Privacy Policy
Last updated: 7 October 2026
1. Who we are and scope
BLZLY (“BLZLY”, “we”, “us”) is a personal-brand studio. This policy explains what personal data we handle when you visit our website or send us an application through the form on it, why we do so, and what rights you have.
We act as the “controller” (the party deciding why and how your data is used) for the data described here. Questions go to support@blzly.com.
2. What data we collect
We collect only the following.
- Application form data. The name you enter, your email address or Instagram handle, the package or option you select (for example Foundation, Growth, Authority, or an invitation to a private event), and the free-text message you write. Please do not put sensitive information (health, religion, political views and similar) in the message.
- Technical data processed by our hosting provider. When you visit the site or submit the form, Cloudflare processes technical data such as your IP address, browser and device type, requested pages and request times, in server and security logs.
- Client account data. If you create an account or become a client: your name, email address and password (stored only in hashed form), and the project information, content drafts and your comments on them, files, reports, invoice records, messages and event invitation answers that we and you add in the account area.
- Emails you send us. If you write to business@blzly.com or support@blzly.com, or contact us by phone or on Telegram, we keep the message and our replies. Telegram processes those messages under its own privacy policy.
The public pages set no cookies and use no analytics. If you sign in to your account, your browser stores a sign-in session for that purpose (see our Cookie Notice). We do not knowingly collect any other data about you, and we do not buy data about you from third parties.
3. How the application is handled
When you submit the form, the details are sent to our server code, which forwards them as an email to our business mailbox. The application is therefore stored as an email in our mailbox, and is not kept in a separate database on the website. It remains there, together with any replies, until we delete it under section 7. The email provider that delivers it also keeps delivery records for a limited time (see section 5).
4. Why we use your data and our legal bases
If you are in the European Economic Area or the United Kingdom, the GDPR and UK GDPR require us to have a legal basis. Ours are:
| Purpose | Legal basis |
|---|---|
| Reading and replying to your enquiry; running the free brand review | Steps at your request before entering into a contract; our legitimate interest in answering people who contact us |
| Inviting you to private BLZLY events when you ask for an invitation, or where you are a client | Your consent (given when you request an invitation) and, for clients, our legitimate interest in running our events and performing our contract |
| Keeping the site and mailbox secure; preventing spam and abuse | Our legitimate interest in security and preventing abuse |
| Complying with legal obligations (for example responding to lawful requests) | Legal obligation |
By sending the form you confirm you have read this policy. Where we rely on consent you can withdraw it at any time by writing to support@blzly.com; this does not affect earlier use. Where we rely on legitimate interests, you may object (see section 9).
We do not use your data for automated decision-making that has legal or similarly significant effects, and we do not send marketing newsletters. We contact you only about your enquiry or, if you asked for one, an invitation.
5. Who we share data with
We use only these service providers (“processors”) to run the site and handle applications:
- Cloudflare, Inc.: hosting of the website, running our server code, security and request logs, and email routing that forwards mail sent to our addresses to the mailbox where we read it.
- Supabase: provides the database, sign-in and private file storage for client accounts. It processes the account data described above on our behalf.
- Resend: an email-sending service that delivers the notification email containing your application to us. It processes the content of that email and delivery records.
Emails forwarded by Cloudflare end up in a mailbox hosted by an email provider that we choose; that provider also processes the messages we receive.
We may also disclose data if required by law, to protect our rights or security, or to a successor if BLZLY is restructured or sold (we would tell you if that affects your data). We do not sell your personal data and we do not share it for cross-context behavioural advertising. We do not use advertising or analytics providers on the site.
6. International transfers
Our providers operate globally, so your data may be processed outside your country, including in the United States. Where data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on safeguards such as the European Commission’s Standard Contractual Clauses (and the UK addendum) or the EU-US Data Privacy Framework where the provider is certified. You can ask us for details at support@blzly.com.
7. How long we keep data
- Enquiries and applications (the email and your replies): up to 24 months after the last contact, unless a client relationship starts. We then delete them.
- Client records: for the duration of the relationship and afterwards for as long as needed for accounting, tax and legal-claim purposes (this period depends on the applicable law).
- Client accounts: while the account is open. You can ask us to delete your account at any time; we then delete or anonymise the data, except records we must keep (for example invoices) for the period the law requires.
- Event invitation lists: until you ask us to stop or for up to 24 months of inactivity.
- Technical logs: kept by Cloudflare and Resend under their own retention schedules, typically short; we do not control these periods.
We may keep data for longer where needed to defend or bring a legal claim.
8. Security
We use reasonable technical and organisational measures: the site is served over HTTPS, access to the mailbox is limited to people who need it, and secrets such as API keys are stored outside our code. No online service can be completely secure, so we cannot guarantee absolute security. Please do not send passwords or sensitive information through the form or by email.
9. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and get a copy;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to certain processing, including processing based on legitimate interests;
- receive your data in a portable format (where the processing is based on consent or contract);
- withdraw consent at any time;
- complain to your data protection authority (for example your national supervisory authority in the EEA, or the Information Commissioner’s Office in the UK).
How to exercise them: email support@blzly.com with the name and contact you used in the form. We may ask you to confirm your identity. We aim to answer within one month (the legal time limit under the GDPR), and will tell you if we need more time.
California (CCPA/CPRA) and similar US state laws. You have the right to know what personal information we collect and use, to request access, correction and deletion, and not to be discriminated against for using these rights. In the past 12 months we have collected identifiers (name, email or social handle, IP address) and the content you send us, for the purposes in section 4. We do not sell or “share” personal information as those terms are defined in California law, and we do not knowingly process the personal information of anyone under 18. You may use an authorised agent; we may need to verify the request. We do not currently respond to browser “Do Not Track” signals because we do not track you across sites.
10. Children
Our services are for adults. You must be at least 18 to use the website or send an application. We do not knowingly collect data from anyone under 18. If you believe a child has sent us data, write to support@blzly.com and we will delete it.
11. Links to other sites
The site may link to third-party platforms such as Instagram. Those platforms have their own privacy practices that we do not control.
12. Changes to this policy
We may update this policy, for example if we add analytics or new providers. We will change the date at the top and, where changes are significant, tell you in a suitable way (for example on the site). Please check this page from time to time.
13. Contact
Privacy requests, complaints and questions: support@blzly.com. General and business enquiries: business@blzly.com.