Blend AI

GDPR overview

Implementation is partial and the wording is generic. The acronym GDPR appears nowhere in the pages reviewed; the text refers instead to "European data protection laws and regulations". A rights section for EEA and UK residents does list access, rectification, erasure, restriction, portability, objection, withdrawal of consent and the right to complain to a local supervisory authority. For transfers, the company invokes the European Commission's Standard Contractual Clauses, available on request, and claims Binding Corporate Rules recognised by EEA and UK authorities — but the sentence ends with an unfilled template placeholder where the link should be, which undermines the claim. Servers are stated to be in India. No data protection officer is named, no Article 27 EU representative is designated, no data processing agreement is offered and no subprocessor list is published.

Who owns the data?

The published documents are silent on this point, and the silence is itself the finding: neither the terms of service nor the privacy notice contains any clause on who owns the images you upload or the visuals the AI generates from them, and no content licence is granted or reserved anywhere in the two texts. What the privacy notice does cover is personal data — email addresses, phone numbers, names, social login details, device and location data — collected on the stated grounds of consent, legitimate interest, contract performance and legal obligation. Users may request access, correction or deletion of that personal data, and account deletion removes it from the active databases. All such requests go to a single address, privacy@blend.to.

Reuse rights

Nothing in the terms of service or the privacy notice restricts what you may do with the images you produce, and nothing grants you a licence either — the contract simply does not address reuse of generated visuals, so the commercial use that the whole product is sold for is neither authorised nor forbidden in writing. On the vendor side, personal data is used for account creation, order and payment handling, support, feedback requests, testimonials published with consent, prize draws, marketing emails and targeted advertising, and is shared with third-party vendors for payment processing, analytics, email delivery, hosting and customer service. RevenueCat and Stripe are named as payment processors. The notice states that information is not otherwise shared, sold, rented or traded for third-party promotional purposes, and it says nothing at all about using customer content to train AI models.

Data retention & training

Hosting summary

The privacy notice states plainly that the company's servers are located in India, and warns that users accessing the service from elsewhere should expect their information to be transferred to, stored in and processed at those facilities, as well as by third parties in India and other countries. For transfers originating in the EEA or the United Kingdom, the company says it relies on the European Commission's Standard Contractual Clauses, which it will provide on request, and claims Binding Corporate Rules recognised by EEA and UK authorities — although the link to those rules is an unfilled template placeholder. Similar safeguards are said to be in place with third-party providers, with details again available only on request. No hosting region in the broader sense is declared, no data centre operator is named, and no security certification such as SOC 2 or ISO 27001 is mentioned anywhere on the site. The domain resolves to an Amazon CloudFront edge node, which reflects content delivery rather than where data is stored.