Privacy Policy

AI Blueprint (“we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains what information we collect when you use aiblueprint.app (the “Service”), how we use it, and the choices you have.

By using the Service, you agree to the collection and use of information in accordance with this policy.

2a. Information you provide directly

• Account registration — when you sign up, we collect your email address and a hashed password (we never store your password in plain text). If you use Google OAuth to sign in, we receive your name and email address from Google.
• Builder inputs — the text descriptions you submit to the AI Pipeline Builder to generate recommendations.

2b. Information collected automatically

• Usage data — pages visited, features used, and interactions with the Service (for example, which blueprint was generated or which news articles were viewed). This is collected in aggregate and not linked to your identity unless you are logged in.
• Log data — our servers automatically record information such as your IP address, browser type, operating system, referring URL, and timestamps when you access the Service.
• Cookies and local storage — we use session cookies to keep you logged in and browser local storage to remember your builder session state (message history, blueprint preferences). We do not currently use third-party advertising cookies.

2c. Payment information

If paid features are enabled, payments are processed by Stripe, Inc. We receive only limited confirmation data (e.g., subscription status, last four digits of card). We never store full card numbers or CVV codes.

We use the information we collect to:

• Create and manage your account and authenticate your identity.
• Provide and improve the Service, including generating pipeline recommendations and curating the news feed.
• Save your blueprints and make them available in your dashboard.
• Send transactional emails (e.g., account verification, password reset). We do not send marketing emails without your explicit consent.
• Detect and prevent fraudulent or abusive activity.
• Analyse aggregate usage trends to improve the Service.
• Comply with legal obligations.

We do not sell your personal data to third parties, and we do not use your builder inputs to train AI models or share them with AI providers.

The Service relies on the following third parties, each with their own privacy practices:

• Neon / PostgreSQL — our database provider stores your account information and saved blueprints securely.
• Vercel — our hosting provider. Vercel may log request metadata as part of normal infrastructure operations.
• NextAuth.js — manages authentication sessions using secure, HTTP-only cookies.
• Google OAuth — if you choose “Sign in with Google,” Google shares your name and email with us. Google's use of data is governed by the Google Privacy Policy.
• Unsplash — article thumbnail images may be fetched from Unsplash's API using your server's IP address. Your personal data is not sent to Unsplash.
• RSS Feed Publishers — news content is fetched server-side from public RSS endpoints. No personal data is shared with publishers.
• Stripe — payment processing when paid features are active. Governed by the Stripe Privacy Policy.

We use the following types of cookies and storage:

• Session cookies — required to keep you signed in. These expire when you close your browser or after a fixed period of inactivity.
• Browser local storage — used to cache your builder message history on your own device. This data never leaves your browser unless you explicitly save a blueprint to your account.

We do not currently use analytics platforms (such as Google Analytics) or advertising networks that track you across other websites.

We retain your account information and saved blueprints for as long as your account is active. If you delete your account, we will delete or anonymise your personal data within 30 days, except where retention is required by law (for example, payment records may be kept for up to 7 years for tax compliance).

Server log files are typically retained for 90 days before being deleted or anonymised.

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — request that we delete your account and associated data.
• Portability — request your data in a structured, machine-readable format.
• Objection / restriction — object to or request restriction of certain processing activities.

To exercise any of these rights, email us at hello@aiblueprint.app. We will respond within 30 days.

We implement industry-standard security measures including:

• TLS/HTTPS encryption for all data in transit.
• Bcrypt hashing for passwords stored in our database.
• HTTP-only, Secure, SameSite session cookies.
• Access controls limiting who within AI Blueprint can access user data.

No method of transmission over the Internet is 100% secure. We cannot guarantee absolute security, but we take reasonable precautions and will notify affected users of any material data breach as required by law.

The Service is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.

AI Blueprint is operated in the United States. If you access the Service from outside the US, your information may be transferred to and processed in the US or other countries where our service providers operate. By using the Service, you consent to this transfer.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, our legal basis for processing your personal data is typically performance of a contract (to provide the Service you signed up for) or our legitimate interests in operating and improving the Service. Where required, we will seek your explicit consent.

We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top of this page. For material changes, we will notify registered users by email or by an in-app notice. Your continued use of the Service after the updated policy takes effect constitutes your acceptance of the changes.

If you have questions, concerns, or requests relating to this Privacy Policy, please contact us at: