilla — while you are signed in, we record product events, such as creating a site, generating or publishing an article, connecting an integration or changing plan, together with your user ID, email address, workspace, plan and role. See sections 9 and 10.
  • Enterprise enquiries — if you ask us about Enterprise from our home page, the name, work email, company or website, number of sites and any message you send. We use them only to reply to you. They are sent to our team by email and stored with our other records.
  • Visits to our website — on our home page, Solutions pages, comparison pages and sign-in pages, Google Analytics and the Meta Pixel load in your browser. See section 9.
  • Technical and operational records — the requests your browser or integrations make to us and our responses, including what they contain (article bodies and images are recorded by size only, and other long text is cut short), the IP address they came from, when they happened and the account they belong to. Passwords, tokens, authorisation codes and other credentials are removed before anything is recorded.
  • Audience measurement on published blogs — for blogs published through BlogZilla we record page views, scroll depth and clicks against a random identifier held in the reader’s browser, together with the page address and the browser’s user-agent string. It is not linked to a name, email address or account, and we do not use it to identify readers or to advertise to them.

2. How we use information, and on what basis

  • To provide the service — creating, editing, scheduling and publishing content, and carrying out the actions you ask for on accounts you have connected. Basis: performance of our contract with you.
  • To show you performance and content insight from the data you have chosen to connect. Basis: performance of our contract with you.
  • To authenticate you and protect accounts against unauthorised access, abuse and fraud. Basis: our legitimate interest in a secure service.
  • To administer subscriptions — applying plan allowances and processing payment. Basis: contract and legal obligation.
  • To communicate with you — service and account messages, and support you ask for. Basis: contract and legitimate interest. Marketing email, where we send it, is separate and you can opt out at any time.
  • To understand how BlogZilla is used and improve it, using the product events described in sections 9 and 10. Basis: legitimate interest.
  • To measure our own marketing and advertising — which of our marketing brings people who sign up and become customers, and the results of advertising we run with Google and Meta. Sections 9 and 10 set out what this involves. Basis: our legitimate interest in measuring our own marketing.
  • To diagnose faults and improve reliability using technical records and aggregated usage. Basis: legitimate interest.
  • To meet legal obligations and to establish, exercise or defend legal claims. Basis: legal obligation and legitimate interest.

We do not sell personal data, and we do not make decisions producing legal or similarly significant effects about you by automated means. We do send Google and Meta a limited record of sign-ups, trials, checkouts and payments (and, to Google, sign-ins) so we can measure our own advertising. Section 10 says exactly what that record contains.

3. Google user data

Connecting a Google service is entirely optional — BlogZilla works without it. When you choose to connect one, we request the narrowest scope that does the job, and both of them are read-only:

  • Google Search Console (webmasters.readonly) — to read clicks, impressions, click-through rate and average position for the properties you select, so BlogZilla can show how your published content performs and suggest what to write next.
  • Google Sheets (drive.file) — per-file access to the single spreadsheet you choose in Google’s own file picker, so that its rows can be used as a data source for your content and charts. This scope grants access only to files you have explicitly picked: BlogZilla cannot see, list or open anything else in your Google Drive.

These scopes cannot create, edit or delete anything in your Search Console properties or your Google Drive. We read only the specific property or spreadsheet you choose, and only while the connection is active.

The credentials that keep the connection alive are encrypted before storage and are used solely to refresh access for the features above. They are never sent to your browser or to any third party. You can disconnect at any time from within BlogZilla, which deletes the stored credentials, and you can revoke our access directly at myaccount.google.com/permissions.

Limited Use. BlogZilla’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we use the Google user data we receive through these connections only to provide or improve the user-facing features described above; we do not transfer it to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with notice to you; we do not use it for advertising; we do not sell it; and we do not allow humans to read it, except where you have given specific consent (for example when you ask for support), where it is necessary for security purposes or to comply with applicable law, or where the data has been aggregated and anonymised.

Sign in with Google is separate from these connections. If you use it, the name, email address and profile picture Google gives us become your account details (section 1) and are used as section 2 describes. That includes sending Meta a SHA-256 hash of your email address when you sign up (section 10).

4. Facebook and Instagram data

Sharing to Facebook and Instagram is coming soon and may not yet be available on your account. When it is, connecting a Meta account is optional and exists for one purpose: so you can share an article you have already published to a Facebook Page and an Instagram professional account that you administer. If you never connect one, we receive no data from Meta at all. This section covers data we receive from Meta; what we send to Meta to measure our advertising is described in sections 9 and 10.

When you connect, we receive and use the following:

  • Confirmation that you signed in to Facebook and authorised the connection. We do not build a profile of you from it.
  • The list of Facebook Pages you administer, with each Page’s name and picture and whether an Instagram professional account is linked to it, so that you can choose which one to connect. Pages you do not choose are discarded and never stored.
  • The name and picture of the Page you selected, and the username of the linked Instagram account, so the connection can be displayed back to you and so we can detect when it has expired and needs renewing.
  • Access credentials for the selected Page, used only to post the content you explicitly ask us to post.

What we do with it, and what we never do:

  • We publish only when you press publish, only the article and caption you chose, and only to the account you selected. We never post automatically, never post to an account you did not select, and never post third-party content.
  • We do not read comments, messages, reactions, follower lists, media or any other user-generated content on your Page or Instagram account.
  • We do not sell, rent or transfer Meta Platform Data, do not use it for advertising, profiling or eligibility decisions, and do not combine it with data from other sources for those purposes.
  • Access credentials are encrypted before storage, are never exposed to the browser, and are used for nothing beyond the features described here.

We handle this data in accordance with the Meta Platform Terms and Developer Policies. You can disconnect at any time from within BlogZilla, which deletes the stored credentials and clears the linked account details, and you can remove our access directly from your Facebook settings under Business Integrations. See section 13 for how to have the data deleted.

5. Other services you connect

BlogZilla can also connect to content management systems and similar publishing destinations you already use, so it can publish your articles there on your instruction. We store only what the connection needs, protect any credentials in the same way as above, and use the connection for nothing else. Each destination remains governed by its own terms and privacy policy.

6. AI processing

BlogZilla uses AI services to write and analyse content. We send each provider the material needed for the task you asked for, or for the automated feature you are using:

  • Text generation and analysis — Anthropic. Drafting and editing articles, analysing your website, brand and tone of voice, planning topics and internal links, reviewing article quality, and explaining data you connect. Anthropic receives your prompts and the context for the task: your articles; your brand guidelines, business details and tone-of-voice samples; text from your website’s pages and from other pages you point it to; the text of reference documents and data files you upload; rows from a connected spreadsheet; search queries and figures from Search Console; the headlines and summaries of news the News Agent finds; and, to check an infographic BlogZilla has generated for errors, the image itself.
  • Image generation — Recraft, OpenAI and Google (Gemini). When BlogZilla creates an image or infographic for an article, it sends one of these providers a written description of the image to produce. Recraft is the default. The description is built from the article’s title and text (for an infographic, figures from the article, which can come from a connected spreadsheet), your target location, your brand colours, the opening of your brand guidelines and any image instructions you or your site settings give. No images, logos or account details are sent; your logo is added afterwards on our own servers.
  • AI visibility checks — Anthropic, OpenAI and Google (Gemini), and Perplexity when enabled. To show whether AI assistants mention your business, BlogZilla puts the questions tracked for your site to these assistants, on a weekly schedule and whenever you run the check yourself, and records whether your site is cited in the answers. The questions are typically the kind a customer might ask about your type of business, and you can add your own. Only the question is sent, not your name, domain or account details; each assistant may search the web to answer it.

Text generation, including anything derived from a connected spreadsheet, is processed by Anthropic (the Claude API, standard commercial tier), which does not train its models on data submitted through that API. We reach every provider above through its developer API, not its consumer apps, and each processes what we send under its API terms in order to return a result to us. We do not route Google user data through model aggregators, gateways or model hubs. We do not use your content to train models.

Separately, the News Agent looks for recent news for your site each day. It sends the news search terms set up for your site (suggested from your industry and services, or added by you) to Google News, and reads any other news feeds you add. Only the search terms are sent; the headlines and summaries it finds go to Anthropic to suggest article ideas.

7. Sharing your information

We do not sell your information. We share it only in these situations, and only to the extent needed:

  • Service providers — the companies listed in section 8, for the purposes given there.
  • Google and Meta, for advertising measurement — the information described in sections 9 and 10. Google and Meta handle it under their own terms and policies and may use it as those allow, including to run and improve their advertising services. See how Google uses information from sites that use its services and Meta’s Privacy Policy.
  • Platforms you have connected — where you ask us to publish content to them.
  • People inside your own workspace — anyone you invite can see the content of that workspace.
  • Legal and safety — where required by law, or to establish, exercise or defend legal claims, or to protect the rights and safety of our users or the public.
  • Corporate transactions — in a merger, acquisition or sale of assets, with notice to you and the same protections continuing to apply.

8. Service providers

These are the companies that process personal data for BlogZilla or receive it from us, what each one does, and what it receives.

  • Amazon Web Services (AWS) — hosts BlogZilla: the servers that run the application and API, the database, storage for images and documents, and server logs (Amazon CloudWatch). Data: everything we store that this policy describes, including account details, content, connected-account records and technical records.
  • Anthropic — AI text generation and analysis, and AI visibility checks (section 6). Data: the prompts and content each task needs, as described there, and the questions tracked for AI visibility.
  • Google — several separate services:
    • Google Analytics measures visits to our home page, Solutions pages, comparison pages and sign-in pages, and receives sign-up, sign-in, trial, checkout and payment events from our servers (sections 9 and 10). Data: from your browser, the page visited, the referring page, browser and device details and your IP address; from our servers, your user ID, workspace ID and plan, and the details of the event.
    • Sign in with Google, if you use it. Data: Google sends us your name, email address and profile picture (section 1).
    • Google Search Console and Google Sheets, only if you connect them (section 3).
    • Gemini, for image generation and AI visibility checks (section 6). Data: image descriptions built from your articles, and the questions tracked for AI visibility.
    • Google News, for the News Agent. Data: the news search terms set up for your site.
  • Meta — the Meta Pixel on our home page, Solutions pages, comparison pages and sign-in pages, and the Meta Conversions API, which receives sign-up, trial, checkout and payment events from our servers, to measure our advertising on Facebook and Instagram (sections 9 and 10). Publishing to Facebook Pages and Instagram is coming soon (section 4). Data: for the Pixel, the request your browser makes to download it; for the Conversions API, a SHA-256 hash of your email address and of your user ID, and the plan and price, as section 10 sets out.
  • Mixpanel — product analytics inside the signed-in app (sections 9 and 10). Data: your user ID, email address, workspace ID, plan and role, the product events you trigger, the address of the page you are on, your browser and device type, the domain of each site you add, and your IP address, which Mixpanel uses to estimate your approximate location.
  • OpenAI — image generation when it is the selected image provider, and AI visibility checks (section 6). Data: image descriptions built from your articles, and the questions tracked for AI visibility.
  • Perplexity — AI visibility checks, when enabled (section 6). Data: the questions tracked for AI visibility.
  • Recraft — image generation; BlogZilla’s default image provider (section 6). Data: image descriptions built from your articles.
  • Resend — sends our email: password resets, team invitations and reminders, site access requests and their outcomes, and service notices such as Autopilot pausing. Data: the recipient’s email address and the message, which can include the name and email address of the person who invited you or asked for access, and the workspace or site concerned.
  • Stripe — payments and subscription billing. Data: your workspace name and ID and the plan and price you choose (with a tax line for your billing country where one applies), and the email address, billing address and card you enter on Stripe’s checkout page (we never receive your card details). Stripe holds the resulting invoices and payment status.

9. Cookies and similar technologies

Some of the tools below use cookies and some use your browser’s local storage, which works in a similar way. This is what runs, and where.

Strictly necessary

Signing in sets session cookies that your browser sends back to us to keep you authenticated; page scripts cannot read them. If you choose a display language, a cookie remembers it, and the app keeps a few preferences, such as the site you last worked on, in local storage, along with a copy of the article you are editing so that unsaved changes survive a crash. The “Continue with Google” button on our sign-in pages is loaded from Google, so your browser contacts Google when those pages open.

Analytics: Google Analytics

Where: our home page, our Solutions pages (for agencies, startups and small businesses), our comparison pages (BlogZilla set beside other tools) and our sign-in pages (signing in or creating an account, accepting an invitation and resetting a password). Not inside the signed-in app, and not on blogs published through BlogZilla. If you follow a link from one of those pages to another of ours, such as this policy, without the page reloading, the scripts stay loaded and Google Analytics may record that page too.

What it does: Google Analytics loads with Google’s consent mode set to “denied” for both analytics and advertising storage. In that state it does not set analytics cookies, but it still sends Google cookieless measurement requests about the visit, containing details such as the page address, the referring page, your browser and device type and the time, and, like any request, they reveal your IP address to Google. On the home page and the Solutions pages it also reports when the pricing section comes into view, and on any of these pages when an Enterprise enquiry is sent. BlogZilla does not currently show a consent banner or offer a way to grant consent, so the “denied” state applies to every visitor.

Advertising measurement: Meta Pixel

Where: the same pages as Google Analytics.

What it does: your browser downloads the Pixel script from Meta, which reveals your IP address and browser details to Meta. Before the Pixel starts, we put it into Meta’s “consent revoked” state, in which it does not send events, including page views, from your browser. Nothing in BlogZilla currently grants that consent, so today the Pixel sends no events from your browser. Meta does receive conversion events from our servers; see section 10.

Product analytics: Mixpanel

Where: inside the signed-in BlogZilla app only.

What it does: Mixpanel keeps an identifier in your browser’s local storage and records the product events we define, such as seeing a plan limit, switching workspace or site, starting a Google connection or opening certain reports, linked to your BlogZilla user ID. We also send it your email address and your workspace, plan and role. It does not record page views, clicks or your screen automatically. Mixpanel runs whenever you are signed in; the consent states above do not apply to it.

Blogs published through BlogZilla

Readers of blogs we host or publish for you get no Google, Meta or Mixpanel scripts from us and no analytics cookies. We measure page views, scroll depth and clicks ourselves, against a random identifier kept in the reader’s local storage, together with the page address and the browser’s user-agent string. This is not linked to a name, email address or account. If the owner of a published blog adds their own analytics or tag manager to their site, that is covered by their own privacy policy, not this one.

10. Server-side conversion events

Some events are sent from our servers rather than from your browser, because they often happen when you are not on our website (a payment clearing, for example). Our servers send them whether or not your browser accepts cookies, regardless of the consent states described in section 9, and browser extensions cannot block them. They go to:

  • Google Analytics — sign-ups, sign-ins, trial starts, checkouts started, payment details added, subscriptions started and payments. Each carries your BlogZilla user ID where the event has one (an internal code, not your email address), your workspace ID and plan where the event has them, and details of the event such as the plan, price, currency and our checkout or invoice reference. Our Google Analytics property is linked to Google Ads, so these events can be used to measure our Google advertising. We do not mark them as excluded from ad personalisation, so Google may also use them to personalise ads, for example in advertising audiences.
  • Meta (Conversions API) — sign-ups, trial starts, checkouts started, payment details added, subscriptions started and payments. For a sign-up, Meta receives a SHA-256 hash of your email address and of your BlogZilla user ID, whether you signed up with a password or with Google. Trial and checkout events carry the hash of your user ID; the other events carry neither your email address nor your user ID. Trial, checkout and subscription events carry the plan, and checkout and payment events carry the price and currency. Meta uses the hashed values to match events to people on Facebook and Instagram, which is how it measures our advertising, and it can also use these events to optimise the delivery of our ads.
  • Mixpanel — product events such as sign-ups, articles generated and published, integrations connected and plan changes, with your BlogZilla user ID, workspace ID, plan and role, and, when you add a site, its domain.

We do not send Google or Meta the content of your articles, your prompts, or data from the accounts you connect.

11. Your choices: opting out and objecting

  • In your browser. You can block Google Analytics, the Meta Pixel and Mixpanel with your browser’s tracking protection or a content blocker, or install Google’s Analytics opt-out browser add-on. Clearing your browser’s local storage removes the Mixpanel identifier and the blog reader identifier.
  • With Google and Meta. You can manage how Google uses your activity for ads in My Ad Center, and review or disconnect activity that businesses share with Meta in your Facebook or Instagram Accounts Center, under “Your activity off Meta technologies”.
  • Server-side events and product analytics. BlogZilla does not yet have a setting that turns these off for your account, and browser controls do not affect events sent from our servers. To object to them, email zilly@blogzilla.me from the address on your account with the subject “Analytics objection”. We will handle it as described in section 16.

12. Retention

We keep account and content data for as long as your account is active, so the service works as you expect. In particular:

  • Articles you delete go to the trash and are permanently removed after 10 days.
  • Image files you upload or BlogZilla generates stay in storage, even after you remove them from an article or delete the article, until your account is deleted or you ask us to remove them.
  • Credentials for a connected account are deleted immediately when you disconnect it. Search Console figures already imported stay with your site until you delete the site or ask us to remove them. Signing out ends the session.
  • Audience-measurement records for a published blog are kept while that site remains in your account, and are deleted with it.
  • Enterprise enquiries sent from our home page (section 1) are stored with our other records, and the copy emailed to our team stays in our mailbox. If you do not become a customer, until we state a fixed retention period here they may be kept indefinitely; email us and we will delete yours.
  • Technical records (server logs) are stored in Amazon CloudWatch for debugging and security. Individual entries cannot be removed from them. Until we state a fixed retention period here, they may be kept indefinitely.
  • Event data sent to Google, Meta and Mixpanel (sections 9 and 10) is kept by those providers under their own retention rules and the settings of our accounts with them.

When your account is closed we delete or irreversibly anonymise your personal data within 30 days, except where we must retain records to meet legal, tax or accounting obligations, or to resolve a dispute. Server logs and database backups are not edited to remove a single account; personal data in them is removed only when they expire (see the point on server logs above).

13. Deleting your data

You can have your data removed in any of these ways:

  • Disconnect a single integration. For Search Console or Facebook and Instagram, open Integrations and choose Disconnect; for a Google Sheet, open Business Data and choose Remove; for WordPress, Ghost or your own blog API, open Setup → Publishing and choose Disconnect. The stored credentials are deleted immediately; for Facebook and Instagram the linked Page and account details are cleared, and for a Google Sheet our copy of its data is deleted too. Search Console figures already imported stay with your site (section 12). Disconnecting deletes our copy of the access but does not revoke it at Google or Meta; to do that, see “Remove our access at the platform” below.
  • Delete individual content — articles and documents can be deleted from within the application at any time. Deleted articles stay in the trash for 10 days and are then permanently removed. Images can be removed from an article, but the image files are kept (section 12); email us if you want particular images deleted.
  • Delete your whole account and all associated data. Email zilly@blogzilla.me from the address registered on the account with the subject “Delete my account and data”. We will confirm the request, delete or anonymise the data within 30 days (server logs and backups excepted, as section 12 explains), and confirm when it is done. No account is needed to make a request about data we hold — write to the same address and we will verify your identity before acting. BlogZilla has no self-service account deletion today, so email is the way to do this.
  • Remove our access at the platform. For Google, use myaccount.google.com/permissions. For Facebook and Instagram, use Settings → Business Integrations. Revoking access there stops any further access; email us as above if you also want the data we already hold deleted.
  • Analytics data. Deleting your account does not automatically delete event data already sent to Google, Meta or Mixpanel (section 10). If you want that removed too, say so in your deletion request.

14. Security

Data is encrypted in transit. Credentials for the third-party accounts you connect are encrypted at rest with strong, industry-standard encryption, and passwords are stored only as secure hashes. Access to production systems is limited to the people who need it. Access to each workspace’s data is checked on every request, so that one customer cannot reach another’s. No system is perfectly secure, but we take these measures seriously and will notify you and any relevant regulator of a breach affecting your data as required by law.

15. International transfers

BlogZilla’s servers, database, file storage and server logs are hosted by Amazon Web Services in its Frankfurt, Germany region (eu-central-1). We operate from the United Arab Emirates, and several of the providers in section 8, including Anthropic, OpenAI, Google, Meta and Mixpanel, are based in the United States, so data we send them may be processed there or in other countries where they operate. Where your data is processed outside your own country, we rely on appropriate safeguards — such as standard contractual clauses or an adequacy decision — to protect it.

16. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to have it deleted, to receive a portable copy, to object to or restrict certain processing, including the analytics and advertising measurement described in sections 9 and 10, and to withdraw consent where processing is based on it. You can exercise any of these by emailing us, and we will respond within the time the applicable law requires and without charge in ordinary cases.

You may also complain to your local data protection authority. Disconnecting a third-party account never affects the rest of your BlogZilla data.

Where you use BlogZilla to process personal data belonging to your own readers or customers, you are the controller of that data and we act as your processor; tell us if you need a data processing agreement.

17. Children

BlogZilla is a business tool and is not directed at children under 16. We do not knowingly collect their personal information. If you believe a child has provided us with data, contact us and we will delete it.

18. Changes to this policy

We will update this page when our practices change and revise the date at the top. If a change is material we will tell you in the application or by email before it takes effect.

19. Contact us

GLOWFISH INCUBATOR FZCO, Dubai, United Arab Emirates.
Privacy questions, data requests and deletion requests: zilly@blogzilla.me
See also our Terms of Service.