GDPR & BlogCrew
GDPR compliance information for BlogCrew — controller/processor roles, DPA, and sub-processors.
This page does not serve as legal advice. Please determine together with your legal advisor how GDPR applies to your business.
What is GDPR?
The General Data Protection Regulation (GDPR) is a European Union (EU) privacy law that allows EU citizens and residents to have access and control over their personal data.
Does it affect you?
If your business is based in the European Union (EU), or you process the personal data of individuals in the EU, the General Data Protection Regulation (GDPR) affects you.
Is BlogCrew GDPR Compliant?
Yes. BlogCrew complies with the GDPR framework. These are the measures we have taken:
- Our Privacy Policy gives you more information about what data we collect, data retention and transfers, and outlines your data protection rights.
- Workspace and account data is encrypted in transit and at rest, with a focus on European Union hosting where practicable.
- Data accessibility: You retain control of the workspace content you create, store, and manage with BlogCrew.
- We have a Data Processing Agreement available for you (see below).
For more information, please consult our Privacy Policy.
Do you have a Data Processing Agreement?
By agreeing to our Terms & Conditions through the creation of your BlogCrew account, professional users also agree, on behalf of their company, to the content of our Data Processing Agreement (outlined in Article 8 of our Privacy Policy) and accept to be bound by it. It is not necessary to sign this document separately.
What happens with workspace content?
BlogCrew provides an agentic SEO and content-operations platform. You are responsible for Personal Data you include in workspace content (briefs, articles, knowledge materials, media, and related records). For that content, you are the data controller and BlogCrew is the processor hosting and processing it on your instructions.
As long as your account is active, you have full control over the content you create and the destinations you publish to.
- You can edit, delete, or export workspace content from your account. To request an export, contact us at [email protected].
- We honor deletions. Content you delete is permanently removed from our backups within 90 days, unless we are required to retain it by law.
- Publish destinations you configure (webhook, Zapier, WordPress, Shopify, Wix, internal blog, and similar) are under your control; those providers process data according to your configuration and their own terms.
How do you use my personal data?
BlogCrew acts as a data controller for the personal information you give us in order to use our service (registration information, payment information for subscriptions, usage metering, for example). BlogCrew does not sell personal data to third parties or use it for marketing purposes or for serving advertisements.
We only share your information with our service providers who help us operate our business (such as Stripe for processing subscription payments), in which case those third parties are required to comply with the GDPR framework.
Subprocessors
BlogCrew engages the following sub-processors to assist in providing our services:
| Name | Description | Country | May process workspace content | Link |
|---|---|---|---|---|
| Supabase | Database, authentication, and file storage services | 🇪🇺 EU | Yes | Learn more |
| Vercel | Hosting and infrastructure services | 🇺🇸 | No (request/platform traffic only) | Learn more |
| Resend | Email delivery services | 🇺🇸 | Yes (account and notification email) | Learn more |
| Mistral AI / Anthropic | AI inference for content generation and related features | 🇪🇺 / 🇺🇸 | Yes (prompts and generated outputs you request) | Mistral · Anthropic |
| OAuth, Search Console research connectors, and image-related services where enabled | 🇺🇸 | Yes when you enable connectors | Learn more | |
| Stripe | Payment processing for paid plans | 🇺🇸 | No (billing data only) | Learn more |
| Destination providers you choose | Webhook, Zapier, WordPress, Shopify, Wix, and similar | Varies | Yes when you publish | User-configured |
Sub-Processor Updates: We may add or replace sub-processors from time to time. We will inform you of intended changes concerning addition or replacement of sub-processors, giving you the opportunity to object. If you object to a new sub-processor, you may terminate your use of the affected service.
All sub-processors under our control are contractually bound to process Personal Data only in accordance with our instructions and applicable data protection laws. User-configured destinations are selected and controlled by you.
Looking for a GDPR-ready content workflow?
When publishing content that may contain personal information, consider:
- Lawful basis: Ensure you have a lawful basis for processing any Personal Data included in briefs, articles, or knowledge materials.
- Privacy notices: Inform individuals appropriately when their data appears in published content.
- Handle sensitive data carefully: If you include special-category data, ensure you have an appropriate lawful basis and explicit consent where required.
- Respect data subject rights: Be prepared to respond to access, rectification, and erasure requests for Personal Data you control.
- Control destinations: Only connect publish destinations and research connectors you trust, and review what payloads you send.
For more detailed information, please refer to our Privacy Policy, Terms & Conditions, and Cookie Policy.
Made and hosted in the EU