1.Who we are
Bloxx (“Bloxx”, “we”, “us” or “our”) is an AI-native content management and search-optimisation platform, owned and operated by James Pentalow (legal name: JAMES HENRY PENTALOW). This Privacy Policy explains what personal information we collect when you use our website at itsbloxx.com, the Bloxx application at app.itsbloxx.com, and the related Bloxx assistant connector (together, the “Service”), how we use it, who we share it with, and the rights you have over it.
For the purposes of the UK GDPR and the EU GDPR, Bloxx is the data controller for personal information processed through this website and the Bloxx application. If you have any questions about this policy or how we handle your data, contact us at hello@itsbloxx.com. You can also request our postal address for privacy correspondence by email.
2.Information we collect
We collect the following categories of personal information:
Information you give us
- Contact and enquiry details. When you complete a form, request a demo, or email us, we collect your name, email address, company name, and anything you choose to include in your message.
- Account information. If you create a Bloxx account, we collect your email address and the credentials needed to authenticate you.
- Booking information. If you book a call with us, our scheduling provider collects your name, email, and chosen time.
- Content you create. If you use the Bloxx application, we process the site content, pages, and settings you create or upload.
Information we collect automatically
- Usage and device data. When you visit the site we automatically receive your IP address, browser type, device and operating system, referring page, the pages you view, and the dates and times of your visits.
- Cookies and similar technologies. We and our analytics and advertising providers use cookies and similar technologies as described in the Cookies section below.
- Server and security logs. Our hosting and security provider logs requests to the site, including request headers and automated-traffic (bot) signals, to keep the Service secure and to power our bot-traffic analytics.
3.How we use your information
We use personal information to:
- respond to your enquiries, provide demos, and communicate with you about the Service;
- create and manage your account and provide the features of the Bloxx application;
- operate, maintain, secure, and improve the Service;
- understand how visitors use our website through analytics, so we can improve it;
- measure and improve our marketing, including advertising campaigns where you have consented;
- detect, prevent, and address fraud, abuse, security incidents, and technical issues; and
- comply with our legal obligations and enforce our Terms of Service.
4.Our legal bases (UK and EU GDPR)
Where the UK GDPR or EU GDPR applies, we rely on the following legal bases to process your personal information:
- Consent for non-essential cookies, analytics, and advertising, and for optional marketing communications. You can withdraw consent at any time.
- Performance of a contract to provide the Bloxx application to account holders and to respond to a request you have made.
- Legitimate interests in running, securing, and improving our website and business, provided those interests are not overridden by your rights. This covers essential logging, security, and basic operation of the site.
- Legal obligation where we must process data to comply with the law.
6.Google services (Analytics, Ads, Search Console, PageSpeed)
We use several Google services to run and measure the Service. When these services are active, Google may process data such as your IP address, device and browser information, and your interactions with the site, in accordance with Google’s own privacy policy.
- Google Analytics helps us measure traffic and understand how visitors use the site. Analytics runs only after you consent to analytics cookies.
- Google Ads may be used to run and measure advertising campaigns, including conversion measurement and, where enabled, remarketing. Advertising features run only after you consent to advertising cookies.
- Google Search Console gives us aggregate, non-identifying data about how the site performs in Google Search. It does not set cookies on your device.
- Google PageSpeed Insights is used by us to test the site’s performance. It does not collect personal information from your visit.
You can learn how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites. You can opt out of Google Analytics across all sites using the Google Analytics Opt-out Browser Add-on, and manage ad personalisation at My Ad Center.
7.Google user data (Search Console and Analytics)
This section is separate from the one above on purpose. Section 6 covers Google tools we use to measure our own website. This section covers your Google data, which Bloxx accesses on your behalf only if you choose to connect your Google account in the Bloxx application.
Connecting is entirely optional. Bloxx works without it.
What we request, and why
- See Search Console data (
webmasters.readonly) – so the app can show you your own clicks, impressions, average position and queries. - Manage Search Console properties (
webmasters) and verify site ownership (siteverification) – so the app can add a site you own to Search Console and complete the ownership check for you, instead of you doing it by hand. - See Analytics data (
analytics.readonly) – so the app can show you your own sessions, users and traffic sources. - Edit Analytics properties (
analytics.edit) – so the app can create a GA4 property and data stream for a site you own. - Your name, email address and Google account id (
openid,email,profile) – so we can show you which Google account is connected and keep the connection attached to the right Bloxx account.
We request these scopes so that the features described above work. We do not use them for anything else.
Limited Use
Bloxx’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
In plain terms, and specifically:
- We use Google user data only to provide and improve the features you connected it for.
- We do not sell Google user data, and we do not use it for advertising of any kind.
- We do not use Google user data to train, retrain, fine-tune or otherwise improve any artificial intelligence or machine learning model, whether ours or a third party’s.
- We do not transfer Google user data to others except as needed to provide the features you asked for, for security, or where the law requires it.
- No human at Bloxx reads your Google user data except where you have given specific permission, where it is needed for security purposes or to resolve a support issue you have raised, or where the law requires it.
Where it goes
- Stored with our backend provider (Xano) – the connection itself, and a cached copy of the metrics the app has fetched, so the app can show you history without re-querying Google every time.
- Sent to an AI assistant, only when you use that feature. Bloxx offers an optional connector that lets an AI assistant answer questions about your own site data. It is a Model Context Protocol server, which means you choose the assistant you connect it to, and the relevant Search Console and Analytics figures are sent to that assistant so it can answer. Where you connect it to Claude, the recipient is Anthropic, and our terms with them do not permit your data to be used to train their models. Where you connect it to any other assistant, the figures go to whoever provides that assistant, governed by their terms rather than ours, so please check them before connecting. If you do not use the connector, your Google data is never sent to any assistant.
How to disconnect
You can disconnect at any time in the Bloxx application under Integrations. When you do, Bloxx revokes its own access at Google and then deletes the stored credentials from our systems, so we cannot reach your Google account again without you granting access afresh. Any scheduled syncs stop at the same time. In the rare case where we cannot reach Google to complete the revoke, we still delete the credentials and tell you so, with a link to finish it yourself.
You can also revoke Bloxx’s access directly from your Google account at any time, without involving us, at myaccount.google.com/permissions. Revoking there takes effect immediately and independently of anything in Bloxx.
To have the connection and any cached Google data deleted entirely, email hello@itsbloxx.com and we will delete it. Deleting your Bloxx account deletes it too.
9.International data transfers
Some of our providers are located outside the UK and the European Economic Area, including in the United States. Where we transfer personal information internationally, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or Addendum, the European Commission’s Standard Contractual Clauses, or a provider’s certification under the EU-US and UK-US Data Privacy Framework, so that your data receives an equivalent level of protection.
10.How long we keep your information
We keep personal information only for as long as we need it for the purposes described in this policy, and to meet our legal, accounting, and reporting obligations.
- Enquiry and contact data is kept for as long as needed to deal with your request and for a reasonable period afterwards.
- Account and content data is kept for the life of your account and deleted, or anonymised, within a reasonable period after your account is closed.
- Analytics data is retained according to the retention settings configured in Google Analytics.
11.Your rights
Depending on where you live, you have rights over your personal information. Under the UK and EU GDPR these include the right to:
- access the personal information we hold about you;
- have inaccurate information corrected;
- have your information erased in certain circumstances;
- restrict or object to how we process your information;
- receive your information in a portable format; and
- withdraw consent at any time, without affecting processing already carried out.
To exercise any of these rights, email us at hello@itsbloxx.com. We will respond within the time limits set by applicable law. If you are in the UK and believe we have not handled your data properly, you can complain to the Information Commissioner’s Office at ico.org.uk. If you are in the EEA, you may complain to your local data protection authority.
12.Security
We take reasonable technical and organisational measures to protect personal information against loss, misuse, and unauthorised access, including encryption in transit, access controls, and reputable infrastructure providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data and to respond promptly to any incident.
13.Children
The Service is intended for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.
14.Third-party links
Our site may link to third-party websites and services that we do not control. This policy does not apply to those sites, and we are not responsible for their content or privacy practices. We encourage you to read the privacy policy of any site you visit.
15.Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will change the “Last updated” date at the top of this page and, where the change is significant, take reasonable steps to bring it to your attention. Your continued use of the Service after an update means you accept the revised policy.
16.Contact us
If you have any questions, requests, or complaints about this Privacy Policy or your personal information, contact us at:
Bloxx (owned and operated by James Pentalow (legal name: JAMES HENRY PENTALOW))
Email: hello@itsbloxx.com