Privacy notice
Last updated: September 15, 2026
This notice explains what personal data blogspace processes when you visit blogspace.me, write to us or create a publication: why we process it, how long we keep it, who processes it for us and what your rights are. It is given under Brazil's General Data Protection Law (LGPD, art. 9) and the EU General Data Protection Regulation (GDPR, art. 13).
Who is responsible
The controller of your personal data is blogspace.
Write to us at [email protected] about anything in this notice.
What we process, why and for how long
Server logs
- Data
- Your IP address and your browser's user agent, where they appear in our servers' logs — for example when repeated sign-in or signup attempts from one address are refused. Our web server keeps no log of ordinary page visits.
- Purpose and legal basis
- Keeping the service secure and protecting it from abuse, under our legitimate interest (LGPD art. 7 IX; GDPR art. 6(1)(f)).
- Retention
- No fixed period. Once these logs reach a size limit, the oldest are deleted first, and all of them are deleted when the server software that wrote them is updated or reconfigured.
Messages you send us
- Data
- Your email address, your name if you give it, and what you write when you send a message to our contact address.
- Purpose and legal basis
- Answering you, under our legitimate interest (LGPD art. 7 IX; GDPR art. 6(1)(f)), or, when you write about your account, providing the service you signed up for (LGPD art. 7 V; GDPR art. 6(1)(b)).
- Retention
- For as long as it takes to answer you and deal with any follow-up. Cloudflare, which forwards the message to us, keeps a record of its delivery for a period it sets itself.
Your account and publication
- Data
- The email address and password you sign up with — the password is stored only in a form that cannot be read back — your publication's name, address, language and time zone, and everything you publish or upload to it.
- Purpose and legal basis
- Providing the service you signed up for (LGPD art. 7 V; GDPR art. 6(1)(b)).
- Retention
- For as long as your publication is active. If it stops being active, it is kept for 12 months if you ever paid for a plan, or for 30 days after a free trial; it is then archived for 30 days (7 days after a free trial) and deleted for good. If you ask for it to be deleted, that happens after a cooling-off period of 7 days, in which you can change your mind. Data in our database backups is deleted within 30 days after that.
Payments
- Data
- When you choose a paid plan, you enter your card details, billing address and any tax number on Stripe's own pages, and Stripe holds them. We never see or store your card. We keep only Stripe's identifiers for your customer record and subscription, and your plan and billing status.
- Purpose and legal basis
- Charging for the plan you chose (LGPD art. 7 V; GDPR art. 6(1)(b)) and keeping the accounting and tax records the law requires (LGPD art. 7 II; GDPR art. 6(1)(c)).
- Retention
- Our billing records are kept with your account, as above. Stripe keeps payment data for as long as financial and tax law requires it to.
Who processes data for us
These providers process personal data on our behalf, only to run the service:
- Oracle Cloud, which hosts the service and its database in São Paulo, Brazil.
- Oracle Email Delivery, which sends account emails such as invitations and password resets.
- Cloudflare, for DNS, for storing the photos and files you upload, and for forwarding messages sent to our contact address.
- Stripe, for payments.
Cloudflare and Stripe operate worldwide, including in the United States, so using them involves transferring personal data outside Brazil and outside the European Economic Area, under the safeguards those providers offer for such transfers, such as standard contractual clauses.
Your rights
Under the LGPD (art. 18) you may ask us to confirm whether we process your data; to give you access to it; to correct it; to anonymise, block or delete data that is unnecessary, excessive or processed unlawfully; to port it to another provider; and to tell you whom we share it with.
Under the GDPR (arts. 15–22) you may ask us for access to your data, to correct it, to erase it, to restrict its processing and to receive it in a portable format, and you may object to processing based on our legitimate interest. We make no decisions about you by automated means alone.
To exercise any of these rights, write to [email protected].
The owner of a publication can also export all of its posts and media from the publication's admin, on any plan and without asking us.
Complaints
If you believe we process your data unlawfully, you have the right to complain to Brazil's National Data Protection Authority (ANPD) or, in the European Economic Area, to the data protection supervisory authority where you live or work, or where the infringement took place.
Cookies and analytics
blogspace.me sets no cookies and uses no analytics, tracking or advertising. The signup form and your publication's admin use only the cookies strictly necessary to protect their forms and keep you signed in.
Your browser may keep two values in its local storage, each only when you choose it, and neither is ever sent to us: blogspace-locale, the interface language you picked, and blogspace-theme, the light or dark theme you picked.