Privacy Policy

Effective Date: 22 May 2026  ·  Blend Technologies Ltd (United Kingdom)

Blend Technologies is committed to protecting your privacy. This policy applies to all users of our Services globally, including in the United Kingdom, the European Union, and the United States.

1. Who We Are

Blend Technologies LTD is a company registered in England and Wales (company number 17236631), with its registered office at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. We are registered with the UK Information Commissioner's Office (ICO) under registration number ZC236476.

For UK and EU data protection purposes, Blend Technologies is the Data Controller in respect of client (business user) data and website data, and a Data Processor in respect of end-user data collected through client quizzes, in that case the client operating the quiz is the Data Controller.

Data protection contact. All data protection queries, including requests to exercise your rights, complaints, or questions about this policy, should be directed to contact@blend-technologies.com.

2. Information We Collect

From Clients (Business Users)

  • Name and email address;
  • Company information;
  • Billing information (processed by Stripe, we do not store full payment card details);
  • Account and usage data.

From End Users (via Client Quizzes)

We collect information only when voluntarily provided by the user, which may include:

  • Name and email address (if provided);
  • Health-related information (e.g. goals, symptoms, dietary preferences, conditions), if explicitly submitted;
  • Demographic data (e.g. age, gender), if provided.

Users are not required to provide personal or sensitive data to use the quiz. All data is submitted at the sole discretion of the user.

3. Special Category (Health) Data

Some quizzes involve health-related information, age, sex, height, weight, diet preferences, lifestyle factors, diagnosed medical conditions, current medications, and pregnancy or breastfeeding status. This is special category data under UK/EU GDPR Article 9 and sensitive personal information under certain US state laws. We process it for two distinct purposes, each with its own lawful basis.

Primary purpose: your personalised recommendations

  • Lawful basis: GDPR Article 9(2)(a), your explicit consent, captured by the brand partner whose quiz you completed.
  • What we do: generate your personalised supplement recommendations and nutrient analysis.
  • Retention: your submission and the recommendations generated from it are stored for up to 12 months, then automatically deleted (see section 9). You can ask for earlier deletion at any time. The brand partner (data controller) may also retain your results in their own system, subject to their privacy notice.

Secondary purpose: service quality and algorithm improvement

Not currently active. We are not creating pseudonymised records today. This section describes the safeguards that will apply if and when we do, and we will update this policy before that happens.
  • Lawful basis: GDPR Article 6(1)(f) legitimate interests (service accuracy and safety) + Article 9(2)(j) statistical purposes with Article 89(1) safeguards.
  • What we do: (i) debugging, investigate user-reported errors, reproduce failures, and validate contraindication alerts; (ii) aggregated statistical analysis, compute non-identifying metrics (error rates, correlation studies) to improve recommendation accuracy.
  • Retention: individual pseudonymised records are kept for up to 90 days, then automatically deleted. Aggregated statistics with no individual records may be retained for up to 2 years for ongoing validation.

Article 89(1) safeguards (for the secondary purpose)

  • De-identification: name, email and IP address are removed; the submission reference is replaced by a one-way cryptographic hash. The data remains personal data in pseudonymised form.
  • Minimisation: only attributes necessary for debugging and statistical analysis are retained.
  • Access restriction: pseudonymised logs are accessible only to Blend Technologies engineering and QA personnel under role-based access; no marketing, sales, or third-party access.
  • No cross-brand sharing: one brand partner's data is never used to generate recommendations for, or accessible to, another brand partner.
  • Security: encryption at rest and in transit; access logs.
  • No automated decisions about you (Article 22): pseudonymised records are used only for aggregate analysis and manual debugging, never to make automated decisions about individuals.

Your rights in respect of health data

  • Right to object (Article 21): you may object to the secondary processing at any time by contacting us at contact@blend-technologies.com. We will functionally delete your pseudonymised record within 5 business days. Objection does not affect your access to your recommendations.
  • Right to withdraw consent (Article 7): you may withdraw consent to the primary processing at any time. Withdrawal does not affect processing already carried out lawfully.
  • Right to erasure (Article 17): request deletion of your pseudonymised records at any time; we will functionally delete them within 5 business days.
  • Other rights: access (Art. 15), rectification (Art. 16), restriction (Art. 18), portability (Art. 20). Contact us to exercise any of these.

4. How We Use Data

We use collected data to:

  • operate and maintain the platform;
  • generate personalised recommendations on behalf of clients;
  • provide analytics and insights to clients (in anonymised or aggregated form only);
  • improve our algorithms and services, using pseudonymised quiz records (90-day retention) and aggregated statistics, as described in section 3 above;
  • comply with legal obligations;
  • enforce our Terms of Service.

We do not sell personal data. We do not use personal data for automated decision-making that produces significant legal or similarly significant effects on individuals without appropriate human oversight.

We process personal data on the following legal bases:

  • Consent, for special category health data (Article 9(2)(a) GDPR), and for marketing communications;
  • Contractual necessity, to provide services to clients (Article 6(1)(b));
  • Legal obligation, where required by applicable law (Article 6(1)(c));
  • Legitimate interests, to operate, improve, and secure the platform, where such interests are not overridden by the rights of data subjects (Article 6(1)(f)).

Where we rely on legitimate interests, those interests are: securing and maintaining the platform; preventing fraud and abuse; improving our algorithms and services using anonymised and aggregated data; and managing our business relationships with clients. A Legitimate Interest Assessment balancing these interests against the rights and freedoms of data subjects is maintained internally and is available on request. We do not rely on legitimate interests to process special category health data.

6. US Privacy Rights (CCPA/CPRA and other state laws)

For residents of California and other US states with applicable privacy laws:

  • You have the right to know what personal information we collect, use, disclose, and sell;
  • We do not sell personal information;
  • We do not share personal information for cross-context behavioral advertising;
  • You have the right to request deletion of your personal information;
  • You have the right to opt out of the sale or sharing of personal information (not applicable as we do not sell or share);
  • You have the right to non-discrimination for exercising your privacy rights;
  • California residents may submit requests via contact@blend-technologies.com. We will respond within 45 days as required by law.

For residents of Virginia, Colorado, Connecticut, Texas, and other states with applicable privacy legislation, equivalent rights apply to the extent required by applicable law.

7. Data Sharing and Sub-Processors

Data may be shared with:

  • the client who owns the quiz (for end-user data collected through that client's quiz);
  • sub-processors acting on our behalf under written data processing agreements (listed below);
  • law enforcement or regulatory authorities where required by law.

We currently engage a small set of sub-processors for hosting, database, payment, and transactional email. Each is bound by a written data processing agreement. For the complete list including data categories, regions, and transfer mechanisms, updated whenever we add or change a sub-processor, see our Sub-Processors page.

We do not sell personal data to third parties.

7A. Shopify Integration (for merchants using our Shopify app)

Merchants who install our Shopify app grant Blend Technologies access to their Shopify store data for the limited purpose of conversion funnel analytics displayed in the merchant's Blend dashboard. We use this data to show the merchant how many quiz completions resulted in product views, cart additions, and completed purchases.

What Shopify data we access

  • Products (read_products scope): product catalogue (titles, SKUs, inventory status) to match quiz recommendations against the merchant's live Shopify inventory.
  • Orders (read_orders scope): order metadata (order ID, timestamp, line items, cart abandonment events) to attribute purchases back to quiz submissions and calculate conversion rates.

What Shopify data we do NOT access

We explicitly do not request protected customer fields: no customer name, email, phone number, or shipping address. Order data is used only to count funnel steps (quiz → view → cart → purchase) and is stored in aggregate form. Individual order records are retained for up to 90 days for analytics accuracy, then deleted or aggregated into anonymised statistics.

Legal basis

  • For the merchant (data controller of their Shopify data): Contractual necessity (GDPR Article 6(1)(b)), the analytics feature is part of the service the merchant purchased.
  • For end-customers whose orders appear in the merchant's Shopify store: Blend Technologies processes this data as a processor on behalf of the merchant (data controller). The merchant's own Shopify privacy policy (not Blend's) governs their collection and sharing of customer order data with apps. Blend does not use Shopify customer data for any purpose other than the merchant's conversion analytics.

Data sharing and storage

Shopify order data is stored in Blend's database (Supabase, EU region eu-west-1) under row-level security scoped to the merchant's account. Order metadata is NOT shared with other merchants or third parties. It is NOT used to personalise quiz recommendations (recommendations are based solely on the end-user's quiz answers, not their purchase history).

Merchant and customer rights

  • Merchants: You may revoke Blend's access to your Shopify data at any time by uninstalling the app. We will delete your Shopify order data within 30 days of receiving the shop/redact webhook from Shopify (GDPR compliance webhook, triggered 48 hours after uninstall).
  • End-customers: If you are a customer of a merchant using our Shopify app and wish to exercise data subject rights (access, deletion, objection) regarding your order data, contact the merchant directly (they are the data controller). If the merchant forwards a customers/redact request to us (GDPR compliance webhook), we delete all records matching that customer ID within 30 days.

For Shopify's own data handling practices, see Shopify's Privacy Policy.

8. International Data Transfers

Blend Technologies is based in the United Kingdom. Our core processing infrastructure is located in the European Union (Vercel Frankfurt, Render Frankfurt, Supabase Ireland). This means end-user quiz data, including special-category health data, is processed and stored in the EU.

A small number of ancillary sub-processors (see the Sub-Processors page) are US-based: Stripe (merchant billing) and Resend (transactional email). For these, personal data may be transferred to the US, and we put appropriate safeguards in place:

  • the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, for transfers from the UK;
  • the EU Standard Contractual Clauses (Commission Implementing Decision 2021/914) for transfers from the EEA;
  • the EU-US Data Privacy Framework, and its UK Extension, where the receiving sub-processor is certified under it (Stripe and Resend, at the time of writing);
  • a transfer risk assessment supporting the chosen mechanism.

The mechanism applicable to each sub-processor is recorded on the Sub-Processors page and, for end-user quiz data, in the Data Processing Agreement between Blend Technologies and the relevant client. Details are available on request.

9. Data Retention

We retain personal data only for as long as necessary for the purposes set out in this policy:

  • Client account data: retained for the duration of the contract and deleted within 90 days of account termination, unless retention is required for legal or regulatory purposes;
  • End-user quiz data: retained for 12 months from submission, then automatically deleted by a scheduled database function (migration 0039). Audit trail of deletions is kept for 7 years. Users may request earlier deletion at any time via contact@blend-technologies.com (processed within 5 business days).
  • Pseudonymised quiz logs (for debugging and statistical improvement under section 3 above; not currently active): if enabled, retained for up to 90 days from submission, then auto-deleted; aggregated statistics (no individual records) may be retained for up to 2 years;
  • Billing records: retained for 7 years in accordance with UK financial record-keeping requirements;
  • Marketing and CRM data (business contacts and prospects): retained while there is an active or prospective business relationship, and deleted or anonymised within 24 months of the last meaningful contact, or sooner on request;
  • Server and application logs (which may contain pseudonymous identifiers): retained in line with our hosting provider's standard log retention period and not exported to third parties;
  • Anonymised and aggregated data: may be retained indefinitely as it no longer constitutes personal data.

10. User Rights

Under UK/EU GDPR and applicable US state laws, you may have the right to:

  • Access your personal data;
  • Correct inaccurate data;
  • Request deletion of your data ("right to be forgotten");
  • Restrict or object to processing;
  • Data portability (receive your data in a structured, machine-readable format);
  • Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
  • Lodge a complaint with a supervisory authority (in the UK: the ICO at ico.org.uk; in the EU: your national data protection authority).

Requests should be sent to contact@blend-technologies.com. We will respond within 30 days (or 45 days for CCPA requests).

11. Automated Decision-Making and Your Right to Human Review

Our platform uses automated decision-making to generate personalised supplement recommendations. When you complete a quiz, your answers (including health data such as conditions, medications, and symptoms) are processed by our algorithm, which scores each supplement in the brand's catalogue and returns a ranked recommendation list with suggested dosages.

How the algorithm works (in plain language)

The recommendation logic considers:

  • Your nutrient targets, computed from your age, gender, weight, height, activity level, and diet;
  • Your health profile: diagnosed conditions, current medications, pregnancy or breastfeeding status, and symptoms you reported;
  • Safety checks: contraindications for pregnancy or breastfeeding, upper-limit ceilings for each nutrient, and medication interactions where documented;
  • The brand's product catalogue: ingredient profiles, dosages, and supplement forms.

For each recommendation you receive, you can view a plain-language breakdown of why each supplement was suggested by clicking "Why this recommendation?" on your results page. This shows the nutrient gaps identified in your profile and the safety checks applied to your specific answers.

For merchants and researchers: a detailed methodology report describing the algorithm's inputs, scoring approach, safety gates, and validation is available on written request to contact@blend-technologies.com. The underlying algorithm itself is proprietary and not published.

Your right to human review (GDPR Article 22)

You have the right to:

  • Obtain human intervention: request that a qualified person (nutritionist, pharmacist, or trained reviewer employed by the brand whose quiz you completed) review your recommendation before you act on it;
  • Express your point of view: submit questions or concerns about the recommendation (e.g. "I'm already taking supplement X, does this overlap?" or "This dosage seems high, why?");
  • Contest the decision: challenge a specific recommendation you believe is incorrect or unsafe.

How to request human review

If you receive a recommendation and want it reviewed by a human before acting on it:

  1. Click the "Request human review" link at the bottom of your results page, or email the brand whose quiz you completed (their contact details are shown on your results page).
  2. A qualified reviewer will contact you within 48 hours (or the timeframe stated by the brand) to discuss your recommendation, answer questions, and make adjustments if necessary.
  3. The review is free and does not require you to purchase anything.

No legal or binding effects

Our recommendations are not medical advice and do not constitute a diagnosis, prescription, or treatment plan. They do not have legal effects (they do not determine your eligibility for services, insurance, or employment). However, we recognise that supplement recommendations based on health data may significantly affect your well-being, which is why we provide the human review option above.

Always consult a qualified healthcare professional (doctor, pharmacist, or dietitian) before starting any new supplement, especially if you are pregnant, breastfeeding, taking medication, or have a diagnosed medical condition.

12. Cookies

Our website uses a small number of cookies and similar technologies:

  • Essential cookies, required for the site to function and to remember your cookie preference. These do not require consent.
  • Demo booking (Calendly), if you accept, we load Calendly's scheduling widget so you can book a demo. Calendly sets its own cookies, governed by Calendly's privacy notice. This is loaded only with your consent.

We do not use advertising or analytics tracking cookies on this website. When you first visit, a cookie banner lets you accept or reject non-essential cookies, and the site works either way. You can change your choice at any time using the “Cookie settings” link in the footer.

13. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or destruction, in accordance with Article 32 GDPR. These include:

  • Encryption in transit: TLS 1.3 for all API requests, webhooks, and web traffic;
  • Encryption at rest: AES-256 encryption for all data stored in Supabase (our primary database, hosted in EU region eu-west-1);
  • Access controls: Role-based access (RBAC) for staff; row-level security (RLS) policies in the database scoped to tenant IDs;
  • Audit logging: All data access, deletions, and consent changes are logged with timestamps and user IDs in an immutable audit trail (retained for 7 years);
  • Secure credential storage: API keys, Shopify tokens and OAuth secrets are encrypted with AES-256-GCM and stored in environment variables or a secrets manager, never in code or version control.

No system is completely secure, and we cannot guarantee absolute security. If you become aware of a security vulnerability, report it immediately to contact@blend-technologies.com.

14. Children

Our Services are intended only for individuals aged 18 or over. Client quizzes must include an age-confirmation step, and the platform is not designed to collect personal data from anyone under 18. We do not knowingly collect personal data from minors. If you believe a person under 18 has provided data through our platform, contact us immediately at contact@blend-technologies.com and we will delete it.

15. Contact and Complaints

For privacy-related queries or to exercise your rights: contact@blend-technologies.com

UK residents may also contact the ICO: ico.org.uk  /  0303 123 1113