Privacy Policy | How BlitzAPI Handles Personal Data

1. Who We Are

This Privacy Policy explains how BlitzAPI processes personal data in connection with its website and Services.

Company: BlitzAPI, a Société par Actions Simplifiée (SAS) registered in France
SIREN: 101 473 775
Registered address: 1 rue Marguerin, 75014 Paris, France
Privacy contact: antoine@blitz-api.ai

BlitzAPI acts as:

Data controller for website usage, account creation, billing, support, analytics, and for the professional B2B data we compile and make available through the Services;
Data processor when we process data that you submit to us strictly on your instructions and for your purposes (for example, a list of professional email addresses you upload for validation).

2. Scope of This Policy

This Policy applies to: the BlitzAPI website (blitz-api.ai); all BlitzAPI API endpoints (Search, Enrichment, Validation); customer accounts, billing, logs and API-usage data; and support and customer-success interactions.

It does not apply to: data you process outside BlitzAPI; or your CRM or third-party platforms connected to BlitzAPI.

3. B2B Only

BlitzAPI processes B2B professional data only. We do not process B2C data, personal (non-professional) email addresses, or consumer profiles.

4. Data We Process

4.1 Website & account data

Identifiers (IP address, browser, device)
Aggregated, cookieless website usage data (Vercel Web Analytics), where enabled
Audience measurement data (pages viewed, interactions such as clicks on our calls to action, sign-up and purchase events), processed with Google Analytics 4 and collected through a first-party server hosted for us by Stape (EU hosting). Interaction and identifier data are only linked to you with your consent (see Section 14); purchases are otherwise counted in aggregate, without any identifier
Pseudonymous identifiers used for that measurement: a random client identifier stored in a cookie, and your internal user identifier once you are signed in and have accepted analytics cookies
Advertising measurement data for Google Ads, LinkedIn and Reddit: the click identifier carried from an ad you clicked, and a hashed version of your email address when you create an account or make a purchase, sent from our own server and only with your consent for each platform (see Section 14.4). For Google Ads, page views and clicks on our calls to action may also be reported with the click identifier only; for Reddit, page views carry only the click identifier and the address of the page. Neither carries your email
When you decline analytics and advertising cookies, Google receives only cookieless pings (such as IP address, user agent, page URL, referrer, screen size and consent state), used for aggregate modelling and not to identify you
Contact-form entries (name, work email, company, topic, message), routed to our self-hosted form-processing tool to answer your request
Account information (email, password hash, billing information)

4.2 Professional B2B data made available through the Services

When you call our endpoints, we make available professional B2B data such as: professional email addresses; professional phone numbers; professional / LinkedIn URLs; job titles; and company information (domain name, company page, sector, size, location). We compile this data from publicly available and third-party professional sources, for legitimate B2B purposes.

4.3 Technical logs

Timestamp
IP address
Endpoint used
Error logs

Technical logs are stored for 30 days for security and operational integrity.

5. Data We Do NOT Process

BlitzAPI explicitly does not accept, process or store:

Personal / consumer data
Personal email addresses (Gmail, Yahoo, Proton, etc.)
Special categories of data (health, religion, political opinions, etc.)
Private or non-public information
Any data collected in violation of a third party’s terms of service

If such data is submitted by mistake, it is automatically rejected or deleted.

6. How We Use Data: Legal Bases

Performance of a contract: executing API calls; returning search, enrichment or validation results; managing accounts and billing; securing the Services.
Legitimate interests (B2B): improving API performance; preventing abuse and fraud; providing support and customer success; internal analytics and service optimisation. For the processing of professional B2B data, we rely on our legitimate interest in providing B2B business-information services and conduct a balancing test to ensure this interest does not override the rights and freedoms of data subjects.
Consent: optional marketing communications; analytics and advertising cookies and the related processing (audience measurement with Google Analytics 4; advertising measurement with Google Ads, LinkedIn and Reddit), collected through our consent banner and withdrawable at any time (see Section 14). Consent is given separately for each advertising platform: accepting one does not enable another. The fact that our own server sends this data does not remove the need for your consent. Aggregated, cookieless website measurement (Vercel Web Analytics) relies on our legitimate interest.

We do not resell data, datasets or enrichments, and we do not allow customers to do so (see our Terms & Conditions).
We do not use customer-provided data to enrich our own database.
We do not sell customer data to third parties.
During API operations, we do not transmit personal data to third-party services; all API operations are processed on BlitzAPI-controlled servers.

8. Data Subjects in Our B2B Data: Your Rights & Opt-Out

If your professional information is included in the data we make available, you have the right to object to our processing and to request access, rectification or deletion at any time.

We rely on legitimate interest for B2B prospecting data, and we honour objections.
On a valid request, we add your information to a suppression list so that it is not returned again through the Services.
To ask us to stop selling or sharing personal information associated with you, use our Do Not Sell or Share My Personal Information form. You only need to provide one identifier (email address, LinkedIn profile URL or phone number), with no account and no verification step; we use it solely to find the relevant profile and process your request, and we give you a request ID as a record. The same link is in the footer of every page of the website.
To exercise these rights in any other way, or to opt out by email, contact us at antoine@blitz-api.ai. If you are acting on behalf of someone else (for example as an authorised agent), write to the same address.

9. Subprocessors & Third Parties

We use a limited set of subprocessors to operate the website, billing, analytics and consent management. We do not share personal data with third parties during API operations. The current categories are:

Provider	Purpose	Location
Hetzner	Hosting & encrypted storage	EU (Germany)
Vercel	Website hosting; aggregated, cookieless website analytics where enabled	EU / US (SCCs)
Hostinger	Hosting of our self-hosted contact-form processing tool (n8n)	EU
Stripe	Payment processing	EU / US (SCCs)
AWS	Certain infrastructure services	EU / US (SCCs)
Google (Google Analytics 4, Google Ads)	Audience and advertising measurement, only with your consent	EU / US (SCCs)
Stape	First-party collection server (server-side tag management)	EU (Belgium)
Axeptio	Consent management platform and proof of consent	EU (France)

We may update this list as our providers evolve; material changes will be reflected in this Policy.

9.1 Advertising platforms acting as independent controllers

The platforms below receive conversion data from our own server, only with your consent for their service (see Section 14.4). They are not subprocessors: each of them decides for itself how it uses the data it receives, under its own privacy policy, and is an independent controller of that data.

Platform	Contracting entity	Purpose	Data received	Transfer basis	Their policy and settings
LinkedIn	LinkedIn Ireland Unlimited Company (Ireland)	Measurement and optimisation of our LinkedIn advertising	Click identifier from a LinkedIn ad, hashed email address, event type (sign-up or purchase), time, and for a purchase the amount and currency. Never your IP address or browser details	Standard Contractual Clauses, Module 1 (controller to controller), incorporated in the LinkedIn Independent Controller Addendum to its advertising terms (see Section 10)	LinkedIn Privacy Policy; the advertising settings of your LinkedIn account
Reddit	Reddit Netherlands B.V. (Netherlands); the data is received in the United States by Reddit, Inc.	Measurement and optimisation of our Reddit advertising	Click identifier from a Reddit ad; for sign-ups and purchases, hashed email address, event type, time, and for a purchase the amount and currency; for page views, the click identifier and the page address only. Never your IP address or browser details	EU-U.S. Data Privacy Framework, as declared by Reddit, Inc., and, as a fallback, Standard Contractual Clauses, Module 1 (see Section 10)	Reddit Privacy Policy; the privacy and advertising settings of your Reddit account

Apart from Google Ads (see the table at the start of Section 9), LinkedIn and Reddit, we do not send data to any advertising platform. Any new platform will be added to this Policy and offered as a separate choice in our consent banner before we send it anything.

10. International Transfers

Our core infrastructure operates within the European Union. Some subprocessors (e.g., Stripe, AWS, Google) may involve transfers to the United States under Standard Contractual Clauses (SCCs) and appropriate safeguards under the GDPR.

The advertising platforms listed in Section 9 as independent controllers may also process the data they receive in the United States:

LinkedIn: under the Standard Contractual Clauses, Module 1 (controller to controller), incorporated in the LinkedIn Independent Controller Addendum to its advertising terms. LinkedIn Corporation also declares a certification under the EU-U.S. Data Privacy Framework.
Reddit: Reddit, Inc. declares a certification under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework and, as a fallback, relies on the Standard Contractual Clauses (Module 1) incorporated in its advertising data processing agreement.

No personal data returned by the API is transferred outside the EU.

11. Data Security

We implement industry-standard measures, including:

Encryption in transit (HTTPS / TLS 1.2+)
Encrypted storage within Hetzner EU data centres
Network segregation
Access control and least-privilege internal policies
Regular auditing and monitoring

No raw API personal data is transmitted to any third-party provider.

12. Data Retention

Technical logs: 30 days.
Analytics data (Google Analytics 4): 14 months.
Cookies: see the lifetimes in Section 14. The advertising cookies written by our server (FPGCLAW, FPGCLGB, FPLIFAT, FPRDTCID, FPAU) expire after 90 days.
Deduplication records kept by our first-party collection server, so that a sign-up or a purchase is counted once: 30 days.
Conversion data received by advertising platforms: retained under their own policies, outside our control. LinkedIn states that it keeps pseudonymised visit data and offline conversion data for 180 days and contact lists for 30 days; it does not publish the retention period of the hashed email address attached to a conversion. Reddit does not publish a retention period for this data.
Account & billing data: for the duration of the contractual relationship and as required by applicable law thereafter.
Professional B2B data: for as long as it remains accurate and useful for the Services; deleted or suppressed following a valid objection or erasure request.

You have the right to: access your personal data; rectify inaccurate information; request deletion; object to processing; restrict processing; export your data (portability); and, where processing relies on consent, withdraw that consent at any time.

Requests can be sent to antoine@blitz-api.ai. We will respond within 30 days. You also have the right to lodge a complaint with the French supervisory authority, the CNIL (https://www.cnil.fr).

Where your data has already been sent to an advertising platform acting as an independent controller (see Section 9), we cannot delete it on that platform directly. On request, we stop any further sending, relay your request, and tell you which channel to use. For LinkedIn, use the advertising settings of your LinkedIn account and LinkedIn’s own privacy channels. For Reddit, we relay your request to Reddit, including through the data deletion process that Reddit provides to advertisers where it is available to us, using the hashed version of your email address; you can also use the privacy settings of your Reddit account or contact Reddit directly. Our own response time of 30 days is unchanged.

14. Cookies

14.1 Our approach

When you first visit the public website (blitz-api.ai), a consent banner (Axeptio) asks whether you accept analytics and advertising cookies. Where your consent is required, these cookies are off by default: no analytics or advertising cookie is set, and no cookie-based measurement or advertising data is sent, until you accept. Wherever you are located, you can refuse or withdraw through the same banner at any time (see 14.3). Cookies that are strictly necessary to operate the website or the application (recording your consent choice, authentication, session) do not require consent.

The choice you make on the website (blitz-api.ai) also applies on app.blitz-api.ai: the consent record is stored on the shared root domain (blitz-api.ai), so you are asked once and your choice follows you into the application.

Our technical documentation (docs.blitz-api.ai) is served by a separate documentation platform; the cookies it may set are not covered by this section.

Essential cookies (authentication, session) are used in the application (app.blitz-api.ai) after sign-in, strictly to operate your Account.

Where website usage measurement by Vercel Web Analytics is enabled, it remains cookieless and aggregated: it does not identify individual visitors and stores nothing on your device.

14.2 Cookies we set

Cookie	Set by	Purpose	Lifetime
`axeptio_cookies`	Axeptio	Your consent choice and the resulting Google Consent Mode v2 state	up to 180 days
`axeptio_all_vendors`	Axeptio	List of the services offered for choice	up to 180 days
`axeptio_authorized_vendors`	Axeptio	List of the services you accepted	up to 180 days
`_ga`	Google Analytics 4	Pseudonymous client identifier	up to 730 days
`_ga_<id>`	Google Analytics 4	Session state (suffixed with the stream identifier)	up to 730 days
`FPGCLAW`	Our first-party collection server (Google Ads Conversion Linker), under your consent for advertising cookies (Google Ads)	Click identifier (gclid) carried from a Google ad click, readable by our application	90 days
`FPGCLGB`	Our first-party collection server (Google Ads Conversion Linker), under your consent for advertising cookies (Google Ads)	Click identifier (gbraid) carried from a Google ad click, same format, readable by our application	90 days
`FPLIFAT`	Our first-party collection server, under your consent for the LinkedIn service	Click identifier carried from a LinkedIn ad click, readable by our application	90 days
`FPRDTCID`	Our first-party collection server, under your consent for the Reddit service	Click identifier carried from a Reddit ad click, readable by our application	90 days
`FPAU`	Our first-party collection server (Google Analytics 4 client), under your consent for advertising cookies (Google Ads)	Pseudonymous advertising identifier used by Google Ads to link your visit to a conversion (the first-party equivalent of Google’s `_gcl_au` cookie)	90 days

The Axeptio cookies record your choice and are strictly necessary; their lifetime is the value we configure. The Google Analytics 4 cookies are set only if you accept analytics cookies; their lifetimes are Google’s documented defaults and may be shortened by your browser. The advertising cookies (FPGCLAW, FPGCLGB, FPLIFAT, FPRDTCID, FPAU) are first-party cookies written by our own collection server on the blitz-api.ai domain, each only under your consent for the corresponding service (Google Ads, LinkedIn, Reddit). FPGCLAW, FPGCLGB, FPLIFAT and FPRDTCID store a click identifier and nothing else, and are readable by our application (which reads them when you create an account, so that the conversion can be attributed). FPAU stores a pseudonymous advertising identifier and is read by our collection server only. All five expire after 90 days.

You can reopen the banner at any time through the “Cookie settings” link in the footer of every page of the website to change or withdraw your choice. Because the consent record is shared on the root domain (see 14.1), the choice you make there also governs the application. Withdrawing your consent is as easy as giving it. From your withdrawal, cookie-based audience measurement stops and no new advertising cookie is set. Our collection server also checks your recorded choice on every page view and on every click on our calls to action: once you have withdrawn your consent for a platform, these events are no longer reported to it, even if a click-identifier cookie is still stored (see 14.2). The withdrawal does not by itself remove such a cookie; you can delete it through your browser settings, otherwise it expires after 90 days. Sign-up and purchase events carry the consent choice recorded when you created your account; if you withdraw later, write to antoine@blitz-api.ai and we will stop these events as well. Declining has no effect on your use of the website or of the Services.

The banner offers a separate choice for each advertising platform (Google Ads, LinkedIn, Reddit). You can also act on the platform side: the advertising settings of your LinkedIn account and the privacy settings of your Reddit account let you limit how each platform uses data received from advertisers, including us, to personalise the ads you see. These settings complement your choice in our banner; they do not replace it.

14.4 Data sent to advertising platforms

Conversion data is sent to advertising platforms from our own first-party collection server, never by a pixel or script of theirs on our pages, and only for the platforms whose service you accepted in the banner.

Google Ads. With your consent for advertising cookies, when you arrive from a Google ad our server stores the click identifier in the FPGCLAW or FPGCLGB cookie. Page views and clicks on our calls to action may then be reported to Google Ads with the click identifier only, never your email. When you create an account or make a purchase, a hashed version of your email address is sent to Google Ads to measure conversions (enhanced conversions). Google receives only the hash, never the plain address.

When you decline advertising cookies, an ad click identifier present in the URL you arrived on may be carried in page URLs while you browse the website (URL passthrough) instead of being stored in a cookie; it is not stored on your device.

Without your consent, Google receives only cookieless pings (such as IP address, user agent, page URL, referrer, screen size and consent state), used for aggregate modelling. No cookie is set and no cookie-based identifier is created.

LinkedIn. With your consent for the LinkedIn service, when you arrive from a LinkedIn ad our server stores the click identifier in the FPLIFAT cookie. When you then create an account or make a purchase, our server sends LinkedIn the click identifier, a hashed version of your email address (SHA-256), the type of event, its time and, for a purchase, the amount and currency. LinkedIn receives the hash only, never the plain address, and never your IP address or browser details. Without your consent for LinkedIn, nothing is stored and nothing is sent (for withdrawal after acceptance, see 14.3).

Reddit. With your consent for the Reddit service, when you arrive from a Reddit ad our server stores the click identifier in the FPRDTCID cookie. Page views are then reported to Reddit with the click identifier and the address of the page only. When you create an account or make a purchase, our server sends Reddit the click identifier, a hashed version of your email address (SHA-256), the type of event, its time and, for a purchase, the amount and currency. Reddit receives the hash only, never the plain address, and never your IP address or browser details. Without your consent for Reddit, nothing is stored and nothing is sent (for withdrawal after acceptance, see 14.3).

15. Children

The Services are not intended for minors. We do not knowingly process personal data of individuals under 16.

16. Customer Responsibilities

Users of BlitzAPI must: use the API only for lawful B2B purposes; not submit consumer data; not violate any third-party platform terms of service (including LinkedIn’s); not attempt to scrape private or restricted resources; and not build datasets, products or enrichment platforms using BlitzAPI outputs. BlitzAPI reserves the right to suspend accounts violating these principles.

17. Changes to This Policy

This Privacy Policy may be modified from time to time as our practices and legal requirements evolve. We will post the updated Policy with a new effective date and, for material changes, provide notice.

18. How to Contact Us

For any privacy question or request, contact us at antoine@blitz-api.ai.

Data controller: BlitzAPI SAS, 1 rue Marguerin, 75014 Paris, France.