Privacy policy

This policy explains which personal data BlokCms collects, why, how long we keep it and what your rights are. It covers people who use BlokCms (account holders and their team members) and visitors of blokcms.app.

1. Who we are

BlokCms is provided by Blok Consulting BV, Boomlaarstraat 75B, 2500 Lier, Belgium, enterprise and VAT number BE 0767.642.063 ("we", "us"). For personal data about BlokCms's own users we are the data controller. Questions about privacy: privacy@blokcms.app.

2. Content our customers put in BlokCms

Organizations use BlokCms to manage their websites' content. What they store in it (pages, files, and the form submissions their website visitors send) belongs to them. For personal data in that content, the organization is the controller and we process it on its behalf, under our data processing agreement. If you sent a form on a website that uses BlokCms, contact that website's owner about your data; we will help them answer your request.

3. What we collect

• Account data: your name, email address, profile picture, the organizations you belong to and your role in them. Our authentication provider, Clerk, stores this for us.
• Data from Google, if you choose "Continue with Google": your name, email address and profile picture from your Google account. We don't ask for, or receive, anything else from Google: no email, files, contacts or calendar.
• What you do in BlokCms: the content you edit, comments and mentions, the history of changes (who changed what, and when), and your notification settings.
• Technical data: to keep accounts and the service secure, Clerk records the device, browser and IP address of each sign-in, and Cloudflare, which runs BlokCms, processes IP addresses to deliver and protect the service. Our own logs contain request addresses and errors, but no email addresses or content. Usage statistics count requests and storage per space, without IP addresses or user ids.
• Email: we send invitations, notifications you can switch off, and notices about your organization's account. We don't send marketing email.

blokcms.app itself sets no cookies and runs no analytics or third-party scripts. The BlokCms admin only uses cookies to keep you signed in and to remember your language; other settings, such as the theme, are kept in your browser.

4. Why we use it, and on what legal basis

• To provide BlokCms (accounts, sign-in, collaboration, emails you need): performance of our contract with you or your organization (GDPR Art. 6(1)(b)).
• To keep the service secure and prevent abuse: our legitimate interest in a safe, reliable service (Art. 6(1)(f)).
• To meet legal obligations, such as accounting and lawful requests (Art. 6(1)(c)).

We don't sell personal data, don't use it for advertising and don't build profiles of you.

5. Google user data

We use the data Google shares (name, email address, profile picture) only to create your account and sign you in. It isn't sold, used for advertising, used to train AI models or shared with anyone except Clerk, our authentication provider. BlokCms's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can remove BlokCms's access at any time in your Google account settings.

6. Who processes data for us

• Cloudflare, Inc.: hosting, storage, content delivery, email sending and logs. Content, files, form submissions and backups are stored in Cloudflare's EU jurisdiction. Published content and images are cached on Cloudflare's network worldwide so websites load fast.
• Clerk, Inc. (United States): accounts, sign-in and organization membership.
• Microsoft (Microsoft 365): the email you exchange with us.
• Workers AI (Cloudflare), only for spaces whose owners switch on AI features: the content sent for translation, alt text or search is processed by Cloudflare's AI models, which may run outside the EU. It isn't used to train models.

Where personal data leaves the European Economic Area, as with Clerk, it is protected by the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

7. How long we keep it

• Account data: as long as your account exists. When you delete it, your profile is removed.
• Content of a deleted space or organization: it goes offline right away, and its content, files and backups are erased within a day. The recovery copies our hosting provider keeps expire within 30 days after that.
• Backups of spaces in use: up to 30 days.
• Logs: up to 30 days.
• Form submissions: as long as the form's owner sets (one year unless they choose otherwise); submissions marked as spam, 30 days.

Content you created for an organization stays with that organization when you leave it.

8. Your rights

You can ask us for a copy of your personal data, have it corrected or erased, restrict or object to how we use it, and receive it in a portable format. Write to privacy@blokcms.app; we answer within one month. You can also complain to the Belgian Data Protection Authority (dataprotectionauthority.be) or the authority where you live.

9. Security

Data is encrypted in transit and at rest. Access is limited to people who need it, sign-in is handled by a specialized provider, and every change in BlokCms is recorded in its history.

10. Children

BlokCms is a tool for businesses and organizations and isn't meant for anyone under 16.

11. Changes

When we change this policy, we update the date above. For important changes we tell organization admins by email beforehand.