Last Updated: October 8, 2026
Introduction
Blabla.ai, located at 11 rue Chaptal, 92300 Levallois-Perret, France, is strongly committed to protecting your privacy and adhering to the highest standards of confidentiality and data security. This document outlines our practices for collecting, using, storing, and sharing personal data as part of our service, accessible via https://www.blabla.ai.
Our Role as Controller and Processor
Blabla is the controller of the personal data of its users described in this policy (account, billing, support and usage data).
When our customers use Blabla to manage their social accounts, Blabla also processes, on their behalf, the comments, messages and public profile information of the people who interact with those accounts. For that data, the customer is the controller and Blabla acts as its processor under the data processing agreement in Section 15 of our Terms of Service. If you have interacted with one of our customers’ accounts, please contact that customer to exercise your rights; if you contact us, we will forward your request to them.
1. Data Collected
Registration Data: Information you provide to create an account, such as your name, email address, and social media credentials.
Connected Social Media Data: When you connect your accounts (YouTube, Instagram, Facebook, TikTok, etc.), we collect limited data necessary to provide the Service, such as comments, posts, engagement metrics, and performance analytics.
Automatically Collected Data: Technical information such as IP addresses, browser types, and usage statistics via cookies, used to improve our services.
2. Use of Data
We use your data solely to provide and improve our service. This includes:
Analyzing the performance of your social accounts to deliver personalized recommendations and engagement features.
Managing responses to comments and messages on social media.
Enhancing the user experience through analytics tools.
3. Google Data and YouTube API Services
Use of YouTube Data: When you connect your YouTube account, limited data (e.g., comments, video metadata, engagement metrics, and performance analytics) is used exclusively to provide and improve our service features.
Reference to Google’s Privacy Policy: Data obtained through the YouTube API is governed by Google’s Privacy Policy, available at https://policies.google.com/privacy.
Revoking Access: You may view, manage, or revoke your permissions for the YouTube API at any time by visiting https://myaccount.google.com/connections?filters=3,4&hl=en or via our integrated revocation feature.
Blabla uses YouTube API Services when you connect a YouTube account. We access and process YouTube data only to provide the features of the Service (e.g., displaying and managing YouTube comments, helping you respond, and providing account performance insights inside Blabla).
Data we may access/collect/store/use (depending on the features you enable):
Account/Channel information (e.g., channel name, channel ID)
Video metadata (e.g., video ID, title, publish date)
Comments and related metadata (e.g., comment text, author/channel name, timestamps, moderation status)
Engagement/Performance data made available via the YouTube API (e.g., counts/metrics returned by the API)
Technical data required to keep the connection active (e.g., OAuth access tokens / refresh tokens)
How we use it:
To display your YouTube content and comments in the Blabla dashboard
To help you manage and respond to comments
To compute and show dashboards/analytics inside Blabla (only using data returned by the API and only for the time needed to provide the feature)
Sharing:
We do not sell YouTube data. We only share data with service providers acting as processors (e.g., hosting, monitoring, customer support) under contractual confidentiality and security obligations, and only as necessary to operate the Service.
Google Privacy Policy:
Use of YouTube API data is subject to Google’s Privacy Policy.
Reference to Google’s Privacy Policy: Data obtained through the YouTube API is governed by Google’s Privacy Policy, available at:
Revoking access:
You can revoke Blabla’s access to your Google/YouTube account at any time from your Google Account security settings page (Third-party access), and/or by disconnecting YouTube from within Blabla (if available): https://myaccount.google.com/connections?filters=3,4&hl=en
To request deletion of YouTube data specifically, contact [email protected] from the email address associated with your Blabla account and specify the connected YouTube channel.
4. Data Sharing
Your personal data is never shared with third parties, except when strictly necessary to provide the Service. For example:
Service providers under strict contractual obligations (hosting, technical support).
Compliance with legal or regulatory obligations, when applicable.
No data is ever transferred to third parties for commercial or marketing purposes.
Sub-processors and Data Location
Your data is stored in the European Union. We use the following sub-processors to provide the Service:
Heroku (Salesforce): application hosting, queues and cache — EU (Ireland)
MongoDB Atlas: database — EU (Ireland)
Amazon Web Services: media file storage — EU (France)
Pinecone: knowledge-base search index — EU (Ireland)
OpenAI: AI classification, moderation and reply generation — United States
Nango: social media access tokens and calls to the platforms’ APIs — United States
Apify: retrieval of public video media for analysis — United States
Auth0 (Okta): user authentication — EU
Vercel: web application hosting — United States
Sentry: error monitoring — United States
Better Stack: application logs — EU (Germany) and United States
Customer.io: service emails — EU
Intercom: customer support — United States
Mixpanel: product analytics — United States
Stripe: payments and billing — EU and United States
Transfers outside the European Economic Area rely on an adequacy decision (including the EU-U.S. Data Privacy Framework) or on the European Commission’s Standard Contractual Clauses. We inform our customers by email at least 30 days before adding or replacing a sub-processor.
5. Data Security
We implement rigorous technical and organizational measures to protect your data from unauthorized access, loss, or misuse. While we make every effort to ensure security, no system is entirely invulnerable.
Our measures include:
All data is encrypted in transit (TLS), and our database and file storage are encrypted at rest.
Social media access tokens are managed by a dedicated credentials service that stores them encrypted.
Customer data is separated by workspace, and every request is checked against the user’s workspace membership and role.
Access to production systems is limited to a small number of authorised people bound by confidentiality.
Our infrastructure providers (AWS, MongoDB Atlas, Heroku) hold ISO 27001 and SOC 2 Type II certifications.
Our AI provider does not use the data sent through its API to train its models.
We notify affected customers of any personal data breach without undue delay, and where feasible within 48 hours.
6. Data Retention
Collected data is retained only for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law. Users may request the deletion of their data at any time by contacting us.
Cookies and Similar Technologies
We (and our service providers) may store or access information on your device (for example through cookies, SDKs, local storage, or similar technologies) to:
keep you logged in and secure your session
remember preferences
measure usage and improve the Service (analytics)
You can control cookies through your browser settings and, where applicable, through our cookie preferences tools.
7. Your Rights
You have the right to:
Access your personal data.
Request its correction or deletion.
Object to its processing, within applicable legal limits.
To exercise these rights, please contact us at [email protected].
Data Deletion
You may request deletion of your personal data by contacting us at [email protected].
If you disconnect a connected social account (including YouTube), we will stop new data collection for that account. We will delete stored data associated with that connection within 30 days, unless we must retain certain records for legal, security, or fraud-prevention purposes.
8. Children’s Data
Our services are not intended for individuals under the age of 16. We do not knowingly collect their data.
9. Changes to This Policy
We reserve the right to modify this privacy policy to reflect changes in our practices or regulatory requirements. You will be notified in the event of any significant updates.
10. Contact
For any questions regarding this policy or your personal data, please contact us at [email protected].
