Legal document
Privacy Policy
How Blueprint Maker collects, uses and protects your personal data.
Last updated: 5 August 2026
Data controller
The data controller is BEAM Consulting, a single-member SARL registered with the Paris Trade and Companies Register under number 930 217 609, whose registered office is at 60 rue François Ier, 75008 Paris. For any question about your data: privacy@blueprint-maker.com.
No data protection officer (DPO) has been appointed to date; your requests are handled at the address above.
Data collected
We collect the following categories of data:
- Account data: name, e-mail address and identifier provided by your identity provider (Google, GitHub) at sign-in.
- User Content: descriptions, prompts, data and files you provide, as well as generated applications and their specifications.
- Billing data: processed by our payment provider (Stripe); we do not store your card details.
- Usage and technical data: connection logs, IP address, usage events, generation metrics.
- Cookies and trackers: see the dedicated section.
Purposes of processing
Your data is processed to:
- provide the Service: generate, deploy, export and host applications;
- manage your account, authentication and support;
- handle billing and subscription management;
- ensure security and prevent fraud and abuse;
- improve the Service. In particular, on the free plan, generated applications, their specifications and the associated generation data may be used to analyse, train and refine the generation engines and the products of the Blueprint ecosystem (notably Blueprint Mind and Blueprint Mirror). On paid plans, this improvement processing does not take place unless you separately agree to it;
- comply with our legal obligations and, with your consent, send you communications.
Legal bases
Depending on the purpose, processing is based on:
- performance of the contract (providing the Service, account management, billing);
- our legitimate interest (security, abuse prevention, improving the Service);
- your consent (non-essential cookies, marketing communications);
- compliance with a legal obligation (accounting, retention).
The improvement use of applications generated on the free plan (analysis, training of the engines, Blueprint Mind and Mirror products) is based on performance of the contract: the free provision of the Service is granted in consideration of that use, transparently disclosed to you. You may object to it by switching to a paid plan, on which this use does not take place.
Data recipients
We use processors acting on our instructions:
- AI model providers for generation: Anthropic, OpenAI, xAI and Google. Your descriptions are transmitted to them to produce the specification and code.
- Payment providers: Stripe (and, where applicable, an alternative payment provider such as LemonSqueezy).
- Authentication providers: Google and GitHub.
- Hosting provider: OVH (see “Hosting and transfers”).
- Transactional email and notifications delivery: Resend (United States).
- Internal operational technical alerts: Telegram.
- Colour-palette generation, on request: Colormind.
- Analytics and advertising: Google Ireland Limited and Google LLC (Google Analytics 4, Google Ads), only after your consent.
We do not sell your personal data. It may be disclosed to authorities where required by law.
Hosting and transfers
The Service is hosted with OVH, in France (European Union).
Some processors: notably the AI model providers (Anthropic, OpenAI, xAI, Google): may process data outside the European Union, in particular in the United States. Such transfers are framed by appropriate safeguards, primarily the European Commission standard contractual clauses, supplemented where applicable by an applicable adequacy decision.
Retention periods
We keep your data for as long as necessary for the purposes pursued:
- account data: for the duration of the relationship, then up to 3 years after the last activity;
- billing data: kept for the statutory period (10 years for accounting records under French law);
- user content and generated applications: until the account is deleted, then purged within 30 days (except data already anonymised);
- technical logs: 12 months.
Your rights (GDPR)
You have the rights of access, rectification, erasure, restriction, portability and objection, as well as the right to withdraw your consent at any time and to set directives regarding your data after your death.
To exercise these rights: privacy@blueprint-maker.com. You may also lodge a complaint with the French supervisory authority, the CNIL (www.cnil.fr).
Security
We implement reasonable technical and organisational measures to protect your data: encryption in transit (HTTPS), access controls, secure hosting.
As no system is entirely infallible, we cannot guarantee absolute security. In the event of a data breach likely to result in a high risk to your rights, you will be informed in accordance with the regulations.
Contact and complaints
For any question about this policy or your data: privacy@blueprint-maker.com.
Competent supervisory authority: the French Data Protection Authority (CNIL), 3 place de Fontenoy, 75007 Paris, www.cnil.fr.