Privacy policy
Edition of 11/06/2026. This version is for visitors and users of BlaBlaPrice in United States.
This policy explains what personal data BlaBlaPrice collects, why, who receives it, how long we keep it and what rights you have. It follows the applicable laws of the United States and of your state. Where another country has its own version of this policy, that version applies to people in that country.
1. Who is responsible for your data
- Controller: EVERLOGIC LLC (ТОВ «ЕВЕРЛОДЖІК»), company code 45818096.
- Address: 48 Lva Halytskoho St., Staryi Sambir, Lviv Oblast, 82001, Ukraine.
- Privacy contact: privacy@blablaprice.com (general support: support@blablaprice.com).
- The person responsible for personal data is the director of EVERLOGIC LLC, reachable at the same privacy address.
2. What data we collect
From you, when you use the service:
- Account: your name, e-mail address, profile photo and Google ID from the Google account you sign in with. We never receive your Google password. If you sign in with a code sent to your email, we keep the address, a hash of the code (10 minutes) and the number of tries, to protect the sign-in from guessing. An offer written on an invitation page without signing in, with the company name, email and phone, is kept for up to 48 hours until you confirm it.
- Profile, if you fill it in: phone number, company or shop name, address or city, website, Telegram, a short description, a seller price list.
- Requests: the text of what you are looking for, the city, the budget, a photo if you add one, and your answers to the assistant's clarifying questions.
- Offers and messages: sellers' offers, prices and photos, the personal chat between a buyer and a seller, reviews and ratings.
- Contact exchange: when a buyer and a seller agree to exchange contacts, each side receives the other's name, phone and e-mail.
- Invitations: when a buyer invites companies through the service, which companies were invited, by which channel, and whether and when the invitation link was opened.
- New requests for sellers: when you sign up as a seller or press «I want to get such requests» on an invitation page, we keep your email address, the date, the consent text you saw, the categories and the city, so that we can send you new buyer requests. You can unsubscribe at any time with the link in every letter, after which such letters stop.
- Monthly email to buyers: if you have confirmed your email address, we may send you one email from BlaBlaPrice a month: how to connect your own AI agent (Claude, ChatGPT) or, if you have not searched for a while, new and popular categories in your city. Where such an email requires consent, we send it only after you have ticked it. You can unsubscribe at any time with the link in every email; after that you no longer receive these emails.
- AI agents and API: the keys you create, and the actions an agent you connected takes on your behalf (logged with time).
- Payments: paid seller plans are not open yet. When they open, we will receive the plan, amount, date and payment status from the payment provider. We do not receive or store card numbers.
- Support: what you write to us by e-mail or through the contact form.
Automatically: IP address, browser and device type, operating system, pages opened, time of visit, the address you came from, and the cookies described in section 9.
From public sources: to find companies that could answer a request, we collect contact details that companies and sole traders have published for customers on their websites, online maps and directories: name, website, phone, e-mail, messenger links, business address. On category pages and in the market analysis we show only a company's name, town, what it offers and its open prices, without phones, e-mails or people's names; a company can take itself off these lists with the link «Remove my firm from the list» under them (/site/firm-optout).
We do not ask for sensitive data (health, religion, biometrics, identity documents). Please do not put such data or your contacts into the text of a request.
3. Why we use the data and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and running your account | account, profile | performance of the contract (the terms of use) with you |
| Publishing requests, showing them to suitable sellers, offers, chat and contact exchange | requests, offers, messages, contacts | performance of the contract (the terms of use) with you |
| Understanding a request with AI: category, clarifying questions, price search; checking requests, offers and photos for contacts, fraud and prohibited content | request text and photo, offers, chat messages, first name (to address you correctly) | performance of the contract (the terms of use) with you |
| Finding companies for a request and preparing the invitations the buyer sends | public business contacts, invitation records | the legitimate interest of buyers and of the company to receive offers from businesses that publicly offer their goods and services |
| Letting an AI agent act for you through the API or MCP | whatever the agent's tools return (section 10) | your instruction (performance of the contract) |
| Measuring how the site is used and improving it | technical data, analytics cookies | our legitimate interest after notice, with the right to switch it off in the cookie settings |
| Security, preventing abuse and fraud, investigating incidents | technical data, server logs | our legitimate interest, balanced against your rights; you may object |
| Keeping accounting and tax records, answering lawful requests of authorities | payment records, what the law requires | a legal obligation |
| Answering your questions and requests | what you write to us | performance of the contract (the terms of use) with you |
| Monthly email to confirmed buyers (no more than once a month, with unsubscribe) | email, language and country, city, whether an AI agent is connected, date of the last search | our legitimate interest, balanced against your rights; you may object |
4. How we use AI
- AI models read the text and photo of a request to choose the category, ask clarifying questions and search for prices; they also check requests, offers, photos and chat messages for contacts, fraud and prohibited content, and guess from a first name how to address you.
- We send the AI providers the text and photos needed for the task, without your account name, e-mail or phone. The models are reached through OpenRouter under API terms; we do not sell this data and do not use it for advertising.
- If the check finds contacts or prohibited content, a request or offer is held automatically: you see the reason and can edit it. If you disagree, write to us and a person will review it. We make no automated decisions with legal effects on you.
5. Who receives the data
We do not sell personal data. We pass it only to these recipients, each for its own task:
| Recipient | What for and what data | Country |
|---|---|---|
| HOSTLIFE (hostlife.net) | hosting of the site, the databases, uploaded files and our mail server (mail.blablaprice.com): all data of the service | servers in the Netherlands; provider in Estonia and Ukraine |
| Google LLC (Google Drive) | storage of our encrypted backups (databases, uploaded files, site settings). Each copy is encrypted on our server (AES-256) before it is sent; Google does not have the key and cannot read the content | USA; Google's servers may also be in other countries, including outside the EEA |
| Google LLC (Google Sign-In) | sign-in: Google sends us your name, e-mail, photo and Google ID | USA |
| Google LLC (Google Analytics 4) | visit statistics: pseudonymous browser ID, pages, events, device, approximate location derived from the IP address | USA |
| Google LLC (Google Fonts) | the site's typeface is loaded from Google, which receives your IP address and browser data | USA |
| Microsoft Corporation (Microsoft Clarity) | behaviour analytics: clicks, scrolling, session recordings with typed text hidden | USA |
| OpenRouter, Inc. | passes AI tasks to the model providers: request text and photos, offers, chat messages, first names | USA |
| AI model providers through OpenRouter: Anthropic PBC (Claude), Google LLC (Gemini), Perplexity AI, Inc. (Sonar) and the provider of any other model we choose for a task | the same data as OpenRouter, for the single task | USA |
| Telegram (Telegram FZ-LLC) | only if you connect our Telegram bot: your Telegram ID and the notifications we send you | United Arab Emirates |
| The push service of your browser (Google, Apple, Mozilla or Microsoft) | only if you allow notifications: a technical subscription address and the notification text | depends on your browser, mostly the USA |
| Other users of the service | see section 6 | depends on the provider |
| The provider of the AI assistant you connect yourself (for example OpenAI, Anthropic) | what the agent's tools return, see section 10 | the provider's country, mostly the USA |
| Courts and authorities | only when the law obliges us, in the scope it requires | depends on the provider |
If the business is ever sold or merged, the data passes to the new owner, who must keep to this policy.
6. What other users see
- Sellers of the matching categories see the text of a request, the city, the budget and the photo, but not the buyer's contacts.
- Companies found on the internet for a request may be shown the text of the request, without your name and contacts.
- A company you invite yourself sees the request text and your first name on the invitation page. The invitation itself is sent by you from your own phone or mailbox, so the company sees your number or address as in any message.
- Phone and e-mail are passed only after both sides agree to exchange contacts, and only to that counterpart.
- Reviews and the public profile of a seller are visible to everyone.
7. Where the data is stored and transferred
- We are a company from Ukraine. Our servers and databases are in the Netherlands (European Union). From there, data reaches the recipients in section 5, mostly in the USA.
- Encrypted backups are also kept outside the hosting: in Google Drive (Google LLC, whose servers may be outside the European Economic Area) and on a protected company computer in Ukraine. Each copy is encrypted with AES-256 on our server before it leaves it, and only we hold the key. For Google Drive this encryption is the protection: Google does not have the key and cannot read the contents of the copies.
- We rely on the providers' data processing terms and, where they offer them, on the European Commission's standard contractual clauses. The USA has no single federal privacy law; data there may be accessible to US authorities under US law.
- Where your country's law asks for it, the transfer is described in more detail in section 14.
8. How long we keep data
- Account: while it exists. When you delete your account in the settings, we erase your name, e-mail, phone, photo, address, contacts, Telegram and sign-in data at once; the record remains as «Deleted user» so the other side keeps the history of finished deals and reviews.
- Requests and offers: deleted 30 days after the request's deadline. If contacts were exchanged, the request and the accepted offers remain (they carry the reviews), their photos are removed and the other offers are deleted.
- A request sent before the e-mail address is confirmed: kept together with that address for up to 72 hours. During this time we may send 2 reminders to that address asking to confirm it. If the address is not confirmed, the request, its photos and the address are deleted; only anonymous counts remain.
- The assistant's conversation about a request and the personal chats: deleted together with the request.
- Uploaded files that are no longer used: moved to a closed trash after 2 days and deleted after another 30 days.
- AI usage records: we keep the cost figures; the buyer's text is removed when the request is deleted.
- Public business contacts: until the company objects or asks us to delete them.
- Server logs (IP, browser, address of the page): up to 12 months.
- Backups: the nightly encrypted backups are kept for up to 7 days (at most the 5 most recent copies in each place, older ones are deleted automatically); separate database copies made before maintenance work are kept for up to 6 months. A deleted account and deleted requests stay for up to 7 more days in the nightly encrypted backups and for up to 6 months in the copies made before maintenance work, and then they are gone from there too.
- Google Analytics: event-level data 2 months, user-level data 14 months (our property settings); the _ga cookies up to 2 years.
- Microsoft Clarity: recordings 30 days, aggregated statistics up to 13 months (Microsoft's settings).
- Your cookie choice: 6 months, then we ask again.
- Payment records, once payments open: as long as tax law requires (in Ukraine generally 3 years).
- Correspondence with support: in our mailbox until you ask us to delete it, unless we need it to settle a dispute.
9. Cookies and analytics
In United States analytics is on by default, as the law allows. You can switch it off at any time in the cookie settings.
- Visitors whose IP address belongs to the European Economic Area, the United Kingdom or Switzerland are asked for consent first, whichever country version of the site they open.
- If your browser sends the Global Privacy Control signal, we treat it as switching analytics off.
- We use Google Consent Mode v2: until consent, analytics storage is «denied»; advertising storage and advertising personalisation are always «denied», because we do not run advertising.
- The site's own statistics: we count page views and button clicks ourselves as daily totals (site country, page type, device type). No cookies, no browser storage, no IP address and none of the text you type, so no single visitor can be seen in it; the data is not shared with anyone and is kept for 13 months, which is why it needs no consent.
| Cookie | Kind | What for | Lifetime |
|---|---|---|---|
bbp_sid | necessary | session, sign-in | until the browser is closed |
_csrf-frontend | necessary | protection of forms against forgery | until the browser is closed |
bbp_idraft | necessary | the key of a seller's answer to an invitation saved before sign-in (/i/), strictly necessary | up to 1 year |
bbp_cc, language, bbp_wall, bbp_glass, filter, bbp_pick, bbp_tg, bbp_lead, bbp_preview | necessary | remembered country, language, wallpaper, theme, filters and other display choices | up to 1 year |
bbp_consent | necessary | your cookie choice | 6 months |
_ga, _ga_* | analytics | Google Analytics: tells visits of the same browser apart | 2 years |
_clck | behaviour analytics | Microsoft Clarity: browser ID and session | 1 year |
_clsk | behaviour analytics | Microsoft Clarity: browser ID and session | 1 day |
CLID, MUID, MR, SM, ANONCHK | behaviour analytics | Microsoft: technical IDs of Clarity | up to 1 year |
Change your choice at any time: Cookie settings.
10. AI agents, API and MCP
- You can connect your own AI assistant (for example Claude, ChatGPT, or an agent you built) to BlaBlaPrice through our API or MCP server, with a key or connection you create yourself.
- The agent sees only what you could see in your own account: requests in your categories (without the buyer's contacts until the exchange), your offers, the messages of your chats, and the counterpart's contacts after the exchange. It cannot see other people's accounts.
- Everything the agent's tools return is passed to the provider of that assistant. That provider is a separate controller and handles the data under its own terms; we do not control it. You choose the assistant and are responsible for what you allow it to do.
- We are responsible for the platform side: what the tools return, keeping it within your account, and logging the agent's actions. A key works for one account in one country version. You can delete it at any time in your account (section «Agent»); to cut off a connected assistant completely, remove the connection in that assistant too.
- If a key leaks or an agent receives someone else's data, we handle it as a security incident (section 12).
11. Your rights and how to use them
Under the applicable laws of the United States and of your state you have the right to:
- know what data we hold about you and get a copy
- have wrong data corrected (most of it you can change yourself in the settings)
- have your data deleted (you can delete the account yourself in the settings)
- object to processing based on our legitimate interest, including analytics and the use of public business contacts
- withdraw consent at any time, without affecting what was done before
- receive the data you gave us in a machine-readable format
- ask us to limit processing while a dispute is checked
- complain to the supervisory authority: the Federal Trade Commission or the attorney general (or privacy agency) of your state (reportfraud.ftc.gov)
Write to privacy@blablaprice.com, preferably from the e-mail of your account, so we can see it is you; we do not ask for identity documents for this. If you use several country versions of BlaBlaPrice, say so: we check all of them. We answer within 45 days.
A company or sole trader whose public contacts we found can object at any time or refuse invitations by writing to privacy@blablaprice.com: we add the contacts to a list for which invitations are not offered, or delete them.
12. Security and incidents
- The site works over HTTPS only; access to servers and databases is limited to the people who need it; each country version has its own database; requests and offers are checked for contacts before others see them; pages of signed-in people are excluded from Clarity recordings.
- No system is completely safe. If an incident affects your data, we record it, assess the risk and notify the authority and you where the law of your country requires it.
13. Children
The service is not intended for children under 16. We do not knowingly collect their data; if you think a child has given us data, write to us and we will delete it.
14. Additional rules for United States
- We do not sell personal information and do not share it for cross-context behavioral advertising. We use no advertising cookies; Google Signals and advertising features in Google Analytics are off.
- If your browser sends the Global Privacy Control signal, we treat it as an opt-out of analytics.
- Where a state privacy law gives you rights (for example to know, access, correct or delete your data, or to opt out), send your request to privacy@blablaprice.com; an authorised agent may act for you with your written permission. We answer within 45 days and will not treat you differently for using your rights.
- The service is not directed to children under 13, and we do not knowingly collect their data.
15. Changes, language and contact
- We may update this policy. The date of the edition is at the top; for significant changes we will show a notice on the site.
- This version is written in English for United States. If a translation differs, the version in the language of your country applies.
- Questions: privacy@blablaprice.com, EVERLOGIC LLC, 48 Lva Halytskoho St., Staryi Sambir, Lviv Oblast, 82001, Ukraine.
Policies of the other countries:India · Казахстан · الكويت · قطر · United Arab Emirates · Україна · South Africa · Philippines · México · Pakistan · Colombia · Malaysia · Hong Kong · Canada · Australia · New Zealand · Singapore · República Dominicana · Argentina · Panamá · Chile · 日本 · ישראל · 대한민국 · საქართველო · 台灣 · Schweiz