Privacy Policy

The Site is operated in connection with Blans, a product under active development for small teams.

For privacy requests and questions: team{'@'}blans.co.

Blans is described on the Site as a calm workspace for small teams: a Kanban-style board, documents linked to work, internal company updates, and analytics aimed at improving flow—not individual surveillance.

This policy focuses on the marketing Site and data you send us through it. If you later use the hosted Blans application (for example at app.blans.co or another URL we publish), that environment may collect additional workspace data (tasks, files, team content). Where a conflict exists, the notices and terms that apply inside the logged-in product govern that product use.

This policy applies to blans.co and related marketing pages we control, including waitlist or contact flows initiated from the Site.

It does not govern third-party sites you open from links (for example social networks or payment providers if we add them later). Those services have their own policies.

Identity and contact data you type into forms: typically name, email address, and optional free-text fields (for example feedback or “what you need from a task tool”).

Technical and usage metadata generated when you browse: may include IP address, approximate location derived from IP, browser and device type, operating system, referrer URL, request timestamps, HTTP status, and similar server or CDN logs used for security and reliability.

Cookie and local-storage identifiers used for language preference, cookie consent state, and (only if you opt in) analytics session data as described in our Cookie Policy.

Communications content when you email team{'@'}blans.co or message us through channels we operate.

We do not intentionally collect special categories of data (such as health or biometric data) through the Site. Please do not submit such information in free-text fields.

When you submit the “get started” / waitlist form on the Site, we store the submission so we can respond, prioritise early access, and improve the product. Typical fields stored include: your name, email address, optional message text, and a creation timestamp.

Those records are stored in a database hosted with Supabase, Inc. (“Supabase”), which acts as a processor on our behalf. Supabase provides managed Postgres, authentication tooling we may use elsewhere in the product stack, and related infrastructure. Supabase’s own terms, privacy policy, and (where applicable) data processing terms apply to their processing of data on their systems.

We configure access keys and server-side routes so that submissions are handled with least privilege in mind, but no internet-facing system is risk-free. You should not put secrets, credentials, or highly confidential business data into marketing forms.

We may send operational emails (for example a confirmation after joining a waitlist) using Resend, Inc. or a similar provider. Resend processes recipient addresses and message content as a processor for delivery, bounce handling, and abuse prevention.

We do not sell email lists. Marketing beyond what fits your request will be handled carefully and, where required by law, only with appropriate consent or soft opt-in rules respected.

If and only if you choose “Accept all” on our cookie banner, we load OpenPanel analytics software to understand aggregate usage of the Site (for example which pages are viewed, outbound link clicks, and screen-flow signals as configured in our integration).

OpenPanel and the configured ingestion endpoint process event data as described in OpenPanel’s documentation. We use analytics to improve the Site and product positioning—not to make automated decisions about your legal rights or eligibility for employment, credit, or similar high-risk areas.

If you choose “Essential only” or never accept analytics, the OpenPanel script is not loaded for that browsing experience (subject to your browser not restoring it from an old session). You can withdraw consent later via “Cookie preferences” in the footer, which clears the stored choice and reloads the Site.

We use first-party cookies and local storage for essential or functional purposes (for example remembering locale and storing your cookie choice).

Optional analytics may set additional identifiers if you consent. See the Cookie Policy for a concise list and retention logic.

To operate, maintain, and secure the Site; to detect abuse, fraud, and technical failures.

To respond to waitlist and contact requests and send related transactional messages.

To measure aggregate interest in Blans when you consent to analytics.

To comply with legal obligations and establish, exercise, or defend legal claims.

To improve the Site and product roadmap based on aggregated or de-identified insights where possible.

Where the GDPR or similar laws apply, we rely on: (a) performance of a contract or steps prior to a contract when handling a request you initiate; (b) legitimate interests in securing and improving the Site, balanced against your rights; (c) consent where we must have it (optional analytics); and (d) legal obligation where applicable.

You may object to processing based on legitimate interests in some cases, and may withdraw consent for analytics at any time without affecting the lawfulness of earlier processing.

We share information with service providers strictly as needed to run the Site: currently including Supabase (database storage for waitlist records), Resend (transactional email delivery), and—if you consent—OpenPanel-related infrastructure for analytics. We also use hosting/CDN and DNS providers typical for a modern web property.

We do not sell your personal information for money. We do not “share” personal information for cross-context behavioural advertising as defined under certain US state laws; if our practices change in a way that triggers sale/share definitions, we will update this policy and controls accordingly.

If we involve a new subprocessor materially similar to the above, we will reflect it in this policy or an internal register and, where required, notify you.

We and our providers may process data in the European Economic Area, the United States, and other regions where servers run. If we transfer personal data from the EEA, UK, or Switzerland to countries without an adequacy decision, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms, in addition to technical measures.

Provider privacy materials describe their global infrastructure; you may request more detail about safeguards by emailing team{'@'}blans.co.

Waitlist and inquiry records: kept while relevant to early access, onboarding, and product development, then deleted or anonymised unless a longer retention is required for legal, security, or dispute-resolution reasons.

Server logs: kept for a limited rolling period appropriate for security and debugging, then rotated or deleted unless isolated preservation is needed for an incident.

Analytics: governed by OpenPanel configuration and our minimisation choices; where feasible we prefer aggregated reporting over long retention of raw events.

If you ask us to delete marketing-Site personal data, we will comply unless a narrow exception applies (for example a legally compelled hold).

We implement reasonable administrative, technical, and organisational measures appropriate to the risk, including access controls, transport encryption where standard for web traffic, input validation on forms, and careful handling of API keys.

No method of storage or transmission is perfectly secure. You use the Site at your own risk to the extent permitted by law.

Depending on your location, you may have rights to access, rectify, erase, restrict, or port your personal data, and to object to certain processing. You may have the right to lodge a complaint with a supervisory authority.

To exercise rights, email team{'@'}blans.co from the address you used on the form when possible. We may need to verify identity before disclosing or changing records. We will respond within the timeframes required by applicable law (typically within one month for GDPR-style requests, subject to extensions for complex cases).

The Site is aimed at adults and professionals. We do not knowingly collect personal information from anyone under 16 (or the higher age required locally). If you believe we have collected a child’s data, contact us and we will delete it promptly where required.

We may update this policy when our practices or the law change. We will revise the “Last updated” date and post the new version on the Site. Material changes may be highlighted by an additional notice on the Site or by email where appropriate and lawful.

This policy is drafted for clarity and self-protection in good faith. It is not an exhaustive legal opinion for every jurisdiction. Translations from English are provided for convenience; if a translated term is ambiguous, the English commercial intent governs internal interpretation, without prejudice to mandatory consumer rights in your country.