Privacy policy

The controller within the meaning of the GDPR is:
FollowerX GmbH
Bei St. Annen 2, 20457 Hamburg, Germany
Managing directors: Robin Trepte, Lukas Tumpak
Email: [email protected]

reblogger.ai is a brand of twentyfirst media group, operated by FollowerX GmbH. For all privacy requests, please contact [email protected].

• Account data: name, email address, password hash (if you use a password), language, plan and credit balance.
• Login data: session tokens, login timestamps and, if you sign in with Google, your Google account ID, name and email.
• Billing data: company name, address and VAT ID (if provided), Stripe customer and subscription IDs, invoices. Card details are processed by Stripe only — we never see them.
• Content data: URLs and topics you submit, settings (language, tone, length, brand voice), generated articles and images, and your edits.
• Integration data: API keys (stored only as a hash), webhook endpoints, connected WordPress sites.
• Technical data: IP address (stored only as a hash for rate limiting and abuse prevention), browser and device type, request logs, timestamps.
• Usage data: first-party analytics events (e.g. page views, signups, generations) linked to a random anonymous ID or your account.

• Providing the service, your account and generations (Art. 6 (1)(b) GDPR — performance of contract).
• Payments, invoices and tax compliance (Art. 6 (1)(b) and (c) GDPR).
• Security, abuse and fraud prevention, rate limiting and the free preview limit (Art. 6 (1)(f) GDPR — legitimate interest in a secure, fairly usable service).
• Transactional emails such as sign-in links, receipts and important service notices (Art. 6 (1)(b) GDPR).
• First-party, privacy-friendly usage statistics to improve the product (Art. 6 (1)(f) GDPR).
• Google Analytics and Google Ads measurement — only with your consent (Art. 6 (1)(a) GDPR, § 25 (1) TDDDG).

Our website, application, database and file storage are hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centres in Germany. We have concluded a data processing agreement (Art. 28 GDPR) with Hetzner.

We may use Cloudflare, Inc. as a content delivery network, for DDoS protection and for object storage. Cloudflare processes connection data (e.g. IP address) to deliver and protect the site. Cloudflare is certified under the EU-U.S. Data Privacy Framework; standard contractual clauses also apply.

To write your articles, we send your input (topic or extracted source text, settings and instructions) to the AI provider of the model you choose. We do not send your name, email or billing data. Depending on the model, these providers are:

• Anthropic PBC (Claude), USA
• OpenAI, L.L.C. / OpenAI Ireland Ltd. (GPT and image models)
• Google LLC / Google Cloud EMEA Ltd. (Gemini, Vertex AI and image models)
• Mistral AI SAS, France
• Amazon Web Services EMEA SARL (Amazon Bedrock, region Frankfurt)
• Replicate, Inc., USA (selected image models)

Our providers process data on our behalf under data processing terms and do not use API data to train their models according to their API terms. Transfers to the USA are based on the EU-U.S. Data Privacy Framework where the provider is certified and/or on standard contractual clauses (Art. 46 GDPR).

EU data-residency mode (Pro and Agency plans): when enabled in your settings, AI requests are routed exclusively to endpoints located in the EU — for example Claude and Gemini via European cloud regions (Google Cloud, AWS Frankfurt) and Mistral. Models without an EU endpoint are unavailable in this mode.

Payments and subscriptions are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland. When you check out, Stripe processes your payment details, billing address and email. Stripe may transfer data to Stripe, Inc. in the USA (Data Privacy Framework, standard contractual clauses). Legal basis: Art. 6 (1)(b) and (c) GDPR. Stripe’s privacy policy: https://stripe.com/privacy

Transactional emails (sign-in links, email verification, password resets, welcome emails) are sent via Amazon Simple Email Service (Amazon SES), operated by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, in the AWS region Frankfurt (eu-central-1). Only the data needed for delivery is processed (email address, message content, delivery status). A data processing agreement is in place; any access from the USA is covered by the EU standard contractual clauses and the EU-US Data Privacy Framework.

If you choose “Continue with Google”, Google Ireland Ltd. authenticates you and shares your name, email address and profile picture with us. Legal basis: Art. 6 (1)(b) GDPR. You can also sign up with email instead.

To protect sign-up and the free preview against abuse, we use Cloudflare Turnstile. Turnstile checks browser signals to distinguish humans from bots without tracking you across sites. Legal basis: Art. 6 (1)(f) GDPR — our legitimate interest in preventing automated abuse.

With your consent we use Google Analytics 4 and Google Ads conversion tracking (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) to understand how our site is used and to measure the success of our ads. We use Google Consent Mode v2: until you consent, no analytics or advertising cookies are set and Google only receives cookieless signals in aggregate. IP addresses are not stored by Google Analytics in the EU. Data may be transferred to Google LLC in the USA (Data Privacy Framework).

Legal basis: your consent (Art. 6 (1)(a) GDPR, § 25 (1) TDDDG). You can withdraw it at any time with effect for the future by clearing your browser storage for reblogger.ai or contacting us; the banner will then ask you again.

Independently of this, we record privacy-friendly first-party events (page views, signups, generations) on our own servers in Germany, linked only to a random ID stored in your browser. These do not leave our infrastructure.

If you try the free preview on our home page, we store your input, the generated article and a hashed form of your IP address to enforce the daily limit. An httpOnly cookie (rb_trial) links the preview to your browser so you can keep the article after signing up. Unclaimed preview articles are deleted automatically after 7 days.

• Account, content and integration data: for as long as your account exists. When you delete your account, we delete this data within 30 days, except where we must keep it by law.
• Invoices and accounting records: 8–10 years as required by German commercial and tax law (§ 147 AO, § 257 HGB).
• API request logs: 90 days. Rate-limit entries: 2 days.
• Unclaimed free-preview articles: 7 days.
• First-party analytics events: up to 25 months, then aggregated or deleted.

You have the right to:

• access your data (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR) — you can export your data from your account settings,
• object to processing based on legitimate interests (Art. 21 GDPR),
• withdraw consent at any time with effect for the future (Art. 7 (3) GDPR).

To exercise your rights, email [email protected]. You also have the right to lodge a complaint with a supervisory authority, for example the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI), Ludwig-Erhard-Str. 22, 20459 Hamburg.

All connections are encrypted with TLS. Passwords and API keys are stored only as hashes, access to production systems is restricted, and we keep regular backups. No method of transmission over the internet is 100% secure, but we work hard to protect your data.

We update this policy when our service or the law changes. The current version is always available on this page; we will notify registered users by email of material changes.