GDPR commitments

Blypp acts as a data processor when handling visitor conversations on behalf of merchants (who are the controllers). Blypp acts as a data controller for merchant account data (signup info, billing).

EU residents whose personal data is processed by Blypp have the right to:

• Access (request a copy of their data)
• Rectification (correct inaccurate data)
• Erasure ("right to be forgotten")
• Restriction of processing
• Data portability (machine-readable export)
• Object to processing
• Withdraw consent (where consent is the legal basis)

Visitors should contact the merchant whose chat they used. Merchants can fulfill these requests via the dashboard\'s data export + deletion tools, or by emailing [email protected].

We respond to all rights requests within 30 days, free of charge.

Every Pro and Enterprise customer is automatically covered by our standard DPA, which incorporates the EU Standard Contractual Clauses (Module 2: controller to processor). To request a signed copy or to negotiate enterprise terms, email [email protected].

The current sub-processors used in delivering Blypp:

• Supabase — database + auth (data lives in your chosen region).
• Vercel — web hosting + edge.
• Google Cloud (Gemini) — AI inference. Paid tier: prompts + responses are not used for training.
• Stripe — payment processing.
• Resend — transactional email delivery.

We notify customers at least 30 days before adding any new sub-processor. To subscribe to those updates, email [email protected].

EU data stays in EU regions when EU residency is selected (Enterprise plan). Otherwise, data may be transferred to Australia or the US under the EU Standard Contractual Clauses. Where applicable we apply supplementary measures (encryption, access controls, transparency reports).

In the unlikely event of a personal data breach, we notify affected merchants within 72 hours of becoming aware, and assist them in their own notification obligations to data subjects + supervisory authorities.

For all GDPR-related queries: [email protected]. EU residents may also lodge a complaint with their local supervisory authority.