Effective date: 25 October 2026

This Privacy Policy explains how RizSTACK Technologies Private Limited ("RizSTACK", "Blockora", "we", "us", or "our") collects, uses, stores, shares, and protects personal data when you use Blockora, including the website at https://blockora.net and the Blockora web application (together, the "Service"). Blockora is a product of RizSTACK Technologies Private Limited, a private limited company incorporated in India.

We process personal data in line with India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the Digital Personal Data Protection Rules, 2025 (the "DPDP Rules"), as their provisions come into force, and the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the "SPDI Rules") for as long as they remain in force. We have also included sections for users in the European Economic Area, the United Kingdom, Switzerland, and the United States, including California.

This notice is meant to be read and understood on its own. It should also be read together with our Terms of Service and Cookie Policy.

1. Who Is Responsible for Your Information

RizSTACK Technologies Private Limited is the "Data Fiduciary" for your personal data under the DPDP Act, and the "controller" for the purposes of the GDPR and UK GDPR.

Contact: grievance@blockora.net

We have appointed a Grievance Officer who is responsible for answering your questions about the processing of your personal data and for handling your grievances (see Section 16).

If you publish a website with Blockora and collect information from your own visitors, you are the Data Fiduciary (or controller) of that information, and you are responsible for your own privacy notice and for obtaining any consent required. Where we host or process that information for you, we act as your Data Processor (or processor).

2. Information We Collect

The categories below are an itemised description of the personal data we process. Section 3 explains the specific purposes for each.

2.1. Information from Google and GitHub sign-in

When you sign in with Google or GitHub, we receive only the basic profile information needed to create and secure your account:

Google: we request only the openid, email, and profile scopes. This gives us your name, email address, whether your email is verified, profile picture URL, language preference (if provided), and your unique Google account identifier.
GitHub: we request the read:user and user:email scopes, which gives us your GitHub username, display name, email address, avatar URL, and unique GitHub user identifier.

We do not store your Google or GitHub OAuth access or refresh tokens. We keep only your provider account identifier, email address, and avatar to maintain your account. We do not receive your Google or GitHub password. We do not request access to your Gmail, Google Drive, Google Contacts, Google Calendar, or any other Google service data.

2.2. Information you provide

Account and profile information: name, email address, and any settings or preferences you choose.
Prompts and inputs: the text prompts, instructions, images, logos, files, and other material you submit to generate or edit websites.
Generated content: the websites, code, text, images, and other output the Service creates for you, along with project names, version history, and published site settings (such as custom domains).
Communications: messages you send to support or to our Grievance Officer, feedback, survey responses, and any information you include.
Billing information: your billing name, billing address, state, country, GSTIN (if provided), and plan details. See Section 2.4.

Please do not include sensitive personal data (such as health information, Aadhaar or other government identification numbers, passwords, biometric data, or financial account numbers) in your prompts or uploads unless it is necessary for your website.

2.3. Information collected automatically

Usage data: features used, pages viewed, actions taken, credits consumed, generation requests, timestamps, and referral source.
Log and device data: IP address, browser type and version, operating system, device type, language, approximate location derived from IP address (city or country level), and error and performance logs.
Cookies and similar technologies: see our Cookie Policy.

2.4. Payment information

Payments are processed by our payment processor, Stripe. Your full card number, CVV, UPI PIN, and net banking credentials are collected and stored directly by Stripe or your bank, not by us. Card details may be stored by Stripe as a token in line with Reserve Bank of India rules on card-on-file tokenisation. We receive limited information such as your name, email, phone number (if provided at checkout), billing state and country, the payment method type, the last four digits and network of your card (where applicable), transaction history, e-mandate status, and subscription status.

2.5. Information from other sources

We may receive information from fraud prevention services, from our payment processor (for example, about chargebacks), or from public sources when needed to investigate abuse.

3. How We Use Your Information

We use personal data for the following specified purposes:

(a) To provide the Service: create and manage your account, authenticate you, generate and edit websites from your prompts, store your projects, host and publish your sites, and provide customer support.
(b) To process payments: manage subscriptions, credits, e-mandates, invoices, GST and other taxes, and billing communications.
(c) To communicate with you: send service messages such as account confirmations, security alerts, billing notices, pre-debit notifications, and changes to our terms or policies.
(d) To keep the Service safe: detect, investigate, and prevent fraud, abuse, spam, security incidents, and violations of our Terms (for example, phishing or malware sites), and enforce usage limits.
(e) To understand and improve the Service: analyze usage trends, fix bugs, measure performance, and develop new features. We use aggregated or de-identified data for this where possible.
(f) Marketing: send product updates or promotional emails where you have agreed. You can unsubscribe at any time using the link in each email.
(g) Legal compliance: comply with legal obligations (including tax, accounting, and cybersecurity reporting obligations), respond to lawful requests from authorities, and establish, exercise, or defend legal claims.

AI training. We do not use your prompts or generated content to train our own or third-party AI models. Where our AI model providers offer the option, we use settings or agreements under which they do not use your data to train their models.

We will only use your personal data for the purposes described in this policy, unless we get your consent or the law permits otherwise.

4. Legal Bases for Processing

4.1. India (DPDP Act)

We process your personal data on one of the following grounds:

Consent: for the purposes in Section 3, we rely on the consent you give when you create an account and accept this notice, or when you opt in to specific features (such as marketing emails or non-essential cookies). Your consent is free, specific, informed, unconditional, and unambiguous, and limited to the personal data needed for the stated purpose.
Legitimate uses: where the DPDP Act permits processing without consent, for example where you voluntarily provide personal data for a specified purpose and have not indicated that you do not consent to its use, to comply with a law or a court order, or to respond to a medical emergency or other situations set out in Section 7 of the DPDP Act.

Withdrawing consent. You can withdraw your consent at any time, as easily as you gave it, by changing your settings, unsubscribing, deleting your account, or emailing grievance@blockora.net. Withdrawing consent does not affect processing that happened before you withdrew it. After you withdraw consent, we will stop processing your personal data for that purpose (and ask our Data Processors to stop) within a reasonable time, unless the law requires or permits us to keep it. Some parts of the Service may stop working if you withdraw consent needed to provide them.

4.2. EEA, UK, and Switzerland

If the GDPR, UK GDPR, or Swiss data protection law applies to you, we rely on the following legal bases:

Providing the Service, account creation, sign-in, generating and hosting your sites, and support (purpose 3a): performance of a contract.
Processing payments and billing (purpose 3b): performance of a contract, and legal obligation for tax and accounting.
Service communications (purpose 3c): performance of a contract, and legitimate interests.
Security, fraud, and abuse prevention (purpose 3d): legitimate interests in keeping the Service and users safe, and legal obligation.
Analytics and improvement (purpose 3e): legitimate interests in improving our product, and consent where required for non-essential cookies.
Marketing (purpose 3f): consent, or legitimate interests where permitted for existing customers.
Legal compliance and claims (purpose 3g): legal obligation, and legitimate interests.

Where we rely on consent, you can withdraw it at any time. Where we rely on legitimate interests, you can object (see Section 10).

5. Sensitive Personal Data or Information (SPDI Rules)

We do not intend to collect sensitive personal data or information as defined in the SPDI Rules, other than limited financial information handled by our payment processor as described in Section 2.4. Where the SPDI Rules apply, we collect such information only with your consent, for a lawful purpose connected with the Service, and we protect it using reasonable security practices. You may refuse to provide it or withdraw your consent, but we may then be unable to provide the related part of the Service.

6. How We Share Your Information

We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We share personal data only as follows:

6.1. Data Processors (service providers)

We share information with trusted Data Processors who process it on our behalf, under valid contracts that require them to protect it and use it only to provide services to us:

Hosting and infrastructure: our own servers, with Cloudflare for CDN, DNS, TLS for custom domains, web analytics, and Turnstile bot protection. They receive all data stored in or passing through the Service as needed to deliver, secure, and operate it.
Database: we host our database ourselves as self-managed MySQL on our own servers. Account data, projects, and generated content are stored there and are not handed to a third-party database vendor.
AI model providers: OpenAI, Google (Gemini), and Anthropic. They receive your prompts, inputs, and related project content needed to generate output.
Speech-to-text for voice prompts: Groq or ElevenLabs. They receive voice audio to transcribe it. Audio is not stored by us.
Stock images: Pixabay and Pexels. They receive image search queries needed to return stock photos.
Payment processing: Stripe. It receives billing, e-mandate, and transaction information.
Analytics: Cloudflare Web Analytics (cookieless) plus our own first-party usage statistics. They cover usage and device data.
Email delivery: our transactional email provider. It receives name, email address, and message content needed to send emails.

We use no third-party error monitoring tool and no third-party customer support tool.

6.2. Other disclosures

At your direction: when you publish a website, connect a third-party service (such as a domain registrar), or ask us to share information.
Legal reasons: when disclosure is required by law, court order, or a lawful request from a government agency authorised by law (including requests under the Information Technology Act, 2000 and directions of CERT-In), or is needed to protect the rights, property, or safety of RizSTACK, our users, or others, or to investigate fraud or abuse.
Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business, subject to confidentiality protections and applicable law. We will notify you if your information becomes subject to a different privacy policy.
Aggregated or de-identified data: which does not reasonably identify you.

Content you publish on a public website created with Blockora is visible to anyone who visits that site.

7. Cross-Border Transfers

RizSTACK is based in India, but some of our Data Processors store and process your personal data outside India, including the United States and the European Union, where our service providers operate. We transfer personal data outside India as permitted by Section 16 of the DPDP Act and the DPDP Rules, and we will not transfer it to any country or territory that the Government of India restricts by notification, or contrary to any conditions the Government of India specifies. When your personal data is processed outside India, it may also be subject to the laws of that country and accessible to its courts and authorities. We require our Data Processors to protect it with safeguards at least as protective as those in this policy.

For transfers of personal data from the EEA, UK, or Switzerland to India or other countries without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum or Swiss equivalent), the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where a provider is certified, or other lawful transfer mechanisms. You can contact us for more information about these safeguards.

8. How Long We Keep Information

We keep personal data only as long as needed for the purposes in this policy, or as long as required by law, and then erase it (and ask our Data Processors to erase it). Generally:

Account information: for as long as your account is active, and erased or anonymized within 30 days after you delete your account or withdraw consent.
Prompts, projects, and generated content: for as long as your account is active or until you delete them, then removed from active systems within 30 days and from backups within 90 days. Deleted projects are purged after 30 days.
Billing and transaction records: for as long as required by tax, GST, and company law (in India, generally up to 8 years).
Logs, traffic data, and security data: for 1 year, as required by the DPDP Rules, and for any longer period required under directions issued by CERT-In (including keeping ICT logs for 180 days within India) or other law, unless needed longer to investigate abuse or security incidents.
Information about Terms violations or chargebacks: as long as reasonably needed to prevent repeat abuse or defend legal claims.

9. Security and Breach Notification

We use reasonable security safeguards appropriate to the sensitivity of the information, as required by the DPDP Act and the SPDI Rules, including encryption in transit (TLS), encryption at rest where supported by our providers, access controls based on least privilege, logging and monitoring of access, backups, and contractual safeguards with our Data Processors. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

If a personal data breach affects you, we will notify you without delay, describing the breach, its likely consequences, the steps we are taking, the steps you can take to protect yourself, and how to contact us. We will also report the breach to the Data Protection Board of India and, where required, to the Indian Computer Emergency Response Team (CERT-In) within the time limits set by law.

10. Your Rights and Choices

10.1. Rights under the DPDP Act

As a Data Principal under the DPDP Act, you have the right to:

Access information: obtain a summary of the personal data we process about you and the processing activities, and the identities of the Data Fiduciaries and Data Processors we have shared it with, with a description of the data shared;
Correction and erasure: have inaccurate or misleading personal data corrected, incomplete data completed, and data updated, and have personal data erased when it is no longer needed for the purpose for which it was collected, unless we must keep it by law;
Withdraw consent: at any time, as described in Section 4.1;
Grievance redressal: have your grievances about our processing of your personal data handled by our Grievance Officer (Section 16);
Nominate: nominate another person to exercise your rights on your behalf in the event of your death or incapacity; and
Complain to the Data Protection Board of India: if you are not satisfied with our response to your grievance, after first using our grievance redressal process.

Under the DPDP Act, you also have duties, including not to register a false or frivolous grievance or complaint, not to impersonate another person, and to provide only verifiably authentic information when exercising your rights.

10.2. Rights for other users

Depending on where you live, you may also have the right to object to or restrict certain processing (including processing based on legitimate interests or for direct marketing), to data portability (receiving a copy of information you provided in a structured, commonly used, machine-readable format), and to complain to your local data protection authority.

You can update account details and delete projects or your account in your account settings. You can also revoke Blockora's access to your Google account at any time at https://myaccount.google.com/permissions, and to your GitHub account at https://github.com/settings/applications.

10.3. How to make a request

Email grievance@blockora.net or our Grievance Officer at grievance@blockora.net from the email address linked to your account, or use the Profile page in your account (app.blockora.net/profile). Please include your account email (your account identifier) so we can find your data. We may need to verify your identity before acting on your request. We will acknowledge your request promptly and respond within one month, and in any case within the period required by applicable law (under the DPDP Rules, no more than 90 days). We do not charge a fee for requests. If we cannot fulfil a request, we will explain why, subject to legal limits.

You may use an authorized agent or nominee to make a request on your behalf where the law allows; we may ask for proof of authorization.

10.4. Complaints

If you are not satisfied with our response, you may contact:

India: the Data Protection Board of India, through the means it publishes (see https://www.meity.gov.in for current details).
EEA / UK / Switzerland: your local data protection authority, or the UK Information Commissioner's Office (https://ico.org.uk).

10.5. Marketing and cookies

You can unsubscribe from marketing emails using the link in each email. You will still receive essential service emails. To manage cookies, see our Cookie Policy.

11. Additional Information for U.S. and California Residents

This section applies to residents of California and other U.S. states with comprehensive privacy laws.

Categories collected (past 12 months): identifiers (name, email, account IDs, IP address); customer records (billing information); commercial information (plans, purchases, credits); internet or network activity (usage and log data); approximate geolocation; user content (prompts and generated content); and inferences limited to product usage analytics.
Sources: you, your sign-in provider (Google or GitHub), your device, and our service providers.
Purposes: the purposes in Section 3.
Disclosures: we disclose each category to the service providers listed in Section 6 for business purposes.
No sale or sharing: we do not sell personal information or share it for cross-context behavioural advertising, and we have not done so in the past 12 months. We do not knowingly sell or share the personal information of consumers under 16.
Sensitive personal information: we do not use or disclose sensitive personal information for purposes that would give rise to a right to limit under California law.
Your rights: to know, access, correct, delete, and obtain a portable copy of your personal information, and to not be discriminated against for exercising these rights. Some states also give you the right to appeal our decision; you can appeal by replying to our decision email. We honor Global Privacy Control (GPC) signals as an opt-out of any non-essential tracking cookies in the browser that sends them.
Retention: see Section 8.

To exercise these rights, contact us as described in Section 10.3.

12. Google API Services User Data Policy and Limited Use Disclosure

Blockora's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Specifically, regarding Google user data:

What we access: only your name, email address, email verification status, profile picture, language preference (if provided), and Google account ID, through the openid, email, and profile scopes when you choose "Sign in with Google".
How we use it: only to create and authenticate your Blockora account, display your name and picture in the app, contact you about your account, and keep your account secure. We do not use Google user data for advertising, and we do not use it to develop, improve, or train generalized or non-personalized AI or machine learning models.
How we store it: in our account database on our own servers, encrypted in transit and protected by access controls. We do not store Google access or refresh tokens.
How we share it: we do not sell Google user data. We do not transfer it to third parties except to service providers that help us operate the Service (such as hosting and email delivery providers) under confidentiality obligations, as needed to comply with law, or as part of a merger or acquisition with notice to you. We do not send Google user data to AI model providers.
Human access: our staff do not read Google user data unless you give us permission (for example, for support), it is needed for security purposes such as investigating abuse, or it is required by law.
Retention and deletion: we keep Google user data while your account is active. You can delete your account in settings or by emailing grievance@blockora.net, and we will delete your Google user data within 30 days, except where we must keep limited records by law. You can also revoke access at https://myaccount.google.com/permissions.

13. Children's Personal Data

Under the DPDP Act, a "child" is anyone under 18. The minimum age to use the Service is 18.

The Service is not intended for anyone under 18, and we do not knowingly process the personal data of children. If we learn that we have collected personal data from a child without verifiable parental consent, we will delete it. If you believe a child has provided us with personal data, contact us at grievance@blockora.net.

For users outside India, we also do not knowingly collect personal information from children under 13 (or the higher minimum age where they live, such as 16 in some EEA countries) without the consent required by local law.

14. Third-Party Links and Services

The Service and websites built with it may link to third-party websites or services (including Google, GitHub, and your payment processor). Their privacy practices are governed by their own policies, and we are not responsible for them.

15. Changes to This Policy

We may update this policy from time to time. If we make material changes, we will notify you by email or through the Service before they take effect, and update the "Last updated" date above. Where required by law, we will ask for your consent again.

16. Contact Us and Grievance Officer

If you have questions, requests, or complaints about this policy or our processing of your personal data, contact us or our Grievance Officer. Our Grievance Officer is designated under the DPDP Act, the SPDI Rules, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Consumer Protection (E-Commerce) Rules, 2020.

Grievance Officer, RizSTACK Technologies Private Limited (operator of Blockora). Email: grievance@blockora.net.

We will acknowledge your grievance within 24 hours (and in any case within 48 hours) and resolve it within one month of receipt, which is within the 90-day maximum under the DPDP Rules. If you are not satisfied with the outcome, you may complain to the Data Protection Board of India.