Privacy Policy

Blox , a product of TDCCommerce (“we”, “us”, or “our”), operates the Blox website-building platform. This Privacy Policy describes how we collect, store, use, and share information about visitors to our website, registered users, workspace collaborators, and visitors to sites published on Blox.

By registering for an account or using Blox, you consent to the data processes described in this policy. If you do not agree with these practices, please refrain from using the platform.

We collect information you give us directly, as well as information generated automatically as you use Blox:

• Account Registration: When you create an account, we collect your name, email address, and a securely hashed password. If you sign in with Google, we receive your basic Google profile (name, email, and avatar). If you enable passkeys or two-factor authentication, we store the public credential or encrypted secret needed to verify you — never your biometric data.
• Visual Design Content: Pages, sections, themes, CMS collections and items, blog posts, forms, custom scripts, uploaded media, and site settings you create are stored in our database and cloud storage so we can edit, publish, and serve your sites.
• Billing Information: All subscription payments are processed via Stripe. We do not store raw credit card numbers or security codes. Stripe shares basic billing details with us (such as your plan, invoice status, card brand, and the last 4 digits of the card) so we can keep your subscription and AI credit balance up to date.
• Form Submissions: If you add forms to your published sites, we store the data your visitors submit on your behalf so you can review and export it. For these submissions, you are the data controller and we act as your processor.

We use the information we collect to:

• Build, host, and serve your sites on Blox subdomains and the custom domains you connect.
• Verify domain ownership and provision SSL certificates for custom domains.
• Enable collaboration, including showing your name and email to other members of workspaces and sites you belong to, and live presence while editing.
• Process subscriptions, renewals, AI credit purchases, and invoices through Stripe.
• Generate sites, sections, and copy when you use Blox AI features.
• Send account emails such as verification, password resets, invitations, and form-submission notifications.
• Protect the platform against spam, fraud, and abuse, and meet our legal obligations.

We do not sell, rent, or trade your personal information. We share data only with service providers that help us run Blox, under confidentiality and data-protection obligations:

• Payments: Stripe processes subscription and AI credit payments.
• Hosting & Infrastructure: Our application, database, and media storage run on Google Cloud. Transactional emails are delivered through Amazon SES, and real-time collaboration uses Pusher.
• AI Services: When you use AI features, your prompts and the relevant site content are sent through the Vercel AI Gateway to third-party model providers to generate a response. We do not permit your content to be used to train their models.
• Spam Protection: Forms may use Google reCAPTCHA, which is subject to Google's Privacy Policy and Terms.
• Legal Obligations: We may disclose data if required by law, subpoena, or court order, or to enforce our Terms of Service.

We use cookies and browser storage (such as localStorage) to run the platform:

• Authentication: Secure, HTTP-only session cookies keep you signed in.
• Preferences: Settings such as your light or dark theme and selected workspace are saved in localStorage so they persist between visits.
• Your Published Sites: Blox does not add advertising or cross-site tracking cookies to sites you publish. If you add analytics, pixels, or other third-party scripts to your site, you are responsible for any cookies they set and for obtaining your visitors' consent where required.

Blox uses administrative, technical, and physical safeguards to protect your data. All traffic between your browser, the editor, our API, and published sites is encrypted with TLS (HTTPS). Passwords are hashed, and sensitive values such as API keys, webhook secrets, and third-party credentials are encrypted at rest.

Each time you publish, Blox saves a version snapshot so you can restore earlier versions of your site within your plan's version history window. No method of transmission or storage is completely secure, so while we work hard to protect your data, we cannot guarantee absolute security.

Depending on where you live, you may have rights over your personal information under the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), or other privacy laws:

• Access & Export: You can export form submissions and CMS collections as CSV, and export your sites, from your dashboard. You may also ask us for a copy of the personal data we hold about you.
• Correction: You can update your name and account details on your Profile page at any time.
• Deletion (“Right to be Forgotten”): You can request deletion of your account and the sites and data associated with it, subject to the retention periods described below.
• No Sale of Data: We do not sell or share your personal information for cross-context behavioral advertising.

To exercise any of these rights, contact us using the details below. We will not discriminate against you for exercising them.

We keep account information for as long as your account is active or as needed to provide the Services. When you delete your account, we delete or anonymize your personal data within 30 days, except where we must keep it longer to meet legal, tax, or accounting obligations (for example, billing records).

Version history snapshots are kept for the period included in your plan and then removed automatically. Form submissions and other data collected on your published sites are kept until you delete them or your account is closed.

For questions about this policy, data requests, or to exercise your privacy rights, contact the Blox team: