Privacy Policy

How BlankTile collects, uses, and protects your data.

Last updated: 21 July 2026

What we collect

Only what's needed to run your dashboard and attribute revenue to your content.

What we never do

We never sell your data or share it with third parties beyond what's required by law.

Encrypted at rest

API keys and webhook secrets are encrypted before they ever touch the database.

Your rights (GDPR)

Access, correct, export, or permanently delete your data — instantly, from Settings.

What we collect

  • Account information — your name, email address, and password (hashed with bcrypt, never stored in plain text).
  • YouTube channel data — channel ID, video titles, and view counts, retrieved via the YouTube API once you connect your channel.
  • YouTube API Services data — when you connect your YouTube channel, BlankTile accesses YouTube channel data and YouTube Analytics data via the YouTube API Services. This includes channel statistics, video performance data, impressions, CTR, and audience retention. This data is used solely to display your own analytics in your BlankTile dashboard. By connecting your YouTube channel you are also agreeing to the YouTube Terms of Service and Google Privacy Policy.
  • Tracked link clicks — timestamp, device, browser, and IP address. IP addresses are anonymised (set to null) automatically 30 days after the click.
  • Revenue events — amount, currency, platform, and customer email, received from payment platform webhooks you configure (Stripe, Shopify, Gumroad, ThriveCart, Kajabi, PayPal, Triple Whale).
  • Email list subscriber counts — aggregate subscriber numbers from your connected email platform.

How we use it

We use your data to provide your dashboard, calculate analytics and health scores, attribute revenue back to the specific videos and links that drove it, and send you weekly performance reports if you've opted in.

What we never do

  • We never sell your data.
  • We never share your data with third parties except as required by law.
  • We never access your connected payment processor accounts beyond receiving the webhook events you've explicitly configured.

Data retention

  • Account data is kept until you delete your account.
  • Click IP addresses are anonymised 30 days after the click occurs.
  • Revenue data is kept for 7 years to meet accounting and tax record-keeping obligations, unless you delete your account, at which point it is removed immediately along with everything else.

Your rights (GDPR)

If you're in the UK or EU, you have the right to access, rectify, erase, restrict processing of, and receive a portable copy of your personal data.

You can delete all of your data instantly, at any time, via Dashboard → Settings → Delete Account. No need to contact us first.

For any other request, contact us at info@blanktile.co.uk.

Data security

  • All data is encrypted in transit via HTTPS.
  • API keys and webhook secrets are encrypted at rest before being stored.
  • Authentication uses httpOnly, secure cookies — never accessible to client-side scripts.
  • We're hosted on Vercel and Supabase, both of which run on SOC 2 compliant infrastructure.

Cookies

We only use essential cookies required for authentication. We do not use advertising or tracking cookies.

Data processor relationships

When you connect a payment platform (Shopify, Gumroad, ThriveCart, Kajabi, PayPal, or Triple Whale), BlankTile receives webhook data as a data processor acting on your behalf. We process this data solely to display it in your dashboard and attribute it to your content — we do not use it for any other purpose.

Contact

Questions about this policy or your data? Email info@blanktile.co.uk.

BlankTile is a company registered in England and Wales.