Privacy Policy

Blog Health — Operated by Diving Escapades SARL-S

Effective date: 9 August 2026

1. Who we are

Blog Health ("Blog Health", "we", "us", "our") is a website-health monitoring service for bloggers, operated by Diving Escapades, S.à r.l.-S, 8 rue des Mérovingiens, Bertrange, Luxembourg L-8070. RCS Luxembourg: B283755. VAT: LU35550236. Contact: support@bloghealth.app.

This Privacy Policy explains what personal data we collect, why, how we use it, who we share it with, and the rights you have. It applies to bloghealth.app and the Blog Health application. We are the data controller for the personal data described here.

2. What data we collect

Account data (via Google Sign-In). Blog Health uses Google Sign-In (OAuth) as the only way to create an account. We do not operate passwords, and we never receive or store a password. When you sign in, Google provides us with your name, your email address, whether your email is verified, your profile image (as a link hosted by Google), and your Google account identifier. We also store technical sign-in tokens returned by Google, limited to reading your basic profile and email.

Google Analytics and Search Console data (only if you connect them). If you choose to connect your Google Analytics (GA4) and/or Google Search Console (GSC) accounts, an optional step after sign-in, we access and process aggregate statistics about your own blog, such as page views, sessions, engagement rates, clicks, impressions, and average search position, organised by page. We receive aggregate figures only, never visitor-level records or IP addresses about your blog's visitors. To maintain the connection, we store access credentials for each connected Google account, which are encrypted at rest at the application level.

Website scan data. When you run a scan, we process the content and structure of your own website (its links, pages, and metadata) to produce your health and performance reports. This may incidentally include personal data you have published on your own site. As part of scanning, we send your page addresses to Google's PageSpeed Insights service to measure performance.

Page Watch data. If you use Page Watch, you provide the web address of an external page you choose to monitor, and an optional label. We send that address to our monitoring provider (Context Dev) so it can check the page for changes. We do not send your identity to the monitoring provider. You are responsible for choosing only publicly available pages and for not monitoring pages that display or collect personal data, as set out in our Terms of Use.

Billing data. If you subscribe to a paid plan, our payment processor (Stripe) handles your payment details. We do not store your full card details; we store identifiers linking your account to your Stripe records.

Communications and feedback. If you contact us or submit feedback, we process what you send us, including your name, email, and any free text you provide. Feedback is emailed to our support address through our email provider (Resend).

Consent records. We keep a record of your cookie consent decision (see Section 10).

Technical data. When you visit our site, standard technical information (such as your IP address, browser type, and device information) is processed by our infrastructure providers to operate and secure the Service. We also process limited analytics as described in Section 10.

3. How we use your data

We use your personal data to:

• provide the service (create and maintain your account, run scans, display your dashboard and reports);
• connect to and display your Google Analytics and Search Console data at your request;
• generate AI-assisted content suggestions through Content Coach, and AI-generated change summaries through Page Watch (see Section 6 regarding our providers);
• monitor external pages you choose through Page Watch and notify you of changes;
• process payments and manage your subscription;
• send you service and transactional messages (scan results, alerts about your sites and watched pages, account and security notices, and billing messages);
• send you marketing or product emails only if you have opted in (we do not currently operate a marketing email programme);
• respond to your enquiries and feedback;
• comply with our legal obligations; and
• protect the security and integrity of the service.

4. Legal basis for processing (GDPR)

We rely on the following legal bases under the EU General Data Protection Regulation:

• Performance of a contract, to provide the service you signed up for, including account management, scans, dashboards, Page Watch monitoring, and transactional/service emails.
• Consent, for connecting your Google Analytics and Search Console accounts, for non-essential cookies and analytics, and for marketing emails. You may withdraw consent at any time.
• Legitimate interests, to secure and improve the service, to analyse data in aggregated and anonymised form to understand trends and produce general insights (see Section 7), and to keep records demonstrating our compliance, where not overridden by your rights.
• Legal obligation, where we must retain or process data to comply with the law (for example, retaining accounting records).

5. Who we share your data with, and international transfers

We do not sell your personal data. We share it only with the service providers below, each under appropriate data protection terms. Some are located outside the EU/EEA (for example, in the United States); where personal data is transferred outside the EU/EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or equivalent mechanisms.

We may also disclose data where required by law, or in connection with a sale or reorganisation of the business, in which case we will ensure it remains protected.

6. AI features and what is shared

Content Coach (Anthropic). When you use Content Coach, we send our AI provider (Anthropic) details about your posts and the strategic context you enter, so it can generate suggestions. This includes, for your posts: the title, web address, aggregate performance figures (such as views, sessions, engagement rate, clicks, and search position), word count, internal link counts, broken link counts, whether a post is flagged as outdated, and the internal link structure between your posts including the anchor text used. It also includes the strategic context you type yourself, such as your niche, target audience, goals, content pillars, what you promote, and planned post ideas. We do not send the full body text of your posts. Outputs are AI-generated suggestions, not professional advice.

Page Watch (Context Dev). When you monitor a page with Page Watch, we send the external page's web address to our monitoring provider (Context Dev), which checks the page and returns a summary of what changed, generated using AI. We do not send your identity. The change summary is AI-generated and may be inaccurate or incomplete; you should check the page yourself before relying on it.

7. Aggregated and anonymised insights

As Blog Health grows, we may analyse data across our users in aggregated and anonymised form to understand common website-health trends and to improve and promote the Service. For example, we may look at how many broken links our users find on a first scan, or the most common types of broken links and SEO issues across the blogs we scan, and we may publish these general findings in blog posts, reports, charts, or other educational or promotional content.

We will only ever publish information in a form that does not identify, and could not reasonably be used to identify, any individual user, blogger, or website. We do not publish figures that are specific enough to single out any one user or site.

Where data is fully anonymised so that no one can be identified from it, it is no longer personal data, and this Privacy Policy does not restrict our use of it. Where the underlying analysis is carried out on data that still relates to you, we do so on the basis of our legitimate interests in understanding, improving, and promoting the Service, as described in Section 4. You may object to this processing at any time by contacting us at support@bloghealth.app. This applies in the same way to FREE and PRO users.

8. Data retention

We keep your personal data only as long as necessary for the purposes in this policy:

• Account data, for as long as your account is active.
• On account deletion, we delete your personal data across our systems, including your account, connected data, watched pages, and feedback and access-list records. We will action a deletion request and confirm within 30 days.
• Billing and accounting records (such as invoices and records of payments), retained for up to 10 years to meet our accounting and tax obligations under Luxembourg law. Your card payment details are held by Stripe, not by us.
• Consent records, retained for up to one year (see Section 10).
• Feedback and support messages, retained for 2 years unless deleted earlier at your request.

You can request deletion of your account and data by emailing support@bloghealth.app.

9. Security

We take reasonable technical and organisational measures to protect your personal data, including encryption in transit (TLS), encryption at rest at the database level, access controls, and reputable infrastructure providers. In addition, the credentials for your connected Google Analytics and Search Console accounts, and the security secret used by Page Watch, are encrypted at the application level.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal data breach occurs that is likely to affect your rights, we will notify the relevant supervisory authority and, where required, affected users, in line with our legal obligations.

10. Cookies and similar technologies

This section explains the cookies and tracking technologies we use. We do not load non-essential cookies until you have given consent through our cookie banner.

Essential cookies (always active): authentication cookies (keep you securely signed in and protect against cross-site request forgery); a consent cookie (bha_consent) that records your cookie consent decision using a randomly generated identifier not linked to your name, email, or IP address, we keep a server-side log of consent decisions to demonstrate consent was obtained; short-lived OAuth security cookies that protect the Google Analytics and Search Console connection process; and a blog consent cookie shared with our separate blog system.

Non-essential technologies (only after you consent): Google Analytics via Google Tag Manager, which sets cookies such as _ga. If you do not consent, these are never loaded.

Cookieless analytics: Vercel Web Analytics, a privacy-friendly tool that does not set cookies or use tracking identifiers, and so runs regardless of your cookie choice.

Once you have made a cookie choice, the banner does not reappear. To change your decision, clear the cookies for our site in your browser, after which the banner will be shown again.

11. Your rights

Under the GDPR, you have the right to access the personal data we hold about you; request correction of inaccurate data; request erasure of your data; restrict or object to certain processing; data portability (receive your data in a portable format); withdraw consent at any time where we rely on consent; and lodge a complaint with a supervisory authority, in Luxembourg the CNPD. To exercise any of these rights, email support@bloghealth.app. We will respond within the timeframes required by law.

12. Children

Blog Health is not intended for anyone under the age of 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. If we make significant changes, we will notify you by email or through a notice in the app. The effective date at the top shows when this version took effect.

14. Contact and complaints

For any privacy question or to exercise your rights: Diving Escapades, S.à r.l.-S. Email: support@bloghealth.app. Address: 8 rue des Mérovingiens, Bertrange, Luxembourg L-8070. RCS Luxembourg: B283755.

You also have the right to complain to the Commission Nationale pour la Protection des Données (CNPD), Luxembourg's data protection authority, at 15 Boulevard du Jazz, L-4370 Belvaux, Luxembourg. Tel +352 26 10 60 1.