Privacy Policy

This policy explains what personal information Blocks collects, why, who it's shared with, how long it's kept, and the choices and rights you have. It covers the Blocks website (getblocks.io), the Blocks app (app.getblocks.io), and the emails we send.

The short version

• We collect what we need to run Blocks, and nothing more. No ads, no tracking cookies, no selling or renting your information.
• Your team's work belongs to your team. We store it and show it to the people your organisation chooses. We don't use it to train AI, analyse it, or look at it unless you ask us to, or we need to in order to fix a problem, keep Blocks secure or meet a legal obligation.
• We use a small number of trusted providers to host Blocks, send emails and run the AI assistant.
• You can see, correct, download or delete your information. Email us at support@getblocks.io, or use the settings in the app.

This summary isn't a substitute for the full policy below.

Who we are

Blocks is run by Sidharth Dilip, an individual based in Dubai, United Arab Emirates. In this policy, "Blocks", "we", "us" and "our" mean Sidharth Dilip, trading as Blocks.

For anything about your privacy, email support@getblocks.io.

Who this policy applies to

• Website visitors, including people who join the waitlist or use our contact form.
• People with a Blocks account, including members who were invited to an organisation.
• People who view a shared link to a workspace, without an account.
• People who aren't Blocks users but whose details are added by someone who is. For example, a person invited by email, or a client named in a campaign brief.

Payments are handled by Paddle, who has its own privacy notice. See "Payments" below.

Where your information comes from

• From you, when you join the waitlist, contact us, sign up or use Blocks.
• From your organisation, when someone invites you, tags you as an owner, or mentions you in a Block, Item or comment.
• From Paddle, when your organisation buys a paid plan.
• Automatically, from your browser or device when you visit the website or use the app, such as your IP address.

Do you have to give us your information?

No. But some things only work with it. We need your name, email address and a password to create an account, and an email address to add you to the waitlist or reply to you. Without them, we can't provide those things. The survey is always optional.

What we collect on the website

Waitlist

• What: your email address.
• Why: to confirm your sign-up, and then to email you updates about Blocks, including when it launches.
• How it works: after you join, we send you an email asking you to confirm. You're only added to the waitlist once you click "Confirm email". Until then, we won't send you anything else.
• Legal basis: your consent. You can withdraw it at any time with the unsubscribe link in any of our emails, or by emailing us.

Optional survey

After you join, you can tell us a little about yourself: the field you work in, the type of workplace, your team size, and what caught your interest. Every question is optional.

• Why: to understand who's interested in Blocks and shape the product and how we talk about it.
• Legal basis: your consent. Skipping the survey doesn't affect your place on the waitlist.

Contact form

• What: your name, email address and message.
• Why: to read and reply to your message. It's sent to our support inbox through our email provider, and isn't added to any mailing list.
• Legal basis: our legitimate interest in answering people who contact us, or taking steps you've asked for before entering a contract with us.

The same applies if you email us directly.

Bot protection

Our forms use Cloudflare Turnstile, an automatic "are you human?" check. Most people don't see anything; some see a tick box. To tell people from bots, it looks at signals such as your IP address and details about your browser and device.

• Why: to protect our forms from spam and abuse. We only use it for this, never for analytics or advertising. Cloudflare also uses these signals to improve its bot detection, as an independent controller. See Cloudflare's Turnstile privacy policy.
• Legal basis: our legitimate interest in keeping the website secure.

Turnstile only loads on pages with a form, once you start using the form.

Website statistics

We use Plausible Analytics to count visits: which pages are viewed, where visitors came from, and their country and type of device. Plausible doesn't use cookies, doesn't build profiles of visitors, and doesn't let us identify you. It uses your IP address briefly to count unique visitors, but doesn't store it.

• Why: to see how the website is used and improve it.
• Legal basis: our legitimate interest in understanding and improving our website.

Hosting and security

The website runs on Cloudflare. Like any host, Cloudflare processes your IP address and browser details to deliver pages and protect the site from attacks. We briefly count requests from each IP address to stop forms being abused. We don't store IP addresses ourselves.

• Legal basis: our legitimate interest in running a secure, working website.

Fonts, images, styles and scripts on our website are all served from our own website, so your browser doesn't contact other services such as Google Fonts. The only exceptions are Turnstile and Plausible, described above.

What we collect in the app

Your account

When you sign up, we collect:

• your first and last name
• your email address
• your password, which is stored in a scrambled form we can't read
• if you're creating a new organisation: its name, whether it's an agency or an in-house team, and, for agencies, the name of your first client (optional), which becomes your first workspace

We also keep:

• a record of when you accepted our Terms, and which version
• your choice about marketing emails, and when you made it
• your theme choice (light, dark or system)

Why: to create and run your account, keep it secure, and contact you about it.

Legal basis: to perform our contract with you (our Terms). Keeping a record of your acceptance and your email choice is in our legitimate interest, and helps us show we've met our legal obligations.

What your team adds to Blocks

Blocks stores what you and your teammates create, including:

• organisations, workspaces and departments
• Blocks (campaigns) and their briefs, dates and phases
• Items and their dates and status
• comments
• who's tagged as an owner on a Block or Item
• notifications, such as "Jane added you as Design owner on Launch campaign"

This can include information about other people, such as clients' names or anything typed into a brief or comment. Blocks doesn't support file uploads or attachments.

If you leave an organisation, what you added there, such as comments, stays with that organisation.

Our role: we hold and process this content on behalf of the organisation that added it. The organisation decides what goes in and who can see it. We only store it, show it to the people the organisation chooses, and process it as described in this policy when your team uses features like the AI assistant. We don't use it for anything else.

If you're not a Blocks user and think your details are in an organisation's workspace, it's best to contact that organisation first. If you can't, or you need help, email us and we'll do what we can.

Invitations

Owners and admins of an organisation can invite people by email. We store the invited email address, who sent the invite, and when it expires (24 hours) or was used. We email the person an invitation showing the inviter's name and the organisation's name.

Legal basis: the legitimate interest of the organisation, and of us, in letting teams invite the people they work with. Invitations are deleted 30 days after they expire or are used.

Share links

An organisation can create a view-only link to a workspace. Anyone with the link can see, without signing in:

• the workspace name and departments
• all Blocks and Items, with their dates, status and briefs
• all comments
• people's names, shortened to first name and last initial (for example "Jane S.")

Share links never show email addresses. The organisation can switch a link off at any time, and links are switched off automatically when a workspace is archived. We don't keep any record of who opens a share link, beyond the short-lived hosting logs described under "Hosting, logs and security".

The AI assistant

Blocks includes an AI assistant, powered by Anthropic. When you use it, we send Anthropic:

• your messages, and the conversation so far
• your local date and time zone
• information the assistant looks up to answer you: campaign and Item names, dates and status, department names, workspace names, and the names of tagged people, shortened to first name and last initial

We never send Anthropic email addresses, comments, campaign briefs or passwords, unless you type them into the chat yourself.

We don't store your conversations with the assistant. They're cleared when you refresh the page or switch workspace. Anthropic doesn't use them to train its AI models, and deletes them within 30 days, unless they're flagged for breaking Anthropic's usage policy, in which case it may keep them for up to 2 years.

Legal basis: to perform our contract with you, by providing the feature you've chosen to use.

AI answers can be wrong. Please check anything important before relying on it.

Emails from the app

We send service emails you need to use Blocks, such as confirming your email address, resetting your password, invitations, and important notices about your account, our Terms, prices or security. We don't need your permission for these, because they're part of the service. Paddle sends its own payment receipts.

We only send product news and marketing emails if you've ticked the box to receive them. You can unsubscribe at any time with the link in those emails.

Payments

Paid plans are sold by our reseller, Paddle.com, which is the Merchant of Record. Paddle collects your payment details, billing address and tax information, and handles the payment, invoices and refunds. We never see or store your card details.

Paddle is responsible for the information it collects at checkout. See Paddle's privacy notice.

Paddle shares some details with us so we can provide your plan, such as the buyer's name, email address, billing address and purchase history. We use these to provide and support your plan, and never for marketing. We keep your organisation's plan, payment status, number of paid members and Paddle's reference numbers.

Legal basis: to perform our contract with you, and to meet our legal obligations, such as keeping records.

Hosting, logs and security

When you use the app, our providers process technical information such as your IP address, browser details and the pages you request, to deliver the app and keep it secure. Our sign-in provider also records the IP address and browser of each device you're signed in on, until you sign out on that device, after 30 days without use, or when you delete your account.

Legal basis: our legitimate interest in running a secure, working service.

Who can see your information

• Other members of your organisation can see your full name and email address. This is how the member list and owner tags work. Elsewhere in the app, such as comments and owner tags, your name usually appears as your first name and last initial.
• Anyone with a share link can see the workspace content and shortened names listed under "Share links".
• Our service providers, listed below, process information for us so we can run Blocks.
• Authorities, only if the law requires us to share information, or to protect our rights, our users or the public.
• A buyer or successor, if Blocks is ever sold or transferred. We'll tell you before your information becomes subject to a different privacy policy.

We don't sell, rent or trade your personal information, and we don't share it with advertisers.

Our service providers

Provider	What they do for us	Where they process data
Supabase	Stores the app's data and handles sign-in	Frankfurt, Germany (EU)
Cloudflare	Hosts the website and app, protects them, and runs Turnstile	Worldwide network
Resend	Sends our emails, and stores waitlist sign-ups and survey answers	Stored in the United States. Emails may be sent from servers in other countries, such as Japan
Anthropic	Powers the AI assistant	Stored in the United States. Processing may take place in the United States, Europe, Asia or Australia
Google Workspace	Our email inbox, including support@getblocks.io	Worldwide
Plausible Analytics	Website statistics, without cookies	European Union
Paddle	Payments, tax and invoices (as an independent seller, under its own privacy notice)	See Paddle's privacy notice

Apart from Paddle, each provider processes your information only to provide its service to us, under a contract that protects it. The one exception is the limited Turnstile data Cloudflare uses to improve its bot detection, described under "Bot protection".

International transfers

Blocks is run from the United Arab Emirates, and some of our providers are in other countries, including the United States. This means your information may be accessed from or stored outside your country, including outside the EU and UK.

Where we transfer personal information from the EU or UK to a country without an approved level of protection, we rely on safeguards such as the European Commission's Standard Contractual Clauses (and the UK's equivalent), included in our agreements with our providers, or on the EU-US Data Privacy Framework where a provider is certified under it.

You can ask us for more information about these safeguards.

How long we keep your information

Information	How long we keep it
Waitlist sign-ups that aren't confirmed	30 days
Waitlist email address and survey answers	While you stay subscribed. If you haven't created a Blocks account, we delete them 12 months after Blocks launches
If you unsubscribe from the waitlist	We delete your survey answers. We keep your email address on a "do not email" list, only so we never email you again
Contact form messages and support emails	2 years after the conversation ends
Your account details	Until you delete your account
Records of signed-in devices	Until you sign out on that device, after 30 days without use, or when you delete your account
Your organisation's content	Until the organisation deletes it, or the organisation itself is deleted
Invitations	30 days after they expire or are used
Notifications	90 days
AI assistant conversations	Not stored by us. Anthropic deletes them within 30 days (up to 2 years if flagged for misuse)
Plan and billing records	While your organisation exists, and longer where the law requires
Emails we send	Our email provider keeps a copy for up to 30 days
Technical logs	Up to 7 days
Backups	Up to 7 days

When you delete your account

You can delete your account in the app's settings. When you do:

• your account, name, email address and sign-in details are deleted
• comments you wrote, and Blocks you created, stay with your team, but show "Former member" instead of your name
• notifications sent to you, and any pending invitations to your email address, are deleted
• if you're the only member of an organisation, the organisation and everything in it is deleted too
• if you own an organisation that has other members, you'll need to hand over ownership first

Deleted information may remain in our backups for up to 7 days before it's gone for good. Paddle keeps its own payment records under its privacy notice, and we keep billing records where the law requires.

Cookies and similar technology

We don't use advertising or tracking cookies, so we don't need to ask for your permission to use cookies.

• Website: our website doesn't set cookies. Cloudflare may set a cookie that's strictly necessary to protect the website, for example if Turnstile shows you a challenge. It lasts no longer than needed for that check.
• App: the app doesn't use cookies. It uses your browser's storage to keep you signed in, remember your theme, reopen the workspace and organisation you were last in, carry an invitation through sign-up, and handle password resets. Signing out clears your sign-in and the saved workspace, organisation and invitation details.

Your rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you, and get a copy
• correct information that's wrong or incomplete
• delete your information
• receive your information in a portable format
• object to us using your information based on our legitimate interests
• restrict how we use your information in some situations
• withdraw your consent at any time, where we rely on it. This doesn't affect anything we did before you withdrew it

How to use them

• In the app: you can change your name and password, and delete your account, in settings. You can stop marketing emails with the unsubscribe link in any of them.
• By email: for anything else, including a copy of your information, an export of your organisation's data, or changing your email address, email support@getblocks.io.

Your right to object. You can object at any time to us using your information based on our legitimate interests, and we'll stop unless we have a compelling reason to continue. You can always object to marketing emails, and we'll stop sending them.

Requests are free. We'll reply within one month. If a request is complex, we may need up to two more months, and we'll tell you within the first month. We may ask you to confirm your identity first, for example by writing from the email address on your account.

If a request is about your organisation's content, we may need to involve the organisation's owner, since the organisation decides what's stored there.

Complaints

If you're unhappy with how we've handled your information, please contact us first so we can try to put it right. You also have the right to complain to a data protection authority, such as the authority in the EU country where you live or work, the Information Commissioner's Office in the UK, or the UAE Data Office.

Marketing emails

We only send waitlist updates and product news to people who have agreed to receive them. Every one of these emails includes an unsubscribe link. If you unsubscribe, we keep your email address on a "do not email" list, only so we don't email you again. Service emails, such as password resets and invitations, don't have one, because you need them to use Blocks.

Security

We protect your information with:

• encryption in transit (HTTPS) and at rest
• access rules in our database, so people only see the organisations and workspaces they belong to
• two-step sign-in on the accounts we use to run Blocks
• access to stored data limited to Sidharth Dilip, and only when needed to run, support or fix Blocks

No system is completely secure. If a security breach affects your personal information, we'll tell you and the relevant authorities where the law requires.

Age requirement

Blocks is a tool for businesses and isn't meant for anyone under 18. We don't knowingly collect information from anyone under 18. If you think we have, email us and we'll delete it.

Automated decisions

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

Changes to this policy

We may update this policy when Blocks changes or the law requires it. We'll update the date at the top, and if the changes are significant, we'll tell you by email or in the app before they take effect.

Contact

Questions or requests about your privacy? Email support@getblocks.io.

Sidharth Dilip, trading as Blocks, Dubai, United Arab Emirates.