Privacy Policy

1. General


This Privacy Policy describes how BlastOptimize processes the Users' personal information to perform the Services offered on the Website, under the domain www.blastoptimize.io ("Services").



Users must read and expressly consent to the data processing referred to by this Privacy Policy, before using the Services.



2. Data Controller


The Controller of the data collected through this Website is Blast Group, entity of French nationality with professional address at 3 avenue de la Division Leclerc, 92160 Antony, France, provided with Tax Identification Number FR66520951419 (hereinafter “Blast Group”).



3. Purposes of the Processing and Legal Basis


Blast Group will process the personal data of the User of this Website for the following purposes:


Enable the maintenance, development and management of the Services, including the business relationship formalized by contracting products and/or services through this Website. This includes carrying out operations related to customer management, contracts, subscriptions, invoices, payments, and possible disputes regarding the use of our products and services. The data processed for this purpose will be kept for as long as the business relationship is maintained and, once it ends, during the legally established periods of conservation and limitation of responsibilities. The legal basis of the processing is the execution of a contract in which the User is a party.



Respond to requests for information and/or queries made by the User. The data processed for this purpose will be kept until the request for information and/or consultation has been answered and, after that, during the legally established periods of conservation and limitation of responsibilities. The legal basis of the processing is the legitimate interest of Blast Group in responding to the User.



Keep the User informed, including by electronic means, about Blast Group products, services and news. The data processed for this purpose will be kept until the User withdraws consent given to receive such communications and, after that, during the legally established periods of conservation and limitation of responsibilities. The legal basis of the processing is the consent of the User.



If the User does not consent to the processing of their data for this purpose, they may inform Blast Group in writing or use the dedicated option provided for this purpose.



Failure to accept this Privacy Policy will imply that the Services provided and Website content offered by Blast Group may not be made available and that the account creation or subscription process may be interrupted or terminated.



4. Categories of Data


The User must complete all required fields with truthful, complete and up-to-date information, except for details indicated as optional. This information is required by Blast Group in order to provide the Services and comply with the purposes described above. Otherwise, Blast Group reserves the right not to provide the Services.



Users guarantee that the personal details provided to Blast Group are accurate and are responsible for notifying any modification of these details by updating the information available on the platform or informing Blast Group.



The data relating to bank cards are stored only for the time necessary to complete the transaction, except in the case of recurring subscriptions, in order to facilitate payments from regular customers. In this case, bank card data may be stored for the duration of the subscription and at least until the date of the last transaction.



Such storage is implemented by Blast Group's secure payment service providers, including Stripe and Braintree. By subscribing to the Services offered on the Website, the User expressly agrees to this storage. Data relating to the visual cryptogram or CVV2 on the back of the bank card are never stored.

5. Automated Decision-Making


Blast Group informs Users that by using the Services they may be subject to automated decision-making, including profiling. The purpose of this processing is to ensure the adequacy and improvement of the Services provided according to the purposes described herein.



6. Recipients and Personal Data Transfers


The data may be communicated to the following third-party recipients:


  • Public Administrations for the fulfillment of legal obligations;
  • Banking institutions for the management of collections and payments;
  • Providers of electronic communications, office automation, hosting, infrastructure, computer maintenance, management, accounting, auditing, consultancy and legal representation services.

These providers may be located outside the European Economic Area, in which case Blast Group will have previously adopted the appropriate safeguards required by applicable data protection regulations.



Some of our service providers, acting as data processors on our behalf, may use artificial intelligence tools as part of their service delivery. This may involve the transfer of personal data to entities located outside the European Economic Area. Blast Group ensures that such transfers are carried out in accordance with applicable data protection regulations and are based on appropriate safeguards.



7. Rights of the Users


Users are entitled at any time to exercise their rights of access, rectification, erasure, restriction of processing, data portability, objection to processing and the right not to be subject to decisions based solely on automated processing, including profiling.


Users may exercise these rights by contacting Blast Group and sending a written notification to legal@blastgroup.io, attaching a copy of their National Identity Document or another equivalent identity document identifying them as a User.



Users have the right to withdraw their consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. Users also have the right to lodge a complaint with a supervisory authority.



8. Blast Group as Data Processor


In the event that the User purchases a license to use the Services, Blast Group may process certain personal data on behalf of the licensee, whether the licensee is the User itself or a legal entity represented by the User.


For these purposes, the User shall be considered the Data Controller and Blast Group shall be considered the Data Processor.



8.1. Processing of Data to be Carried Out by the Data Processor


The Data Processor shall process the personal data necessary to provide the Services on behalf of the Controller. The processing shall have a duration equal to the provision of the Services. Once the Services have ended, the processing shall be considered completed.



8.2. Identification of the Information Concerned


For the performance of the Services, the Controller shall make available to the Processor the following categories of information:


  • Identification data
  • Personal characteristics data
  • Social circumstances data
  • Academic and professional data
  • Employment details
  • Economic, financial and insurance information
  • Transactions related to goods and services
  • Health data
  • Data revealing racial or ethnic origin
  • Data revealing political opinions
  • Data revealing religious or philosophical convictions
  • Data concerning sex life or sexual orientation


8.3. Obligations of the Processor


The Data Processor undertakes to:


has. Use personal data only for the strict provision of the Services and never for its own purposes.


b. Process data according to the instructions provided by the Controller. If the Processor considers that any instruction infringes the GDPR or other applicable data protection provisions, it shall immediately inform the Controller.


c. Maintain, where applicable, written records of processing activities carried out on behalf of the Controller, in accordance with Article 30(2) of the GDPR.


d. Not communicate personal data to third parties except where legally permitted or expressly authorized by the Data Controller.


e. Not subcontract any processing activity involving personal data without prior written notification and compliance with applicable GDPR requirements.


f. Maintain confidentiality regarding all personal data accessed during the provision of the Services, including after termination of the Services.


g. Ensure that authorized persons processing personal data commit themselves to confidentiality obligations and comply with applicable security measures.


h. Keep documentation demonstrating compliance with applicable obligations available to the Data Controller.


i. Ensure appropriate training regarding personal data protection for authorized personnel.


j. Assist the Controller in responding to requests relating to:

  • Access, rectification, erasure and objection;
  • Restriction of processing;
  • Data portability;
  • Not being subject to automated individual decisions, including profiling.

k. Notify the Controller without undue delay and no later than 48 hours by email of any personal data security breach of which it becomes aware.

L. Support the Controller in carrying out data protection impact assessments, where appropriate.


Mr. Support the Controller in carrying out prior consultations with the supervisory authority, where appropriate.


n. Make available to the Controller all information necessary to demonstrate compliance with its obligations, as well as for the performance of audits or inspections carried out by the Controller or any authorized auditor.


o. Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, implementation costs, and the nature, scope, context and purposes of processing.


These measures include:

  • Ensuring the continued confidentiality, integrity, availability and resilience of processing systems and services;
  • Restoring availability and access to personal data in a timely manner in the event of a physical or technical incident;
  • Regularly verifying, evaluating and assessing the effectiveness of technical and organizational measures implemented to ensure processing security;
  • Pseudonymizing and encrypting personal data where appropriate.

p. Appoint a Data Protection Officer and communicate their identity and contact details to the Controller where required.



q. While a BlastOptimize account is active, all associated data, including personal data, will remain accessible. However, invoices related to active subscriptions will be deleted six years after their creation, in compliance with legal requirements.


Account administrators may delete their account and associated data at any time. The deletion process can be initiated directly from the BlastOptimize platform interface (app.blastoptimize.io) or by contacting us at legal@blastgroup.io.


Account deletion requests will be processed within a maximum period of 30 days. Certain information, such as payments, invoices and billing data, may not be deleted immediately. Instead, such data may be blocked in order to comply with legal obligations or defend against potential claims, in accordance with applicable retention periods under Article 17(3) of the GDPR.



Account Deactivation: Once a subscription ends, if the account is not accessed within six months, it may be deactivated. Upon deactivation, users may lose access to the account and associated experimentation features. Account restoration may not be possible after permanent deletion.


Users will receive notifications before their account is deactivated. If users access their account during this period, the deactivation countdown may be reset.



Following account deactivation, data management will proceed as follows:


  • Non-Personal Data: Experiment metrics, campaign performance data and technical information may be deleted upon account deactivation to ensure that unnecessary data is not retained.
  • Personal Data: Personal information, including user details, integration logs and account information, may be archived and permanently deleted three years after the date of account deactivation.
  • Financial Data: Payments, invoices and billing information may be archived and permanently deleted six years after the date of account deactivation, in compliance with applicable accounting and fiscal requirements.

The distinction between personal data retention periods and financial data retention periods reflects the different legal obligations applicable to each category of information.


Once data has been archived, retrieval requests may be submitted by email to legal@blastgroup.io. Such retrieval will only be permitted where there is a valid legal basis, such as compliance with a legal obligation or defense against potential claims.


Blast Group will retain archived data according to the applicable retention periods, ensuring that such data remains restricted and used only when required by legal obligations or for addressing liabilities arising from service performance.


r. Comply with any other obligations established by the GDPR, applicable data protection laws and regulations for the Data Processor.



8.4. Obligations of the Data Controller


The Data Controller has the following obligations:

  • Provide or allow access to the data necessary for the provision of the Services;
  • Carry out a data protection impact assessment where applicable;
  • Conduct prior consultation with the supervisory authority where required;
  • Ensure compliance with GDPR requirements throughout the processing;
  • Supervises processing activities, including audits and inspections;
  • Provide appropriate information to data subjects at the time of data collection;
  • Comply with all other obligations applicable to Data Controllers under GDPR and related regulations.


9. Security and Protection of Data


Blast Group has implemented the legally required data protection and security measures and continuously works to adopt additional technical and organizational measures within its capabilities to prevent loss, misuse, alteration, unauthorized access or theft of personal data provided by Users.


Blast Group commits to processing all information provided by registered Users with the highest level of confidentiality and security.


Any use and transfer of information received from Google APIs by Blast Group will comply with the Google API Services User Data Policy, including Limited Use requirements. Google Workspace APIs are not used to develop, improve or train generalized artificial intelligence or machine learning models.



10. Changes to this Privacy Policy


Blast Group reserves the right to modify this Privacy Policy in order to adapt it to new regulations, case law developments and industrial or commercial practices.


If Blast Group modifies this Privacy Policy, the updated version will be published on this page.


This Privacy Policy was last modified on 10/07/2025.



BlastOptimize is a professional platform dedicated to digital experimentation and conversion optimization. We provide tools that enable businesses to create, manage and analyze A/B tests and improve their digital experiences. We do not create, support or endorse inappropriate or misleading content. Any search engine associations suggesting otherwise are the result of third-party misuse and do not reflect BlastOptimize's purpose or values.

Search