Privacy Policy

Solvail Inc. ("Solvail", "we") is the data controller for BlitzHub by Solvail — our AI workspace of five tools for spreadsheets, presentations, documents, data insights, and diagrams — and for the solvail.com and blitzhub.app websites (together, the "Service").

Questions about this policy or your data? Email us at info@solvail.com.

We design BlitzHub to comply with privacy laws in the United States and Europe, including:

• The EU General Data Protection Regulation (GDPR) and the UK GDPR
• The Swiss Federal Act on Data Protection (FADP)
• The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), and similar US state privacy laws

Wherever you live, we apply the same baseline: minimal collection, no selling of personal data, and the rights described in section 10.

Account data. Your name, email address, password (stored only as a secure hash), and any preferences you save — including the optional "memory" notes you ask BlitzHub to keep about how you like your work done.

Content you create. The prompts you write and the files you upload or generate: workbooks, presentations, documents, reports, diagrams, and images. This is your content — see section 5 for how AI processing works.

Billing data. Your plan, credit balance, and payment history. Card payments are handled by Stripe; we never see or store your full card number.

Usage and technical data. Device and browser type, IP address, pages visited, feature usage, and error logs — used for security, capacity planning, and fixing bugs.

We do not collect more than we need, and we do not buy data about you from anyone.

• To run the Service: create your account, generate the artifacts you ask for, store your work, and meter your credits
• To process payments and send receipts
• To respond when you contact support
• To keep the Service secure: detect fraud, abuse, and attacks
• To improve the product, using aggregated or de-identified usage data
• To send service messages (security alerts, billing notices). Marketing email is sent only with your consent, and every message includes an unsubscribe link
• To meet legal obligations, such as tax and accounting rules

When you ask BlitzHub to create or edit something, we send your prompt — and, where needed, the relevant content — to our AI model providers (currently Anthropic for text and reasoning, and Google for image generation) to fulfil that request. Under our agreements with these providers, your content is not used to train their models.

We log AI interactions (prompts, responses, token counts, and cost) to operate the credit system and debug failures. Access to those logs is restricted to authorized personnel.

We never sell your personal data, and we do not share it with advertisers or data brokers. We share data only:

• With service providers who help us run BlitzHub — hosting and database infrastructure (DigitalOcean, Supabase), payments (Stripe), and AI model providers (section 5). Each operates under a data processing agreement and may use your data only to provide the service
• With authorities, when the law genuinely requires it
• As part of a merger or acquisition of Solvail — in which case this policy continues to apply to your data, and we will notify you
• With your consent, at your direction — for example, when you publish a community template

BlitzHub runs on infrastructure in the United States and the European Union. If you are in the EU, UK, or Switzerland, transfers of your data to the United States are protected by Standard Contractual Clauses approved by the European Commission, together with the security measures in section 9.

• Account data and your content: for as long as your account exists. Delete your account and we delete them, except where the law requires retention
• Billing records: as long as tax and accounting law requires (typically 7 years)
• Usage analytics: aggregated or anonymized after 12 months
• Server and error logs: deleted or anonymized within 90 days

• Encryption in transit: all traffic between your browser and our servers uses TLS
• Encryption at rest: user data is encrypted on our storage infrastructure using AES-256
• Row-level security: database policies ensure each user can access only their own data
• Access controls: administrative access to production systems is restricted to authorized personnel
• Payment isolation: card details are handled entirely by Stripe and never touch our servers
• Regular security review by the engineering team

No online service can promise absolute security, but if a breach affects your personal data we will notify you and the relevant authorities as the law requires.

Wherever you live, you can:

• Access the personal data we hold about you and get a copy
• Correct data that is wrong or incomplete
• Delete your account and your data
• Export your content (your workbooks, documents, and other artifacts are downloadable at any time)
• Object to or restrict certain processing, and withdraw consent where processing is based on consent
• Not be discriminated against for exercising any of these rights

To exercise any right, email info@solvail.com. We respond within 30 days.

EU, UK, and Switzerland. Our legal bases under the GDPR are: performing our contract with you (running the Service), our legitimate interests (security and product improvement), your consent (marketing, optional features), and legal obligations (tax records). You may also lodge a complaint with your local data protection authority.

California. We do not sell or share personal information as defined by the CCPA/CPRA, and we do not use sensitive personal information for purposes requiring a right to limit. The categories we collect are those in section 3; the recipients are those in section 6. You may exercise all CCPA/CPRA rights — know, access, correct, delete, and non-discrimination — via the contact above, including through an authorized agent.

We use only essential cookies: keeping you signed in, remembering your theme, and securing your session. We do not use advertising or cross-site tracking cookies, so there is no cookie banner to click through.

BlitzHub is not intended for children under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

If we make a material change, we will email you or show a notice in the app before it takes effect, and we will always update the date at the top of this page. Minor clarifications may be posted without notice.

Solvail Inc. · info@solvail.com

See also our Terms of Service.