Privacy Notice
Draft: pending legal review. Version 30 August 2026.
This notice explains what personal data Vablis processes, why, and what your rights are. Vablis is provided by Blomburst Solutions Oy, referred to below as Blomburst, we or us.
1. Controller
- Blomburst Solutions Oy, Business ID 3587888-4
- Iidesaukio 3, 33100 Tampere, PL 82085, Finland
- Data protection contact: valtteri@blomburst.io
2. When we are the controller and when we are the processor
We are the controller for the personal data described in this notice: your contact details, your account, the preview you request and the technical data of the service.
Your sources, your interview and your outputs can contain personal data of other people, for example your staff or your customers. For that data you are the controller and we are the processor, acting on your instructions under a data processing agreement. Those people should contact you first.
3. What we process and why
The free preview
| Data | Why | Legal basis | Kept |
|---|---|---|---|
| Your email address | To verify it and to send you the verification link | Steps before a contract, taken at your request | Deleted seven days after the request |
| The web address you enter and the public pages we read from it | To produce the preview | Your confirmation that the website is yours; steps before a contract; our legitimate interest in showing what the service does | Deleted seven days after the request |
| A salted hash of your IP address | To limit the number of previews per network and to prevent misuse. The address itself is not stored. | Legitimate interest | Deleted seven days after the request |
| The preview itself | To show it to you at a link only you receive | Steps before a contract | Deleted seven days after the request |
Your account and the paid service
| Data | Why | Legal basis | Kept |
|---|---|---|---|
| Email address | Login links, service messages and support | Contract | For the life of the account, then as described in section 7 |
| Device name, a hashed device identifier and session data | Device slots and keeping you logged in | Contract | Until you release the device or the session expires |
| The interview and the drafts built from it | So that Vablis can serve you with your own information, voice and rules | Contract | For the life of the account |
| Your approved sources and the indexes built from them | So that Vablis can answer from your own material | Contract (for personal data inside them, you are the controller) | Until you delete the source or the account ends |
| Your notes from a connected vault | So that Vablis can answer from your own notes as well as your other sources | Contract (for personal data inside them, you are the controller) | Until you disconnect the vault, the vault stops syncing for 90 days, or the account ends; see section 7 |
| Credit balance and usage events: what was done, when and for how many credits | Metering, your balance view and cost accounting | Contract and legal obligation | For the life of the account; accounting records as required by law |
| Payment data | Processing your payment through Stripe. We receive the confirmation, the amount and the email address used at checkout. We do not receive or store card numbers. | Contract and legal obligation | Accounting records as required by law |
Connected vaults
If you connect a vault of your own notes, Vablis reads the folders you choose from it. It reads Markdown files only, and it does not read anything outside the folders you selected. Your files stay where they are: what Vablis holds is a working copy of the text, used to answer your questions and always attributed back to the note it came from. You can change the selected folders or disconnect the vault at any time.
Your notes are processed exactly like your other approved sources. They are stored in the same database, isolated at the database level so that no other customer can read them, they are indexed for search by the same provider listed in section 6, and they are sent to the language model only as the material for answering your own questions. Connecting a vault does not add a new service provider.
Notes are personal in a way that a public website is not. They can contain information about other people, for example customers, colleagues or meetings. For that information you are the controller and we are the processor, as described in section 2, and section 8 of the Terms describes what that means for you.
Technical data
| Data | Why | Legal basis | Kept |
|---|---|---|---|
| Server logs: IP address, time, requested page and browser | Operating and securing the service, investigating errors | Legitimate interest | At most 12 months |
| Support messages | Helping you | Contract | For the life of the account |
Contacting you about Vablis
Today we send only the emails the service itself requires: the preview verification link, login links and the welcome message after a purchase. If you have requested a preview or bought Vablis, we may also contact you by email about the service and related offers, based on our legitimate interest in business-to-business communication. You can opt out at any time by writing to valtteri@blomburst.io, and we stop.
4. What we do not do
- We do not sell personal data.
- We do not use your data, your sources or your outputs to train models, ours or anyone else's.
- We do not ask for, and you should not send us, personal identity numbers, health data or other special categories of personal data.
- We do not make solely automated decisions about you that have legal or similarly significant effects.
- We do not use analytics or marketing cookies.
5. Artificial intelligence
Vablis is an AI system. The interview, the summaries and the answers are written by a language model (Anthropic Claude) from the sources you approve. Whenever Vablis writes to you, you are interacting with an AI system. Outputs can be wrong; section 8 of the Terms of Service describes your responsibilities when you use them.
6. Sub-processors and where data is
We use the following service providers to run Vablis. Each processes data only to provide its part of the service and on our instructions.
| Provider | What it does |
|---|---|
| Supabase | Database and storage for accounts, sources, indexes, interviews and outputs, in the EU (region eu-west-1) |
| Vercel | Hosting of the application and server logs |
| Resend | Sending verification and login emails |
| Anthropic | Language model that produces the interview, the summaries and the answers from the content we send it |
| Groq | Backup language model for the free preview, both for the summary and for the three sample outputs, used only while our primary language model has no capacity |
| Voyage AI | Embeddings used to search your approved sources |
| Firecrawl | Reading the public pages of the website you confirmed as yours |
| Gmail connector. Not yet available: no customer can connect it today, and no Gmail data has been processed. When it becomes available and you connect and authorize it, it reads message threads (sender, recipient, subject and body) and creates draft replies in that Gmail account. It never sends email on your behalf | |
| Stripe | Payments |
Your data is stored in the European Union. Vercel, Resend, Anthropic, Groq, Voyage AI, Firecrawl, Google and Stripe are established outside the EU and EEA or may process data there when they perform their part of the service, for example when text is sent to a language model. Transfers to each of these providers are based on the standard contractual clauses adopted by the European Commission.
The Gmail connector is not yet available, and no Gmail data has been processed. It is described here because the rest of this notice describes it. When it becomes available, it will only access the account you explicitly connect. It is limited to reading messages and creating unsent drafts, using the minimum scopes Google offers for that. You will be able to disconnect it at any time, which revokes our access to your Gmail account.
Groq only ever receives the public pages of the website you confirmed as yours when you request a preview. It never receives your email address, your IP address or any other record we hold about you. Public company pages can still contain personal data, for example names on a team or contact page, and that content is sent to Groq when this backup is used.
We may disclose personal data to an authority, an auditor or a legal adviser when the law requires it or a legal claim makes it necessary.
7. How long we keep data
- Preview data, including the pages read and the result: seven days after the request, then deleted automatically.
- Verification and login links: single-use and time-limited; the email states the validity period. Only a hash of each link is stored.
- Account data, sources, interview and outputs: for the life of the account. When you ask us to delete your account, your access ends immediately and not after 30 days: at that moment we revoke your sessions, release your device slots and revoke any connector authorizations. The 30 days is the period after which the data itself is erased, and it exists so that a request made by mistake can still be undone. The data is erased within 30 days of your request, except data we must keep by law.
- Notes from a connected vault: when you disconnect the vault, we stop using them immediately and nothing from that vault can appear in any answer. Our copy is erased within 30 days. Your own files are not affected. If a vault stops syncing for 90 days, we treat it as abandoned and do the same thing without being asked, so that a vault you stopped using does not leave a copy with us indefinitely. If the account ends instead, the notes are deleted with everything else within 30 days.
- Accounting records: for the period required by accounting law.
- Server logs: at most 12 months.
- Your opt-out from our emails: the request you send us, kept for as long as needed to honour it.
8. Security
We protect personal data with access control, encrypted connections, secrets management and backups. Login links and device identifiers are stored only as hashes. Each customer's data is isolated at the database level, so one customer cannot query or see another customer's data. Only the people who need the data for their work have access to it.
9. Cookies and local storage
Vablis uses only what the service needs to work: a session cookie (vablis_session) that keeps you logged in and expires at the latest 30 days after login, and a device identifier in your browser's local storage (vablis.device) so that the same device does not use a new device slot. No analytics or marketing cookies are set. If we ever introduce non-essential cookies, we ask for your consent first.
10. Your rights
- The right to know whether we process your personal data and to get a copy of it.
- The right to have inaccurate or incomplete data corrected.
- The right to have your data deleted, in the situations provided by law. If you ask us to delete your account, your access ends immediately; section 7 describes what happens and when.
- The right to restrict processing.
- The right to object to processing based on our legitimate interest, and an unconditional right to object to direct marketing.
- The right to withdraw consent at any time, without affecting processing done before the withdrawal.
- The right to receive the data you gave us in a portable form, where the law provides for it.
- The right to complain to the Office of the Data Protection Ombudsman in Finland.
Send requests to valtteri@blomburst.io. We may ask for reasonable additional information to verify your identity, and we answer without undue delay and normally within one month.
11. Changes to this notice
We may update this notice when the service, our providers or the law change. The current version is published at /privacy with its date. If a change materially affects you, we tell you by email.
12. Contact
Blomburst Solutions Oy, Iidesaukio 3, 33100 Tampere, PL 82085, Finland. valtteri@blomburst.io