Privacy Policy

BlogSphere is the admin and API for the websites you build, a product of Metalinx Innovations ("we", "us"). This policy explains what personal data we handle when you visit this website, use the BlogSphere admin and API, connect an AI assistant, or order a website from us, and the choices you have. Questions: [email protected].

Who is responsible for what

There are two roles, and it helps to keep them apart.

We are the controller for the data of people who visit this website, contact us, create a BlogSphere account or buy a service from us.
You are the controller for the data of your own visitors, customers and subscribers that you collect with the websites you run on BlogSphere (for example contact messages, newsletter sign-ups, store orders and analytics of your website). We process that data for you, on your instructions, to run the service.

What we collect

Account data: your name, email address and a password hash if you set a password. If you use two-step verification or passkeys, we store the information needed to verify them.
Google sign-in: if you sign in with Google we receive your Google account ID, email address, whether it is verified, your name and profile picture. We use it only to create and secure your account and to show your name and photo in the admin.
Content and settings: the posts, pages, media, products, orders, subscribers, messages and settings of the websites you manage.
Messages to us: what you write in our contact form or by email, including your name, email address, phone number and company if you give them.
Website packages: when we build a website for you, the brand material, content, domain details and billing details you share with us.
Usage and security data: IP address, browser, device, sign-in history, API key usage and audit logs. We use them to protect accounts, prevent abuse and fix problems.
AI assistant connections: if you connect an AI assistant, the access you grant (workspace, websites and permission level), your basic profile, and a log of the assistant's tool calls (tool name, website, time and result status).
Visit statistics: if you accept analytics, we count page views on this website with BlogSphere's own analytics: the page, referrer, campaign, approximate country, device type and browser. It does not identify you personally.

How we use it

To provide, secure and support the BlogSphere admin and API.
To design, build, host and support the websites we make for you.
To send account, security and service emails, and to reply to your messages.
To understand how the product is used and to improve it.
To meet legal duties and to protect our rights.

We do not sell personal data, and we do not use Google user data for advertising.

Cookies and similar technologies

When you first visit this website we ask you to choose. You can change your choice at any time with "Cookie settings" in the footer.

Essential: needed to run the website and the admin, for example to keep you signed in, protect forms from abuse and remember your cookie choice. These are always on. Your choice is stored in a cookie named bs_consent for 12 months.
Analytics: only if you choose "Accept all". BlogSphere's analytics counts visits without tracking you across websites and honours your browser's Do Not Track setting. If you choose "Essential only", it is not loaded at all.

We do not use advertising cookies and we do not share your visits with advertising networks.

Connecting an AI assistant (MCP / OAuth)

BlogSphere lets you authorise an AI assistant, for example Claude or ChatGPT, to work with your websites through the Model Context Protocol (MCP). Connecting is always your choice.

You decide the access. You sign in, then choose the workspace, the websites and a permission level (read only, editor or full). The assistant never gets more access than you have, and you can revoke it at any time under Connected apps in your account.
What the assistant can see. Only what its tools return for the websites and permission level you granted, such as posts, media, comments, analytics and, if you grant it, store or audience data.
Personal data is minimised. Customer, subscriber, commenter and reviewer emails are masked by default. Phone numbers and street addresses are left out unless you explicitly ask for them. IP addresses and user agents are never returned. Long text is shortened, and lists and exports are capped.
What we share with the assistant. Only your basic profile (name and verified email, through the OpenID userinfo endpoint), to identify your account.
What we log. For security and auditing we log each tool call (tool name, website, time and result status). We do not log the content of your posts or of your customers' data.
The assistant's provider. Content you ask an assistant to process is handled by that assistant's provider under its own terms and privacy policy. We do not control it, and you should check it before connecting.
Actions. Changes an assistant makes with your grant are made on your behalf. Deleting content requires an explicit confirmation.

Google user data

BlogSphere's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We request only the basic profile and email scopes needed for sign-in, store related tokens encrypted, and you can unlink Google from your account at any time.

Only with providers that help us run the service, and only as needed: hosting and infrastructure, email delivery, DNS and content delivery, and domain registration when we register a domain for you. They process data on our instructions. We also share data with an AI assistant you connect yourself (as described above), when the law requires it, or with your consent.

Where it is stored and how long

We keep account data while your account is active. You can delete content at any time. After you ask us to delete your account we remove it and the related data, except what we must keep by law or for security. Backups are removed on a rolling schedule. Messages sent through our contact form are kept for as long as needed to answer you and keep a record of the conversation. Assistant tool-call logs are kept for as long as needed for security and auditing.

Security

Data is encrypted in transit and secrets and tokens are encrypted at rest. The admin supports two-step verification, passkeys and Google sign-in, API keys and assistant connections have scopes you control, and important actions are written to audit logs. No system is perfectly secure, so please use a strong, unique password.

Your rights

Depending on where you live you may have the right to access, correct, export or delete your data, to object to or limit some processing, and to withdraw consent. Email us to use these rights. If you are a visitor or customer of a website that runs on BlogSphere, please contact the owner of that website first, because they decide how your data is used.

Children

BlogSphere is for businesses and developers. It is not directed at children under 16 and we do not knowingly collect their data.

Changes to this policy

When we change this policy we update this page and the date above. For important changes we will also tell account holders by email.

Contact

Metalinx Innovations, [email protected], or use the contact page.