We use cookies to improve BlockImagine. Details are in our privacy policy.

BlockImagine Goldenes isometrisches B mit schwebendem Würfel und dunklem BlockImagine-Schriftzug. Vektornachzeichnung des ursprünglichen Logos; alle Formen und Buchstaben sind Pfade.

Privacy policy

As of 23 October 2026. This is a translation; the German version is binding.

1. Controller

BlockImagine, owner Michael Sieminski, c/o IP-Management #3642, Ludwig-Erhard-Str. 18, 20459 Hamburg, Deutschland
Email: contact@blockimagine.com

2. What we process and why

  • Account and sign-in: your email address, sign-in links (stored only as a hash, valid for 15 minutes), sessions with IP address and browser identifier, and counters that limit sign-in attempts per IP address. If you sign in with Google, also your Google account ID, your name, the address of your profile picture and the sign-in tokens Google issues for it (section 3b). Purpose: signing you in and preventing abuse. Legal basis: Art. 6(1)(b) GDPR (contract) and (f) (legitimate interest in security).
  • Your descriptions and models: the texts and photos you enter (descriptions, changes, animation wishes, reference images) and the plans, models, textures and previews made from them. Purpose: creating, changing, showing and offering the models for download. Legal basis: Art. 6(1)(b) GDPR. Our administrators look at requests, reference images included, and their results to fix errors and improve the quality of the models. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a working service).
  • Plans, credits and purchases: your plan, your credit balance and every entry (deduction per job, refund, purchase). When you buy a plan or a credit pack, we receive from Stripe your customer and subscription identifiers, the plan or pack bought, the subscription's status and billing period, payment and invoice identifiers, the amount, currency and country of the purchase, and refunds and chargebacks. We do not receive your card or PayPal details. Purpose: adding and deducting credits, managing your subscription, issuing invoices, handling refunds. Legal basis: Art. 6(1)(b) GDPR, and (c) for keeping booking records (tax and commercial law obligations).
  • Cancellations: what you enter under "Cancel contracts here" (name, email address, contract, type, reason and timing of the cancellation) with the time it arrived; if you are signed in, also your account ID. Purpose: carrying out the cancellation, confirming it to you and proving it. Legal basis: Art. 6(1)(b) and (c) GDPR (section 312k German Civil Code). We keep it until the limitation period ends (three years from the end of the year).
  • Costs per job: for every job the AI models used, token counts, run times and costs, linked to your account but without your texts. Purpose: billing, cost control and usage limits. Legal basis: Art. 6(1)(b) and (f) GDPR.
  • Technical logs: when you use the app our host processes connection data such as IP address, time and requested address; error logs contain job identifiers but not your texts. Purpose: operation, debugging and security. Legal basis: Art. 6(1)(f) GDPR.
  • Usage analytics (only with your consent): which pages you open, what you click and which actions you take (such as "model created" or "folder created"), recordings of your session (mouse movements, clicks, scrolling, page content; text typed into form fields is masked), technical errors, browser console messages, load times, browser, device, screen size, approximate location from your IP address and a random identifier. When you are signed in, we link this data to your internal account ID, not to your email address. Purpose: understanding how the app is used, finding errors and improving the app. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Without consent there is no analytics; the app works the same.

3. Recipients and processors

  • Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA) runs the app, the database, file storage, the model builds and the sign-in emails for us, and forwards requests to the AI providers named below through Cloudflare AI Gateway without logging their content there. Database and file storage are in the EU jurisdiction; the app itself runs on Cloudflare's global network, so requests may also be processed outside the EU. This is covered by a data processing agreement with the EU Commission's standard contractual clauses (Art. 46 GDPR).
  • Anthropic, PBC (548 Market St, PMB 90375, San Francisco, CA 94104, USA) receives your descriptions, reference images, change and animation wishes and the models' plans, to design the models with its AI models (Claude). According to Anthropic, API inputs and outputs are not used for training and are usually deleted within 30 days; content flagged for usage policy violations may be kept longer. Transfers to the USA rely on standard contractual clauses (Art. 46 GDPR) in Anthropic's data processing agreement. Please do not enter other people's personal data in descriptions or photos, such as recognisable people.
  • We decide which AI model handles a job. Instead of Claude, it may be a model of one of the following providers; they then receive the same data as described above for Anthropic, to design the models. Requests reach them through Cloudflare AI Gateway. Please do not enter other people's personal data here either.
    • OpenAI Ireland Limited (1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland) with its AI models (GPT). According to OpenAI, API inputs and outputs are not used for training; they are kept for up to 30 days to detect abuse, longer only where the law requires it. We have OpenAI not store responses. Where OpenAI transfers data to affiliates or third parties outside the EEA, such as in the USA, this relies on standard contractual clauses or an adequacy decision (Art. 45, 46 GDPR).
    • Google Cloud EMEA Limited (70 Sir John Rogerson’s Quay, Dublin 2, Ireland) with its AI models (Gemini, paid Gemini API). According to Google, inputs and outputs are not used to improve Google's products; Google logs them for a limited period solely to detect violations of its usage policies and may cache them briefly in any country where Google or its agents maintain facilities. This is covered by Google's data processing agreement with standard contractual clauses (Art. 46 GDPR).
    • SpaceXAI LLC ("xAI", USA) with its AI models (Grok); representative in the EU: Lionheart Squared (Europe) Ltd, FAO x.ai, 2 Pembroke House, Upper Pembroke Street 28-32, Dublin, D02 EK84, Ireland. According to xAI, API inputs and outputs are not used for training without explicit permission and are stored encrypted for 30 days so abuse can be reviewed, then deleted automatically. Processing may take place in the USA; this is covered by xAI's data processing agreement with standard contractual clauses (Art. 46 GDPR).
  • PostHog, Inc. (2261 Market Street #4008, San Francisco, CA 94114, USA) runs the usage analytics for us, only if you have consented. The data is stored in PostHog's EU cloud (Frankfurt). Access from the USA cannot be ruled out; this is covered by a data processing agreement with the EU Commission's standard contractual clauses (Art. 46 GDPR).

3a. Payments through Stripe

Payments for plans and credit packs are processed for us by Stripe Payments Europe, Limited (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). When you click "Subscribe" or "Buy", we send you to Stripe's payment page and pass on your email address, your internal account ID and the plan or pack you chose (Art. 6(1)(b) GDPR). On the payment page you give Stripe your payment details (such as card or PayPal), your country and, where needed, your billing address; Stripe also processes technical data such as your IP address. Stripe uses this data as our processor for payment, invoices, tax calculation and the customer portal, and as an independent controller for fraud prevention and its own legal obligations. If you pay with PayPal, PayPal (Europe) S.à r.l. et Cie, S.C.A. (22–24 Boulevard Royal, 2449 Luxembourg) also processes your data as an independent controller. Stripe may transfer data to the USA; Stripe, Inc. is certified under the EU-US Data Privacy Framework (Art. 45 GDPR), with standard contractual clauses in addition (Art. 46 GDPR). Details are in Stripe's privacy policy.

3b. Sign-in with Google

Instead of a sign-in link, you can sign in with your Google account. When you click "Continue with Google", we send you to Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). There you sign in to Google and choose your account; Google processes your sign-in data and technical data such as your IP address as an independent controller. Google then sends us your email address, whether Google has confirmed it, your name, the address of your profile picture and an identifier of your Google account. We do not ask for access to any other data or services of your Google account. If the email address already belongs to an account with us, you are signed in to that account. Legal basis: Art. 6(1)(b) GDPR. Google may transfer data to the USA; Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Details are in Google's privacy policy.

4. Cookies and consent

Technically necessary and set without consent: a session cookie that keeps you signed in, one cookie each for your choice of language, light or dark display and the open or folded sidebar, and a cookie that stores your analytics choice (§ 25(2) no. 2 TDDDG). Only if you agree to usage analytics does PostHog also store a random identifier as a cookie and in your browser's local storage. Before that, no analytics data is collected or sent. We use no advertising cookies. We serve fonts ourselves; your browser does not connect to Google or other providers for them.

You can withdraw or give your consent at any time with effect for the future, using the button at the end of this page. This does not affect the lawfulness of processing before the withdrawal.

5. How long we keep data

We keep your account, descriptions, reference images and models as long as your account exists. You can delete single models yourself at any time; their descriptions, reference images and files are then removed from the app and our storage at once. Cloudflare's technical run logs of the model generation are deleted after their retention period. PostHog deletes session recordings after 30 days; we keep other analytics data as long as we use it to improve the app and delete it on request or with your account. On request we delete your account with all models; write to the address above. Cost records are kept for bookkeeping, after account deletion without a link to your email address. Credit entries and records of purchases and refunds are kept for the statutory periods (up to ten years, § 147 AO, § 257 HGB), after account deletion likewise without a link to your email address. How long Stripe keeps your payment data is set out in its privacy policy. Expired sessions and sign-in links are no longer used.

6. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can also complain to a data protection supervisory authority, for example the one where you live.

7. Required information

Without an email address you cannot sign in. Without a description we cannot create a model. There is no automated decision-making within the meaning of Art. 22 GDPR.