GDPR & security
GDPR and your AI writer: how your data flows
Choosing a GDPR-minded AI writer starts with knowing where your data lives and who sees it. This page explains how Blog Automation handles texts, credentials and AI providers.
- Hosting in Germany
- DPA
- Encrypted credentials
- Activity log
Where your data lives
The Blog Automation application and database run on our own servers in a data centre of STRATO GmbH in Germany. That is where your posts, ideas, settings, your team and the activity log are stored.
| Area | What | Where |
|---|---|---|
| Application and database | posts, ideas, settings, team, activity log | STRATO data centre in Germany |
| WordPress credentials | user name and application password | encrypted with AES-256 |
| AI actions | the text of the single action | OpenAI Ireland Ltd. (texts and images); processing outside the EU possible, safeguarded by standard contractual clauses |
| Payments | payment details for purchases and subscriptions | Stripe Payments Europe, Limited, Ireland; to perform the contract (Art. 6 (1) (b) GDPR) |
The full list is on the sub-processors page.
AI providers and data flow
Texts are written by OpenAI gpt-6-astra, images are created by OpenAI gpt-image-2. Your texts go to the AI provider only for the single action, for example when you create a post or shorten a paragraph. The provider works as a processor. According to the app, your input is not used to train the models.
In the Pro plan you can add your own AI keys. The action then runs under your own contract with OpenAI, Anthropic, Google or another provider, and you choose the provider yourself. Your keys are stored encrypted; only the last four characters are visible.
Important: Do not put sensitive personal data into notes for the AI, sample texts or posts unless you have to. Only the text of the single action goes to the AI provider.
Credentials and roles
- WordPress credentials are stored encrypted with AES-256. The application password is not shown again after saving.
- With roles and individual rights you decide who sees, edits, approves or publishes posts.
- The activity log records every action with person and time.
- You sign in with a password, an e-mail code or a passkey. An extra confirmation with an authenticator app is not available yet.
- Under Security you see signed-in devices and the login history.
Data processing agreement (Art. 28 GDPR)
If you process content that contains personal data with Blog Automation, you need a data processing agreement. The DPA applies in every plan, including Free, and is part of the terms; on request, you get a copy from support. You request an export of your data in the app under Privacy. More on the DPA page.
What we do not promise
We do not write "100 % GDPR compliant", because whether your use is lawful also depends on the data you process. We are open about where data lives and who processes it, and we give you the tools for clean documentation. The assessment for your company is made by your data protection officer or your legal adviser. This is not legal advice.
Frequently asked questions
Are my texts used to train the AI?
According to the app, no: input is not used to train the models. Texts go to the provider only for the single AI action. With your own AI key in the Pro plan, the terms of your own contract with the provider apply.
Which data goes to the AI provider?
According to the app, only the text of the single action: for example topic, focus keyword, notes and brand voice when writing, or the selected paragraph when shortening. The provider needs neither your WordPress credentials nor your payment details for an AI action.
Can I export or delete my data?
You request a data export in the app under Privacy. When you disconnect a website, posts that are already published stay in WordPress. To delete your account, write to us through the contact page. After the end of the contract we delete your data after 30 days; until then you can still request an export. We keep invoices for the statutory periods.
Ready for your first post?
Try Blog Automation with sample data
The demo opens at once, no sign-up needed. You see the dashboard, editor, calendar and approval just the way your team will use them.
The demo shows sample texts. The Free plan includes 200 tokens a month.