Privacy Policy for Bluda Overturn

1. Controller

The controller responsible for processing your personal data in connection with Overturn is:

Bluda UG (haftungsbeschränkt) Loreleyring 26 56346 Sankt Goarshausen, Germany Email: support@bluda.tech

This policy applies to the Overturn software application, Overturn Cloud, account and billing features, and the Overturn backend. The general Bluda website privacy policy applies separately to other parts of bluda.tech.

2. Data we process

Depending on how you use Overturn, we process:

• Account data: user ID, email address, authentication status, and login/provider information. Passwords and Google sign-in are handled by Supabase Auth and, if chosen, Google.

• Billing data: Stripe customer and subscription IDs, email address, plan, price, payment and invoice status, subscription dates, and billing metadata. Full payment-card or bank details are entered directly with Stripe and are not stored by Bluda.

• AI content: prompts, chat messages, system instructions, and other text or content you choose to include, as well as the generated response.

• AI usage and audit data: model, request status, timestamps, feature metadata supplied by the app, token counts, estimated cost, billing period, and error information. Bluda's application database does not store the text of successful prompts or generated responses in these audit records.

• Technical and security data: IP address, request time, device or application information, request headers, and server/error logs that may be processed by our hosting and infrastructure providers.

• Support data: your contact details and the content of messages when you contact us.

Please do not include unnecessary personal data in prompts. In particular, avoid special-category data, confidential information, trade secrets, and third-party personal data unless you have a lawful basis and the processing is necessary.

3. AI processing

When you use an AI feature, the app sends your request to the Overturn backend. The backend authenticates your account, checks your subscription and usage limit, and forwards the prompt through Vercel AI Gateway to the selected model provider, currently MiniMax. The response returns through the same services to the app.

Bluda does not save prompt or response text in its Overturn application database after the request is completed. Vercel and MiniMax necessarily process that content to provide the response and may process technical, safety, or service data under their applicable terms and privacy rules. Overturn currently does not send the request-level Vercel settings for zero data retention or no prompt training. You should therefore assume that the upstream providers may retain or use submitted content as described in their policies and should not submit sensitive or confidential content.

Provider information: Vercel Privacy Notice, Vercel AI Product Terms, and MiniMax API Privacy Policy.

4. Purposes and legal bases

We process personal data for the following purposes:

• Providing Overturn and your account — performance of the contract or steps requested before entering it (Article 6(1)(b) GDPR).

• Generating AI responses — performance of the contract (Article 6(1)(b) GDPR). If you include third-party personal data, you are responsible for having an appropriate legal basis.

• Subscriptions, payment, and invoices — performance of the contract (Article 6(1)(b)) and compliance with tax and accounting law (Article 6(1)(c)).

• Usage limits, fraud prevention, service security, debugging, and abuse prevention — our legitimate interests in operating a secure and economically sustainable service (Article 6(1)(f)).

• Support and service communications — performance of the contract (Article 6(1)(b)) or our legitimate interest in responding to requests (Article 6(1)(f)).

• Establishing, exercising, or defending legal claims — our legitimate interests (Article 6(1)(f)).

Where we rely on consent for a specific optional activity, the legal basis is Article 6(1)(a) GDPR. You may withdraw consent at any time with future effect.

5. Recipients and processors

We use the following categories of recipients:

• Supabase: authentication, account management, Postgres database, subscription and usage records. Privacy Policy

• Stripe: checkout, recurring payments, invoices, and customer billing portal. Privacy Policy

• Google Cloud: hosting of the Overturn backend, networking, and operational logs. Privacy Notice

• Vercel AI Gateway: routing, metering, and forwarding AI requests. Privacy Notice

• MiniMax: processing prompts and generating AI responses. API Privacy Policy

• Google, if you choose Google sign-in: identity and authentication. Privacy Policy

• professional advisers, authorities, or courts where required by law or necessary to protect legal rights.

We do not sell your personal data.

6. International transfers

Some providers process data in the United States, Singapore, or other countries outside the European Economic Area. MiniMax states that its API personal data may be stored in the United States. Where required, transfers rely on an adequacy decision, the European Commission's Standard Contractual Clauses, or another lawful safeguard. You can contact us for more information about applicable safeguards.

7. Retention

We retain data only as long as needed for the purposes above:

• account data is generally kept while your account exists and deleted or anonymized after account deletion, subject to legal obligations and legitimate claims;

• subscription, invoice, and payment records are retained for statutory tax, commercial, and accounting periods, generally between six and ten years where German law applies;

• usage-period and inference audit records are kept for account administration, budget enforcement, security, support, and legal claims, and are deleted with the account unless continued retention is legally required;

• prompt and generated-response text is not stored in Bluda's Overturn application database after processing; upstream providers may retain data according to their own policies and contractual settings;

• technical and security logs are retained according to operational necessity and the configurations of our hosting providers; and

• support communications are kept until the request is resolved and thereafter as needed for legal obligations or claims.

Data may be retained longer when required by law, a preservation obligation, or the establishment, exercise, or defense of legal claims. It is then restricted to that purpose.

8. Local storage and authentication

The Overturn subscription page stores the Supabase session token in your browser's local storage so that you remain signed in. You can remove it by signing out or clearing site data. Supabase and Google may use technically necessary cookies or similar storage during authentication. Stripe uses its own technologies on checkout and billing pages under its policy.

9. Automated processing

AI generation is automated, but Bluda does not use it to make decisions that produce legal or similarly significant effects about you. Automated checks may enforce authentication, subscription status, security controls, and monthly usage limits. If you believe such a check is incorrect, contact us.

10. Your rights

Subject to the legal requirements, you may request access, rectification, erasure, restriction, data portability, or object to processing based on legitimate interests. You may withdraw consent at any time with future effect. You also have the right to lodge a complaint with a data-protection authority. The authority responsible for Bluda is generally the State Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate; you may also contact the authority at your habitual residence or workplace.

To exercise your rights, email support@bluda.tech. We may need to verify your identity. Statutory exceptions may apply.

11. Security

We use appropriate technical and organizational measures, including encrypted transport, access controls, provider credentials, and database access policies. No internet service is completely secure. Keep your credentials protected and do not place sensitive data in AI prompts unless necessary and appropriate.

12. Children

Overturn is not directed to children under 16. Users under 18 should use the service only with the consent of a parent or legal guardian where required. If you believe a child has provided personal data without valid authorization, contact us.

13. Changes and contact

We may update this policy when the service, providers, or law changes. We will identify the current date above and provide additional notice of material changes where required.

For privacy questions or requests, contact support@bluda.tech.