Privacy Policy

1. Who we are

Blabba (blabba.app) is run by Granite Digital, a business based in Jersey, Channel Islands. Granite Digital is the controller of the personal data described here, under the Data Protection (Jersey) Law 2018. We are registered with the Jersey Office of the Information Commissioner under number 102809.

For anything about your data, including the rights in section 7, email hello@blabba.app. We are a small business and haven’t appointed a data protection officer; your email comes to the person responsible.

2. What we collect, why, and on what basis

The law requires a legal basis for each use of personal data. The ones we rely on are from Schedule 2 of the Data Protection (Jersey) Law 2018: contract (we need it to provide something you asked for), legitimate interests (explained beside each one), legal obligation, and consent for Google Analytics only, which you can withdraw at any time. Where we rely on legitimate interests, you can object (section 7).

Visiting any page

Our hosting provider, Google Cloud, records each request to the website: your IP address, browser and device type, the page, and the time. We use these logs to keep the site running and secure, to investigate abuse, and to enforce blocks under our Terms. Basis: legitimate interests. A website can’t run or be defended without knowing what is asking it for pages; the logs are kept briefly, not used to profile anyone, and not combined with anything else unless we are investigating misuse.

Google Analytics (only if you allow it)

When you first visit, we ask whether we may use Google Analytics. If you say no, or don’t answer, it isn’t loaded at all and nothing is sent to it. If you say yes, it sets cookies (section 3) and records which pages you visit, how you arrived, how long you stay, what you click to leave, your device, browser and screen size, and your rough location (country and city), worked out from your IP address. Google says Analytics doesn’t store IP addresses. It does not receive anything you write, your blabbas or your account details, and we have turned off Google’s advertising features and its linking of data to Google accounts. We use the reports, which show totals rather than individuals, to find out what people use and what to improve. Basis: consent. We ask again after twelve months. You can change your mind at any time, here:

Making films, with no account

Nothing you write, design or export is sent to us. Drafts, saved characters, voice audio and finished films stay on your device (section 3). To speak, the studio downloads its voice models once, straight from Hugging Face, and the mobile editor also loads part of its voice engine from jsDelivr. Like any website, they see your IP address when your browser fetches from them; they don’t receive anything you write.

Agreeing to the Terms

Your browser remembers which version of the Terms you agreed to and when. If you’re signed in, we also record that against your account (the version, the date, and whether it was in the studio or on the sign-in page). Basis: contract, and legitimate interests in being able to show what was agreed.

Making an account

Your name, email address and, if you sign in with Google, your profile picture, plus an account ID and when you signed up and last signed in. Accounts are handled by Google’s Firebase Authentication. If you use a password, it is stored by Firebase in a form nobody can read, including us. Basis: contract.

Saving blabbas to your account

The blabbas you save: titles, scripts, cast and settings, and their version history. Only you can read them through Blabba. We can see them with our administration tools and only look when we need to: to fix a problem you’ve asked us about, to investigate a report under our Terms, or when the law requires it. Basis: contract.

Voice engine diagnostics (signed-in users only)

Voices are generated on your device, and devices differ a lot. When you’re signed in, the studio records which voice engine your browser settled on and how fast it ran, with your browser’s user agent, platform, number of processor cores, approximate memory and screen size, under a random ID for that browser. Basis: legitimate interests. When someone tells us the voices are slow or broken, this is how we can see why without asking them to run tests. It contains nothing you wrote, and you can object to it (section 7).

Paid exports

What you bought and when, Paddle’s reference for the payment, which versions of a blabba it licenses, and your plan. Each paid export also creates a public licence record, so anyone holding the reference can check it: it shows the tier, the blabba’s title, a fingerprint of the film and the date, and nothing about you.

Payments are taken by Paddle (Paddle.com Market Limited), our reseller and the Merchant of Record for every order. At checkout you give Paddle your email address, country and payment details; we never see your card details. We pass Paddle your account email so it is filled in for you, and a reference to your account and the blabba you are paying for, so the payment can be matched to the export. Basis: contract, and legal obligation for keeping financial records (Schedule 2, Part 2, paragraph 7).

Reports and enforcement

If you report a film, we keep your email and what you sent. If we block someone under our Terms, we keep what we need to make the block work: account IDs, email addresses and IP addresses. Basis: legitimate interests in keeping Blabba from being used to harm people. Where the law requires us to disclose information to the police, a court or a regulator, basis: legal obligation (Schedule 2, Part 2, paragraph 7).

Emailing us

Your email address and whatever you write, to answer you. Basis: legitimate interests in replying, or contract if it’s about your account.

You never have to give us anything to make or export films. An account needs an email address; without one we can’t create it.

3. What Blabba keeps on your device

The only cookies on blabba.app are Google Analytics’ own, and only if you allow them:

Saying no, or withdrawing later, deletes them. No advertising cookies are ever set.

Blabba also stores these things in your browser’s own storage so the studio works. They stay on your device and aren’t sent to us, except where you’re signed in and save, as described above. Clearing your browser’s data for blabba.app removes them, along with any unsaved drafts.

4. Who else is involved

• Google (Google Cloud and Firebase) hosts the website, the sign-in service and the database, as our processor: it handles the data on our instructions and under its data processing terms.
• Google Analytics, run by Google, if you allow it. Google processes the data on our behalf under its data processing terms for Analytics.
• Hugging Face and jsDelivr serve the voice models and engine files your browser downloads directly. They receive the usual request details (IP address, browser) under their own privacy policies.
• Paddle (Paddle.com Market Limited, UK), if you buy anything. Paddle sells to you as the Merchant of Record, so it is a controller of your payment details in its own right, under the Paddle privacy notice.
• The police, courts and regulators, when the law requires it, or to protect someone from serious harm.
• Professional advisers, such as lawyers and accountants, when needed, under a duty of confidentiality.
• A new owner, if Blabba is ever sold, who would have to keep to this policy.

We never sell personal data, and never share it for advertising.

5. Where your data is kept

• Saved blabbas, account details and the records above are stored in Google’s database in the European Union (its multi-region “eur3”, in Belgium and the Netherlands). The website is served from the Netherlands.
• Sign-in is handled by Firebase Authentication, and Google Analytics (if you allow it) by Google, both of which Google runs globally, including in the United States. Google LLC is certified under the EU-US Data Privacy Framework, which the European Commission has found adequate, so the transfer is to a country with an adequate level of protection under Article 66 of the Data Protection (Jersey) Law 2018. Google’s data processing terms also include the European Commission’s standard contractual clauses.
• Hugging Face and jsDelivr may serve your browser from anywhere in the world; they receive only request details, not anything you write.
• Paddle is based in the United Kingdom, which Jersey treats as giving an adequate level of protection under Article 66. Where it processes payment details elsewhere, its own privacy notice says how.

6. How long we keep it

• Hosting logs: for Google Cloud’s standard log retention, about 30 days, unless they’re part of an abuse investigation.
• Google Analytics: the detailed records about individual visits for 2 months, then deleted by Google; the reports, which are totals, for as long as they’re useful. The cookies last up to 2 years in your browser unless you withdraw sooner.
• Your account and saved blabbas: until you delete them or ask us to close your account. Deleting a blabba removes it and its version history straight away; closing your account removes everything under it.
• Records of agreeing to the Terms: as long as your account exists, and afterwards only if needed for a dispute.
• Purchase records: for as long as tax and accounting rules require. Public licence records are kept for as long as Blabba runs, so a licence can always be checked; they contain nothing about you.
• Reports and block records: as long as the report is being dealt with, and block records for as long as the block is in force.
• Emails: as long as the conversation is useful, then deleted.

7. Your rights

Under the Data Protection (Jersey) Law 2018 you have the right to:

• get a copy of the personal data we hold about you;
• have it corrected if it’s wrong;
• have it deleted;
• have its use restricted while a concern is looked into;
• receive the data you gave us in a portable format;
• object to our using it on the basis of legitimate interests (for example, the voice diagnostics);
• object to direct marketing at any time (we don’t send any);
• withdraw your consent to Google Analytics at any time, with the switch in section 2. That stops it from then on; it doesn’t make earlier use unlawful.

Email hello@blabba.app. It’s free. We will respond within four weeks. If a request is complex we may extend that by up to eight more weeks, and if so we’ll tell you why within the first four. We may ask you to prove who you are before handing over or deleting anything. If we refuse a request we’ll say why, and tell you about your right to complain and to go to court.

8. Complaints

Please tell us first and we’ll try to put it right. You also have the right to complain to the data protection regulator in Jersey:

Jersey Office of the Information Commissioner
2nd Floor, 5 Castle Street, St Helier, Jersey JE2 3BT
+44 (0)1534 716530 · enquiries@jerseyoic.org · jerseyoic.org

If you live in the UK or the EU, you can also complain to your own regulator.

9. Automated decisions

We don’t make decisions about you by automated means. (Blabba’s auto camera chooses camera shots for your film. That’s about the film, not about you.)

10. Children

Blabba is for people aged 13 and over. If you believe a child under 13 has given us personal data, email hello@blabba.app and we’ll delete it.

11. Security

Everything is sent over encrypted connections. Our database rules only let each account read its own saves, and access to our administration tools is limited to us. If something goes wrong that puts your data at risk, we will tell the regulator and, where the risk is high, tell you.

12. Changes to this policy

If we change how we use personal data, we’ll update this page and the date at the top. If a change is significant, we’ll say so in the studio before it takes effect.