This Privacy Policy explains how Blam Labs, Inc. (“Blam”, “we”) collects, uses, and shares personal data in connection with the Blam service (app, marketing site, emails, support). We're the data controller for your account and usage data. For customers in the EU/UK, our representative is listed at the bottom of this page.
| Purpose | Legal basis |
|---|---|
| Providing the Service you signed up for | Contract (Art. 6(1)(b)) |
| Billing & fraud prevention | Contract + legitimate interests (Art. 6(1)(b), (f)) |
| Product analytics & improvement | Legitimate interests (Art. 6(1)(f)) |
| Marketing emails | Consent (Art. 6(1)(a)) — you can withdraw any time |
| Legal/regulatory compliance | Legal obligation (Art. 6(1)(c)) |
Content you put in Workspaces, prompts you send in the Remix Studio, and Memory content are sent to our AI provider (currently Anthropic) to generate responses. We have a Data Processing Agreement in place that prohibits Anthropic from training foundation models on your data. Anthropic may retain inputs and outputs for up to 30 days for abuse monitoring before deletion.
Video transcription is done by Whisper or a contracted equivalent under the same no-training terms.
We do not use Your Content to train any models, first- or third-party. Aggregate, anonymized usage signals (e.g. “feature X was used N times this month”) are used to improve the product.
The Viral Database and Account Spy index public metadata from TikTok and Instagram. We respect rate limits and publish an opt-out process at optout@useblam.com — creators can request removal of their profile and content from our indexes. We process removals within 14 days.
Videos are displayed via embedded players or cached thumbnails. Clicking through takes you to the original platform, which has its own privacy policy.
We share personal data only with the following sub-processors, each under a DPA:
| Provider | Purpose | Region |
|---|---|---|
| Vercel | Hosting / edge compute | US / EU |
| Supabase | Database, auth | US / EU (region-pinned) |
| Cloudflare R2 | File & video storage | Global |
| Mux | Video playback | US |
| Anthropic | LLM inference | US |
| Stripe | Payments | US / EU |
| Apify | Public-metadata scraping | EU |
| Resend | Transactional email | US |
| PostHog | Product analytics | EU |
| Sentry | Error monitoring | US |
| Intercom | In-app live chat | US |
We use strictly necessary cookies for auth and session management. We use analytics cookies (PostHog, self-hosted in EU) only if you've accepted them via the cookie banner, except in the US where accept-by-default is legal. We don't use third-party advertising or retargeting cookies. You can clear cookies any time; it'll log you out.
We encrypt data in transit (TLS 1.2+) and at rest (AES-256). Passwords are hashed with bcrypt. Production access is limited to on-call engineers via SSO + MFA, logged for audit. We run third-party penetration tests annually once we're past Series A. Report vulnerabilities to security@useblam.com. We'll acknowledge within 48 hours. No security is bulletproof — if we suffer a breach affecting you, we'll notify you without undue delay and in any case within 72 hours as required by GDPR.
Regardless of where you live, you have the right to:
California residents have the right to know what personal information we collect, the right to delete it, the right to correct inaccuracies, and the right to opt out of “sale” or “sharing” — we don't sell or share personal info in the legal sense, but the option is honored. We don't use Sensitive Personal Info for purposes beyond providing the Service. Exercise any right at privacy@useblam.com. We won't discriminate against you for asking.
Your data may be processed in the US, EU, or UK depending on the sub-processor. For transfers out of the EEA/UK, we rely on Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. We do not transfer data to jurisdictions without adequate protection.
Blam is not directed to users under 13 (or under 16 in the EU/UK). We don't knowingly collect data from children. If you believe a child has signed up, email privacy@useblam.com and we'll delete the account.
Material changes will be announced at least 30 days before they take effect (email + in-app banner). An archive of prior versions lives at /legal/archive.
Data questions: privacy@useblam.com
Security: security@useblam.com