Legal

Privacy policy

Q: Who is the data controller?

Arne Kellmann, Odenwaldstr. 134L, 64372 Ober-Ramstadt, Germany, is the controller (Art. 4(7) GDPR) responsible for data processing on this site.

Q: What data does Blockquote process?

Blockquote fetches a submitted public URL, scores the page 0–100 across 34 checks (29 deterministic, 5 via a language model), and stores the URL, the report, and a temporary HTML snapshot. Scanning works without an account; with an account the service additionally stores the email address, a session identifier, the plan, the email notification preferences, and monitored URLs.

Q: Which categories of data does Blockquote store?

Submitted URLs, scan reports and scores, temporary HTML snapshots, account email address, login tokens, unsubscribe tokens and session identifiers, email notification preferences, monitored URLs with score history, subscription state, IP-based rate-limit counters, Cloudflare platform logs, and — only with consent — analytics usage data, and AI answer tracking consent: the time it was given, the engines named, and the IP address it was given from. Card numbers are never sent to or stored by Blockquote.

Q: What are the purposes and legal bases for processing?

Art. 6(1) lit. b GDPR for service delivery and billing, Art. 6(1) lit. f GDPR for security and abuse prevention, Art. 6(1) lit. c GDPR for statutory retention, and Art. 6(1) lit. a GDPR (consent) for web analytics and AI answer tracking — each is asked for separately, and each can be withdrawn separately.

Q: How long does Blockquote retain data?

HTML snapshots are deleted after 7 days; rate-limit counters expire after at most 24 hours; login tokens expire after 15 minutes; sessions after 30 days; the single-use unsubscribe token in an email footer has no expiry, so an email opened weeks later can still turn that email off; billing records are kept as long as commercial and tax law requires; a tracking consent record is kept as long as the monitored URL exists, and is deleted when you withdraw it or delete the URL.

Q: Which processors does Blockquote use?

Cloudflare (hosting, storage, Workers AI), Stripe (payments, partly as independent controller), Resend (transactional email, EU region delivery), and — only with consent — Google Ireland Limited for analytics, and Perplexity, OpenAI or OpenRouter for AI answer tracking of a monitored URL you have allowed.

Q: How does web analytics (Google Analytics 4) work?

Google Analytics 4 is strictly opt-in: no script loads and no analytics cookies are set until 'Allow analytics' is chosen in the consent banner. Ad signals are permanently denied, IP addresses are not logged or stored by GA4, the decision is stored locally under the key bq-consent, and event-level data expires after at most 14 months. Consent can be withdrawn any time via 'Cookie settings' in the footer.

Q: Is data transferred outside the EU?

Cloudflare and Stripe may process data outside the EU under the EU standard contractual clauses; with analytics consent, Google may transfer usage data to Google LLC in the United States under the SCCs and the EU–US Data Privacy Framework; if you allow AI answer tracking for a monitored URL, the query for that page is transferred to the engine you named in the United States, covered by the EU standard contractual clauses in that provider's data processing agreement.

Q: What rights do you have under the GDPR?

Access, rectification, erasure, restriction, objection and data portability where applicable; withdrawal of consent with effect for the future (Art. 7(3) GDPR) — via 'Cookie settings' in the footer for analytics, and under 'Monitored URLs' in your account for AI answer tracking; and complaint to a supervisory authority — for the controller's seat in Hesse, the HBDI.

This privacy policy is the authoritative description of what Blockquote processes when a public URL is submitted for analysis, when you sign in, when you pay, and — only if you opt in — for web analytics, and how Blockquote handles the collected data operationally.

TL;DR: Blockquote stores only what the scan service needs:

Scanning needs no account; Blockquote stores the submitted URL, the generated report (34 checks, scored 0–100), and one temporary HTML snapshot of at most 3 MB.
HTML snapshots are deleted after 7 days; rate-limit counters expire after at most 24 hours.
Login tokens expire after 15 minutes; sessions after 30 days.
Payment details are entered directly on Stripe's hosted checkout — card numbers never reach Blockquote.
Google Analytics 4 runs only after opt-in consent (Art. 6(1) lit. a GDPR), and consent can be withdrawn at any time.

Who is the data controller?

Arne Kellmann is the controller (Art. 4(7) GDPR) responsible for data processing on this site:

Arne Kellmann
Odenwaldstr. 134L
64372 Ober-Ramstadt
Germany

Email: hello@arnekellmann.de

What data does Blockquote process?

Blockquote accepts a public URL, fetches the referenced page, analyzes its content for schema, structure and citation-readiness signals, and returns a report. The report scores the page 0–100 across 34 checks — 29 checks run deterministically on the fetched HTML, and 5 checks send page text to a language model. The service stores the submitted URL, the generated report, and a temporary HTML snapshot needed for the diagnostic workflow. Scanning works without an account.

With an account, the service additionally stores your email address, a session identifier, your plan, your email notification preferences, and any URLs you put under weekly monitoring. Blockquote processes only data about the scanned public page and the data listed in the categories below; the service has no advertising trackers and no third-party embeds.

Which categories of data does Blockquote store?

Submitted URLs
Generated scan reports and scores
Temporary raw HTML snapshots of scanned public pages
Account email address, login tokens, unsubscribe tokens and session identifiers
Email notification preferences: which kinds of email you have turned on
Monitored URLs and their score history
Subscription state: plan, status, renewal date, Stripe customer identifier
Technical request metadata such as IP-based rate-limit counters
Standard server and platform logs provided by Cloudflare
Analytics usage data (pages viewed, device and browser information, approximate region) — collected only if you consent, see the analytics section below
AI answer tracking consent: the time it was given, the engines named, and the IP address it was given from — only for monitored URLs you allowed

Card numbers are never sent to or stored by Blockquote. Payment details are entered directly on Stripe's hosted checkout.

What are the purposes and legal bases for processing?

Processing is performed to deliver the requested service, to run the contractual relationship for paid plans, to protect the service against abuse, and to maintain technical operations. The legal basis is generally Art. 6(1) lit. b GDPR for service delivery and billing, Art. 6(1) lit. f GDPR for security, reliability and abuse prevention, and Art. 6(1) lit. c GDPR where tax or commercial law requires retention of invoices. Web analytics and AI answer tracking are each based solely on your consent, Art. 6(1) lit. a GDPR — each is asked for separately, and each can be withdrawn separately. The full text of the GDPR (Regulation (EU) 2016/679) is published at EUR-Lex.

How long does Blockquote retain data?

Scan results, accounts, sessions and monitors are stored in Cloudflare D1. Temporary HTML snapshots are stored in Cloudflare R2 and deleted after a retention window of 7 days. Rate-limit counters are stored in Cloudflare KV and expire after at most 24 hours. Login tokens expire after 15 minutes; sessions after 30 days. The single-use token in an email footer that turns notifications off carries no expiry, so an email opened weeks later can still turn that email off. Billing records are kept for as long as commercial and tax law requires. A tracking consent record is kept as long as the monitored URL exists, and is deleted when you withdraw it or delete the URL. Data is deleted earlier where the data is no longer needed for operations.

Which processors does Blockquote use?

What does Cloudflare process?

The application runs as six Cloudflare Workers and uses associated Cloudflare services: D1, KV, R2, Queues, Durable Objects and observability tooling. Page text is also processed by Cloudflare's AI runtime (Workers AI) for the 5 language-model checks in the report. Cloudflare describes its handling of personal data in the Cloudflare privacy policy.

What does Stripe process?

Payments, subscriptions and refunds are handled by Stripe. When you start a checkout, Stripe receives your email address and an internal account identifier, and collects payment details directly from you. Stripe acts as an independent controller for parts of that processing under the Stripe privacy policy.

What does Resend process?

Transactional email — sign-in links and the weekly monitoring digest — is sent through Resend, with delivery in the EU region. Resend receives the recipient address and the message content; Resend's handling of personal data is described in the Resend privacy policy.

What do the AI answer engines process?

Blockquote can check whether an AI answer engine cites a page you monitor. This runs only for a monitored URL you have explicitly allowed, engine by engine, in your account. The engines are Perplexity AI, Inc., OpenAI, L.L.C. and OpenRouter, Inc., all in the United States.

What an engine receives is one short search query, built from the page title — or from the host name when the report has no title. The page text is not sent. The comparison between the engine's answer and your URL is made inside Blockquote.

Your decision is stored with the monitored URL: the time you gave it, the engines you named, and the IP address you gave it from. That record is the proof of consent required by Art. 7(1) GDPR. You can withdraw it at any time under "Monitored URLs" in your account; withdrawal stops the next run, and clears the record.

What does Google process?

If — and only if — you consent, Google Ireland Limited processes web analytics data on our behalf as a processor. Details, including what Google receives and how to withdraw, are in the analytics section below.

No advertising trackers and no third-party embeds are used. The only cookie set without your consent is the session cookie after you sign in; the session cookie is strictly necessary for the sign-in function. Web analytics runs only after you opt in — see the next section.

What does the scan field remember?

The URL field on the home page suggests URLs you scanned before. Those URLs are written to your browser's local storage (key bq-recent-urls, at most eight entries) purely so the field can complete them; they are never transmitted and are not readable by us. "Clear" in the suggestion list, or clearing your browser's site data, removes them.

How does web analytics (Google Analytics 4) work?

With your consent, this site uses Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), to understand which pages are used and how the service can be improved. The legal basis is your consent, Art. 6(1) lit. a GDPR. Google's own handling of data is described in the Google privacy policy.

Analytics is strictly opt-in: the measurement script is not loaded and no analytics cookies are set until you choose "Allow analytics" in the consent banner. Google Consent Mode is configured with advertising signals permanently denied; ads personalization is disabled. Your decision itself is stored in your browser's local storage (key bq-consent) and is not transmitted anywhere.

If you consent, Google processes usage data (pages viewed, approximate region, device and browser information, interaction events) on our behalf. IP addresses are not logged or stored by Google Analytics 4. Data may be transferred to Google LLC in the United States; those transfers are covered by the EU standard contractual clauses and Google's EU–US Data Privacy Framework certification.

You can withdraw your consent at any time via "Cookie settings" in the footer — analytics stops immediately and stays off on future visits. Analytics data is retained in aggregate reporting; event-level data expires after at most 14 months.

Is data transferred outside the EU?

Cloudflare and Stripe are US-based providers and may process data outside the EU. Those transfers are covered by the EU standard contractual clauses in the respective data processing agreements. If you consent to analytics, Google may transfer usage data to Google LLC in the United States, covered by the EU standard contractual clauses and Google's certification under the EU–US Data Privacy Framework. If you allow AI answer tracking for a monitored URL, the query for that page is transferred to the engine you named in the United States, covered by the EU standard contractual clauses in that provider's data processing agreement.

What rights do you have under the GDPR?

You have the rights of access, rectification, erasure, restriction, objection and data portability (Art. 15–21 GDPR) where applicable. Where processing is based on your consent — web analytics and AI answer tracking — you can withdraw that consent at any time with effect for the future (Art. 7(3) GDPR), via "Cookie settings" in the footer for analytics, and under "Monitored URLs" in your account for AI answer tracking. You also have the right to lodge a complaint with a supervisory authority; the authority competent for the controller's seat in Hesse is the Hessian Commissioner for Data Protection and Freedom of Information (HBDI). To delete your account and its data, write to the address above.