Skip to content
YOUR HERO IS VAGUEYOUR CTA IS HIDINGNOBODY READS PARAGRAPH FOURYOUR HERO IS VAGUEYOUR CTA IS HIDINGNOBODY READS PARAGRAPH FOURYOUR HERO IS VAGUEYOUR CTA IS HIDINGNOBODY READS PARAGRAPH FOUR
Bluntpage

Legal

Privacy Policy

Plain English, complete, and short enough to actually read. The summary: we collect what the product needs, we do not sell it, we do not train models on it, and you can take it or delete it whenever you like.

Last updated September 1, 2026

1. Who we are

Bluntpage Inc. ("Bluntpage", "we", "us") is a Delaware C-Corp headquartered in Atlanta, Georgia. We run the website at bluntpage.com and the Bluntpage application (together, the "Service"). For the personal data described here, we are the data controller. This policy applies to everyone who uses the Service, wherever they live.

2. Data we collect

Data you give us.

  • Account data: your name, email address, and a scrypt hash of your password. We never store the password itself.
  • Google sign-in data, if you choose it: your name, email address, and Google account identifier. We do not receive your Google password or access to your Google data.
  • Content you submit: the URLs you ask us to roast and any HTML you paste.
  • Agency plan data: client labels, your agency name, and the email addresses of seats you invite.
  • Messages: whatever you send through the contact, help, careers, or waitlist forms, or by email.

Data we create or collect when you use the Service.

  • Roast data: a structured outline of the page, the score, kills, fixes, rewrites, and re-check history.
  • Usage data: how many roasts you have run this month, and your plan.
  • Billing data: your plan, billing interval, and payment status. Card details are collected and held by Stripe. We never see or store full card numbers.
  • Log data: IP address, browser type, requested path, and timestamps, kept in server logs.
  • Cookies: essential session cookies only. See the Cookie Policy.

We do not buy data about you from third parties, and we do not collect sensitive categories of data. Please do not paste pages containing other people's personal or confidential information.

3. Why we use it

  • To provide the Service: create your account, sign you in, fetch and roast pages, and store your results. Legal basis: performance of our contract with you.
  • To bill paid plans and keep financial records. Legal basis: contract and legal obligation.
  • To send service email such as verification, password resets, receipts, and important notices. Legal basis: contract.
  • To keep the Service secure: rate limiting, abuse prevention, and debugging. Legal basis: legitimate interests.
  • To answer your messages and job applications. Legal basis: legitimate interests, or steps taken at your request.
  • To improve the product using aggregate, de-identified statistics, such as how many roasts run per day. Legal basis: legitimate interests.

We do not send marketing email unless you ask for it, and every such email has a one-click unsubscribe link.

4. What we never do

  • We never sell or rent your personal data, and we do not share it for cross-context behavioral advertising.
  • We never use your pages, pasted HTML, or roast results to train AI models, and we do not allow our AI provider to do so.
  • We never fetch a page unless you ask us to. There is no background crawling.
  • We never run advertising trackers or third-party analytics cookies.

5. Page fetching

When you submit a URL, our server requests that page's public HTML once, identifying itself as BluntpageBot. The fetch is limited to 600 KB and 9 seconds, and it refuses private network addresses. A re-check fetches the same page again, only when you ask.

6. AI processing

To generate a roast, we send a structured outline of the page's content to a language model provider through its API. Today that provider is OpenAI. Under its API terms, data sent through the API is not used to train its models. We do not send your name, email address, or password to the model. The output is advice generated by software. It is not a decision with legal or similarly significant effects on you.

7. Sub-processors

We share personal data only with the companies that help us run the Service, under contracts that limit what they can do with it:

  • Vercel Inc. (United States): hosting, serverless compute, the document store, and request logs.
  • OpenAI, L.L.C. (United States): language model API that generates roasts and rewrites.
  • Stripe, Inc. (United States): payment processing, when billing is enabled.
  • Google LLC (United States): sign-in, only if you choose Google sign-in.

We may also disclose data when the law requires it, to protect the rights and safety of our users or the public, or as part of a merger or acquisition. If the company is acquired, this policy continues to apply to your data unless you are told otherwise and given the chance to delete your account first.

8. International transfers

We are based in the United States and our sub-processors process data there. If you use the Service from outside the United States, your data will be transferred to and processed in the United States. Where required, we rely on Standard Contractual Clauses or an equivalent lawful transfer mechanism with our sub-processors.

9. How long we keep it

  • Account data, roasts, and pasted HTML: until you delete the roast or your account. Account deletion from Settings is immediate.
  • Server logs: about 30 days.
  • Messages and support tickets: up to 24 months, or sooner on request.
  • Job applications: up to 12 months after the role closes, or sooner on request.
  • Billing and tax records: as long as tax and accounting law requires, typically 7 years.
  • Backups: the document store may hold residual copies for up to 30 days after deletion, after which they are overwritten.

10. Your rights

We honor the same rights for everyone, worldwide, whether or not your local law (such as the GDPR, UK GDPR, or the CCPA and other US state privacy laws) requires it:

  • Access and export. Download everything as a JSON file from Settings, at any time, on any plan.
  • Deletion. Delete individual roasts, or your whole account, from Settings. It takes effect immediately.
  • Correction. Change your name in Settings, or email us to correct anything else.
  • Objection and restriction. Ask us to stop or limit a particular use of your data.
  • Withdraw consent where we rely on it, without affecting what happened before.
  • No sale or sharing. We do not sell or share personal data, so there is nothing to opt out of.
  • No retaliation. We will never treat you worse for using these rights.

For anything you cannot do yourself in Settings, email privacy@bluntpage.com. We may ask you to confirm you control the account email. We respond within 30 days. If you are unhappy with our answer, you can appeal by replying to it, and you may also complain to your local data protection authority or state attorney general.

11. Security

We use TLS in transit, scrypt password hashing, a guarded page fetcher, validated model output, and rate limiting. No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires. Details are on the Security page.

12. Children

The Service is for businesses and professionals. It is not directed to children, and people under 16 are not permitted to use it. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, email us and we will delete it.

13. Changes to this policy

If we change this policy, we will update the date at the top. For material changes, we will email account holders at least 14 days before the change takes effect.

14. Contact

Privacy questions and requests: privacy@bluntpage.com

Bluntpage Inc.
Attn: Privacy
1100 Peachtree Street NE, Suite 920
Atlanta, GA 30309
United States