Privacy

What we hold about you

Listed item by item, because a policy you can check against the product is worth more than one that reassures.

Effective 29 August 2026

WhatWhyWhereHow long
Email address, display nameTo sign you in and send account emailOur database (EU)Until you delete your account, then 90 days
Password, stored as an Argon2id hashTo check your password. We cannot read it backOur database (EU)As above
Google account id (sub claim), if you sign in with GoogleTo recognise the same Google account next time. Not your Google password, not your contactsOur database (EU)Until you unlink Google or delete the account
Session token (hashed), IP address, browser stringTo keep you signed in, to show you your active sessions, and to rate-limit sign-in attemptsOur database (EU)30 days, or until you sign out
Time of email verification, password changesTo gate account linking and to answer support questions honestlyOur database (EU)As above
Brand name, website, category, region, promptsThe audit itself — what you asked us to measureOur database (EU)Until the workspace is deleted, then 90 days
Every AI engine answer, verbatimThe evidence behind each figure in a report. Reports are reproducible from itObject storage (EU)As above
Extracted mentions, citations, aggregatesThe reportOur database (EU)As above
Transactional email delivery eventsTo know when a verification or reset email bouncedAWS SES, Frankfurt90 days
Bot-check signal on sign-in, sign-up and reset (IP, browser characteristics)To tell a person from a script before we do any workCloudflare TurnstileCloudflare's retention; we keep only pass or fail for the request
Server request logsTo find faults and abuseOur servers (EU)30 days
Who

Who is responsible

LLMBlaze is operated by Abhishek Kumar Sharma, a sole proprietor based in Greater Noida, Uttar Pradesh, India. For anything about your data, write to hello@llmblaze.com. That address reaches the person who runs the servers, not a queue.

Not collected

What we deliberately do not collect

  • No advertising or analytics trackers. The site sets one cookie, the session, and only after you sign in. Fonts are self-hosted, so no request leaves for a font network.
  • No payment card details. When billing exists it will run through a payment processor; card numbers never touch our servers.
  • No personal data in prompts. The questions we put to AI engines are category questions (“best e-signature tool for a small law firm”). They contain no names, emails or account details, and by design not even the brand being measured.
  • No data purchased from brokers, and none sold to anyone.
Processors

Who else touches the data, and for what

Hosting: our servers are rented from netcup (Nuremberg, Germany) and Hetzner (Germany / Finland). Database and object storage run on those machines, not on a third-party cloud. Email: Amazon Web Services SES, Frankfurt region, sends verification, reset and report-ready messages. It sees the recipient address and the message.

AI engines: to measure visibility we send prompts to Anthropic (Claude), Google (Gemini), Perplexity and, through licensed data providers, to the consumer surfaces of ChatGPT, Google AI Mode and Overviews, and Microsoft Copilot. They receive the prompt text described above and return an answer. They do not receive who you are. Their handling of prompts is governed by their own terms, which we link from the methodology page as each engine is enabled.

Extraction: stored answers are read by a language model (Anthropic) to identify brand mentions and citations. It is given the answer text only.

Bot check: the sign-in, sign-up and password-reset forms use Cloudflare Turnstile, which sees your IP address and browser characteristics to decide whether you are a person. It sets no tracking cookie and we receive only a pass or fail.

Agencies

If you are an agency, or an agency's client

An agency account holds workspaces for its clients. The agency decides what goes in them and who on its team can see them; we act on the agency’s instructions for that data. If you are a client of an agency and want to know what has been measured about your brand, ask the agency first — they hold the account — and write to us if that fails.

Retention

How long, and what deletion means

Your account and its workspaces exist until you delete them. After deletion they are held, unreachable, for 90 days so a mistaken deletion can be undone, then purged: database rows and the stored engine answers in object storage together, not just the rows. An entry recording that a deletion happened is kept without the content.

If you want the data gone now, say so in your request and we skip the 90 days. Backups roll over on their own schedule and are gone within a further 30 days.

Your rights

What you can ask for

You can ask to see what we hold about you, correct it, export it, or have it deleted, and we will do it within 30 days — usually much sooner. Write to hello@llmblaze.com from the address on the account, or from any address with enough detail for us to be sure it is you.

These are the rights under India’s Digital Personal Data Protection Act, 2023, and, where you are in the EU or UK, under the GDPR. We apply the same handling to everyone regardless of where they are; the law only changes which regulator you can also complain to.

Security

How it is protected

Passwords are hashed with Argon2id. Sessions are opaque tokens stored as hashes, so a copy of the database does not contain usable logins. Each customer’s data is separated by row-level security enforced inside the database, not only in application code, and the sign-in path runs under a database role that cannot reach measurement data at all. Servers accept SSH by key only, and only the web server is reachable from the internet. If we learn of a breach affecting you, we will tell you within 72 hours of confirming it.

Age

Not for children

The service is for businesses and the people who work in them. You must be 18 or over to hold an account.

Changes

When this page changes

We will change this page when the product changes what it collects — for example when billing is added. The effective date at the top moves, and if a change reduces your rights or widens what we collect, account holders get an email first. See also the terms of service.