Privacy policy

This website works without cookies, without tracking and without third-party content. Here you can find out which data is still processed, what happens in the Blog Automation app and what rights you have.

This privacy policy applies to the website blog-automation.com (the "website") and to the Blog Automation app at app.blog-automation.com, where we process data of our customers and their teams as the controller (section 9). The German version is the binding one.

Last updated: 23 October 2026

1. Controller

The controller responsible for data processing is:

Internet am Dornbusch
Owner: Sajjad Hanifa
Eschersheimer Landstraße 297
60320 Frankfurt am Main
Germany

Phone: +49 69 34 87 77 44
E-mail: info@blog-automation.com

Blog Automation is a service of Internet am Dornbusch.

We are not required to appoint a data protection officer, because the conditions of § 38 BDSG and Art. 37 GDPR are not met in our case. For any questions about data protection, you can contact us directly.

2. Summary

  • This website sets no cookies.
  • We use no analytics or tracking services, no advertising pixels and no social media plugins.
  • Fonts (Gabarito, Geist and Geist Mono) are served from our own server. There is no content delivery network (CDN), no Google service, no map and no embedded video.
  • We store only one entry in your browser's storage: that you closed our privacy notice (section 4).
  • The live demo on the home page only loads after you click (section 7).
  • Messages from the contact form are not stored on the website; they are sent to us by e-mail (section 5).

3. Hosting and server log files

This website runs on a server we operate ourselves at IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, in a data centre in Germany. We have a data processing agreement with IONOS under Art. 28 GDPR. The Blog Automation app runs separately on servers in a data centre of STRATO GmbH in Germany (section 9).

Each time you open a page, your browser sends technical data to the web server. The web server stores this data in log files:

  • IP address
  • date and time of access
  • requested address (URL)
  • referrer, i.e. the page you came from, if your browser sends it
  • user agent, i.e. browser and operating system
  • HTTP status code (for example, whether the page was found) and amount of data transferred

Purpose: delivering the website, finding and fixing technical errors, and protecting against attacks and misuse. The data is not analysed for statistics or advertising.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is the secure and stable operation of the website.

Storage period: the log files are not combined with other data. They are rotated and deleted automatically as soon as they are no longer needed for these purposes, unless a specific security incident still needs to be investigated.

4. Local storage in the browser (privacy notice)

On your first visit, the website shows a short privacy notice. When you close it with "Got it", your browser stores an entry named "ba_notice" in its local storage (localStorage). It only records that you closed the notice, so that it does not appear again on every page.

The entry contains no personal data, is not sent to our server and is not analysed. It stays in your browser until you delete it, for example in your browser settings ("clear site data"). After that, the notice appears again on your next visit.

Legal basis: § 25 (2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act). Storing it is strictly necessary for the website to remember that you have already read the notice.

5. Contact form

You can send us a message through the contact form. We process:

  • topic (chosen from a list)
  • name
  • company (optional)
  • e-mail address
  • phone number (optional)
  • your message
  • your consent via the checkbox
  • the page from which you sent the form and the time it arrived

Sent by e-mail: your details are not stored on the website, not even in a database; they are sent straight to our mailbox info@blog-automation.com by e-mail. Sending runs encrypted via the mail server (SMTP) of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, where our mailbox is also hosted. We have a data processing agreement with IONOS. If the e-mail cannot be sent, nothing is stored and you see an error message.

Confirmation: after sending, you automatically receive a short confirmation at the e-mail address you entered. It names your topic, your name and your company, but does not contain your message.

Spam protection without third parties: so that no automated requests reach us, the form checks on sending:

  • a hidden field that only automated programs fill in,
  • a security token (nonce) and a signed time stamp that show whether the form was sent unrealistically fast or very late,
  • a small calculation that your browser solves itself before sending (proof of work). Your browser fetches the task from our own server; we only record that a solved task has already been used,
  • the number of submissions: at most 5 per hour. For this we do not store your IP address, only a short value derived from it that cannot be reversed (hash). This value is deleted automatically after one hour.

We use no external service for this (no reCAPTCHA), set no cookies and transfer no data to third parties. The legal basis for spam protection is Art. 6 (1) (f) GDPR. Our legitimate interest is protecting the form from misuse.

Purpose: handling and answering your request.

Legal basis: your consent via the checkbox (Art. 6 (1) (a) GDPR). If your request is aimed at a contract with us, for example a quote, we also process the data to take steps prior to entering into a contract (Art. 6 (1) (b) GDPR). You can withdraw your consent at any time with effect for the future; an informal message to us is enough.

Storage period: we delete your request from our mailbox once it has been dealt with and no statutory retention obligations apply. If your request leads to a contract, we keep the related business correspondence for the periods required by commercial and tax law (Art. 6 (1) (c) GDPR).

6. Contact by e-mail or phone

If you e-mail or call us, we process your contact details and the content of your request in order to deal with it. The legal basis is Art. 6 (1) (b) GDPR where a contract or its preparation is concerned, otherwise Art. 6 (1) (f) GDPR (our legitimate interest in answering requests). Our mailboxes are hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. Section 5 applies accordingly to the storage period.

7. Live demo on the home page

On the home page you can try the Blog Automation app with sample data in a frame (iframe). Before you click "Start the live demo", the website loads nothing from the app and no data is sent to it.

Only after your click does your browser load the demo from app.blog-automation.com, which is our own app (section 9). The app's server then receives the usual technical data from your browser, for example your IP address. The demo sets a technically necessary session cookie there ("bp_demo_sid") so that the demo session works, and stores app settings such as language and display in your browser's storage. The demo works with invented sample data, does not call any AI provider and publishes nothing. No sign-up is needed. The same applies if you open the demo in its own tab through a "Try the demo" link.

Legal basis: Art. 6 (1) (f) GDPR (providing the demo you asked for) and, for the cookie and storage, § 25 (2) no. 2 TDDDG.

Our pages contain links to websites of other providers, for example to sources in our guides. As long as you do not click a link, no data is sent to these providers. Only when you follow a link does the operator of that website process your data under its own responsibility.

9. The Blog Automation app (customer accounts)

Links such as "Start free" or "Log in" take you to the app at app.blog-automation.com. If you create and use an account there, we process as the controller:

  • Account data: name, business e-mail address, company, password (stored only as a hash), role, language and settings, and the data of team members you invite
  • Contract and billing data: chosen plan, billing period, token balance and token bookings, invoices and payment status
  • Usage and security data: sign-in times and methods, signed-in devices (browser and operating system, shortened IP address), passkeys, an activity log of actions in the account and a list of AI calls

Purpose and legal basis: providing the service and performing the contract (Art. 6 (1) (b) GDPR), meeting tax and commercial law obligations (Art. 6 (1) (c) GDPR) and the security of the service (Art. 6 (1) (f) GDPR). For signing in, the app sets a technically necessary session cookie (§ 25 (2) no. 2 TDDDG); it is used only for signing in, not for analytics. The app uses no analytics or tracking services.

Hosting: the app and its database run on servers we operate in a data centre of STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. The app's e-mails (for example sign-in codes, invitations and notifications) are sent via IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany.

Payments via Stripe: we bill paid plans and token packs through the payment service provider Stripe Payments Europe, Limited, Dublin, Ireland ("Stripe"). You enter your payment details directly on Stripe's checkout page (Stripe Checkout); we never receive full card or account details. We send Stripe the details needed for the payment (for example company, e-mail address, plan and amount) and receive the payment status and invoices from Stripe. You manage your subscription and payment method in Stripe's customer portal, which you open from the app. The legal basis is Art. 6 (1) (b) GDPR. Stripe also processes payment data under its own responsibility, for example to prevent fraud and meet legal obligations. In doing so, Stripe transfers data to Stripe, LLC in the USA. According to Stripe, Stripe, LLC complies with the EU-U.S. Data Privacy Framework (adequacy decision under Art. 45 GDPR) and Stripe also uses standard contractual clauses. More in Stripe's privacy policy: stripe.com/privacy (external link)

AI features via OpenAI: when you start an AI action in the app, for example writing a post or creating an image, we send the text of that action to OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. For this content you as the customer are the controller and we are your processor; details are in the DPA and on the sub-processors page. OpenAI may also process the data outside the European Economic Area, for example in the USA. Under OpenAI's data processing addendum, this is based on the European Commission's standard contractual clauses or an adequacy decision.

Storage period: we delete account data 30 days after the end of the contract. We keep invoices and accounting records for the statutory periods (up to 10 years, § 147 AO, § 257 HGB).

Content you process in the app: for posts, ideas, images and other content that you or your team process in Blog Automation, you as the customer are the controller. We process it as a processor under the DPA.

10. Recipients and transfers to third countries

Within our company, only the people who need your data for the purposes described receive it. External recipients are only the service providers named in this policy:

  • IONOS SE (website server, sending e-mail and mailboxes, sections 3, 5, 6 and 9)
  • STRATO GmbH (data centre of the app, section 9)
  • for paid plans, Stripe (payments, section 9)
  • for AI actions in the app, OpenAI (section 9)

We do not sell data and do not pass it on for advertising.

When you visit the website or use the contact form, we transfer no data to countries outside the European Union or the European Economic Area. If you use a mailbox with a provider outside the EU yourself, for example Gmail or Outlook.com, that provider processes the confirmation and our reply under its own terms. In the app, transfers to the USA may occur with Stripe and OpenAI (section 9).

11. Your rights

Under the GDPR you have the following rights towards us:

  • Access to the data we process about you (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure of your data (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Withdrawal of consent with effect for the future (Art. 7 (3) GDPR)

Right to object (Art. 21 GDPR): where we process data on the basis of our legitimate interest (Art. 6 (1) (f) GDPR), you may object at any time on grounds relating to your particular situation.

An informal message to the contact details in section 1 is enough for any request.

12. Right to lodge a complaint with a supervisory authority

You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your residence, your place of work or the place of the alleged infringement. The authority responsible for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Wilhelmstraße 7
65185 Wiesbaden, Germany
datenschutz.hessen.de (external link)

13. Obligation to provide data

You are not required by law or contract to provide us with personal data. Without the required fields of the contact form (name, e-mail address, message and consent) we cannot accept your request, and without account data we cannot provide the app. Without the technically transmitted data (section 3), the website cannot be displayed.

14. No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

15. Changes to this privacy policy

We update this privacy policy when the website, the app, the technology we use or the law changes. The version published here applies.

Last updated: 23 October 2026