When you use BLUN, we process the following personal data:
Account data
Email address, name (on registration)
OAuth provider ID (when signing in with Google or other providers)
Selected plan and role information
Usage data
Created agents, conversations, and messages
Cost and usage data (token usage, model calls)
Activity logs (login, data export, setting changes)
Technical data
IP address, browser type and version
Operating system, device type
Access times and pages visited
Payment data
Payment information is processed exclusively by Stripe. We do not store credit card numbers or bank details on our servers.
From Stripe we only receive a reference ID, the payment status, and the amount.
Web search (Brave Search)
If you use web search in BLUN Chat or in the BLUN console, we transmit the search text as well as the language and country of the request to the Brave Search API of Brave Software, Inc. (USA). The search returns result lists that we use as a source for the answer. We do not transmit any account details, files or the conversation history. We do not store the result lists; we use them only for the current request. The legal basis is Art. 6(1)(b) GDPR (performance of the function you requested). The safeguards described in Section 8 apply to the transfer to the USA. Please do not enter personal data of third parties into search queries unless it is necessary for the search.
3. Legal bases
Your data is processed on the basis of the following legal grounds in accordance with Art. 6 GDPR:
Art. 6 Abs. 1 lit. a (Consent): For optional features such as newsletters, analytics cookies, and advanced statistics.
Art. 6 Abs. 1 lit. b (Performance of contract): For providing the service, account management, and payment processing.
Art. 6 Abs. 1 lit. f (Legitimate interest): For security measures, fraud prevention, system stability, and improving the service.
4. Cookies
We use the following types of cookies:
Necessary cookies
blun_token: Session cookie for authentication. Without this cookie, the service cannot be used. Expires: at the end of the session.
Analytics cookies
Google Analytics (_ga, _gid, _gat): Set only with your consent. Used to analyze user behavior to improve the service.
Marketing cookies
Google Ads (_gcl_au, _gac_): Set only with your consent. Used to measure advertising campaigns.
You can change your cookie settings at any time using the button at the end of this page.
5. Google Analytics
We use Google Analytics (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to analyze user behavior on our website.
Google Analytics uses cookies to evaluate the use of the website. The information generated is usually transferred to a Google server in the USA and stored there.
IP anonymization
We have activated IP anonymization. Your IP address is truncated within the EU/EEA before being transmitted to Google.
We may use Google Ads conversion tracking to measure the effectiveness of our advertisements. Google sets a cookie when you reach our website via a Google ad.
You can disable personalized advertising in your Google settings:
For payment processing we use the Stripe service (Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA).
The following data is transmitted to Stripe during a payment transaction:
Email address
Payment amount and currency
Payment method (credit card, SEPA, etc.)
IP address and device information (for fraud prevention)
Stripe processes this data as an independent controller. For more information, see Stripe's Privacy Policy.
8. Data sharing with third parties
We only share your personal data with third parties in the following cases:
Stripe, Inc.: Payment processing (see Section 7)
Google Ireland Ltd.: Web analytics and advertising (only with consent, see Sections 5 and 6)
AI processing: Processing of messages to provide the agent functionality. Only the data required for the respective task is processed or transmitted.
Brave Software, Inc.: Web search for chat and console (see Section 2, Web search). Only the search text and the language and country of the request are transmitted.
Hetzner Online GmbH: Hosting provider. Server locations: Germany and Finland. Hetzner's privacy policy
Model server hosting provider (Austria): Operation of the language model. Server location: Austria.
Data transfers to third countries (USA) are based on standard contractual clauses (Art. 46 Abs. 2 lit. c GDPR) or an adequacy decision (EU-US Data Privacy Framework).
9. Your rights
Under the GDPR you have the following rights regarding your personal data:
Art. 15 - Right of access: You have the right to obtain information about the data stored about you.
Art. 16 - Right to rectification: You can request the correction of inaccurate data.
Art. 17 - Right to erasure: You can request the deletion of your data, unless statutory retention obligations apply.
Art. 18 - Right to restriction: You can request the restriction of processing.
Art. 20 - Right to data portability: You have the right to receive your data in a machine-readable format.
Art. 21 - Right to object: You can object to the processing of your data at any time if it is based on legitimate interest.
To exercise your rights, please contact us at contact@blun.ai.
10. Data export
You can download all personal data stored at BLUN at any time in a machine-readable JSON format. This includes account data, agents, conversations, messages, cost events, and activity logs.
You can permanently delete your account and all associated data at any time. This includes all agents, conversations, messages, payment references, and activity logs.
We take appropriate technical and organizational measures to protect your data:
SSL/TLS encryption: All data transmissions are encrypted via HTTPS.
Password hashing: Passwords are stored with secure hashing algorithms and never in plain text.
Access control: Access to personal data is restricted to authorized systems and persons.
Regular updates: Servers and software are updated regularly to close security gaps.
Data backup: Regular backups ensure the availability and integrity of the data.
13. Retention periods
Account data: Stored as long as your account is active. After account deletion, all data is removed immediately and permanently.
Usage data: Stored for the duration of account usage.
Payment data: References are retained in accordance with statutory tax retention obligations (7 years under Austrian tax law, BAO).
Activity logs: Stored for a maximum of 12 months for security purposes.
Consents: Records of granted consents are retained for the duration of the business relationship and for 3 years thereafter.
14. Right to complain
If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with the competent supervisory authority:
