Privacy Policy

Last updated: October 6, 2026

This Privacy Policy explains how Blockema processes your personal data when you visit https://www.blockema.com or use our Excel and CSV data validation platform (the "Service").

1. Data Controller

Blockema
Carrer de Provença, 183, 08036 Barcelona, Spain
Email: hello@blockema.com

2. Data We Process, Purposes and Legal Bases

2.1 User account

• Data: name, email address, password (stored as a hash) or, if you sign in with Google, your Google account identifier and email.
• Purpose: to create and manage your account and provide the Service.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

This data is required to register; without it we cannot provide the Service.

2.2 Files and validation results

You can validate Excel and CSV files in two ways:

• Browser-based validation: the file is processed entirely in your browser tab. Its contents are never sent to our servers. The file and the result are saved in your browser's local storage, only on that device, until you discard the validation or clear your browser data.
• Server-based validation: the file is uploaded to our servers for processing and is deleted automatically as soon as processing finishes.

In both cases, if you are signed in, we store the file name and the validation results (the issues found in each row, which may include the values of the affected cells) in your history so you can review them later.

• Purpose: to provide the validation service you requested.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

If your files contain personal data of third parties, you act as controller of that data and Blockema acts as processor, processing it solely to provide the Service. We do not use the contents of your files to train models, for advertising or for any other purpose.

2.3 Subscription and payments

• Data: name, email address, plan, subscription status and transaction identifiers.
• Purpose: to manage your subscription and comply with accounting and tax obligations.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR).

Payments are handled by Polar.sh, which acts as reseller (Merchant of Record) and processes payment data as an independent controller under its own privacy policy. Blockema never receives or stores your full card details.

2.4 Contact form and error reports

• Data: name, email address and the content of your message. For error reports sent from the application, also technical error information (message and stack trace).
• Purpose: to answer your enquiry or resolve the issue.
• Legal basis: legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR) or, if you are a user, performance of a contract (Art. 6(1)(b) GDPR).

2.5 Emails

• Transactional (account verification, password reset, subscription notices): performance of a contract (Art. 6(1)(b) GDPR).
• Marketing: only with your consent (Art. 6(1)(a) GDPR) or, if you are a customer, about services similar to those you purchased (Art. 21(2) LSSI-CE). You can unsubscribe at any time.

2.6 Usage analytics

We use Umami, an analytics tool hosted on our own servers that does not use cookies or store anything on your device. It records, in aggregate, pages visited, referring URL, browser type, operating system, country, usage events within the Service and page-load performance metrics (Core Web Vitals). Your IP address is used only to derive your country and is not stored. It also records where people click and how far they scroll (heatmaps) and session replays, which reproduce your interaction with the Site and the Service, including what is displayed on screen. We do not identify you individually.

• Purpose: to understand how the Website is used and improve the Service.
• Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• How to object: if you turn on your browser's Do Not Track setting, Umami does not record your visit. You can also object by writing to hello@blockema.com.

2.7 Security and technical monitoring

• Data: IP address, server logs and application errors (error message and technical stack trace, page, browser and operating system), collected with Grafana tools hosted on our own servers. Nothing is stored on your device for this.
• Purpose: to keep the Service secure, prevent abuse and detect and fix errors.
• Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

3. Cookies and Local Storage

We do not use advertising, tracking or third-party cookies. We only use the following strictly necessary items, which are exempt from consent under Article 22.2 of the LSSI-CE:

• refreshToken (first-party cookie): keeps you securely signed in. Expires after 7 days or when you sign out.
• i18nextLng (local storage): remembers your language.
• Application preferences (local storage): remember your interface settings and cache account data so the application loads faster. Cleared when you sign out or clear your browser data.

You can delete these items through your browser settings, although some features of the Service, such as signing in, will stop working.

4. Recipients

We do not sell or share your data with third parties. We only disclose it to:

• Hetzner Online GmbH (Germany): server hosting in the European Union, as processor.
• Resend (United States): email delivery, as processor.
• Polar.sh (United States): payment processing, as independent controller.
• Google (United States): only if you choose to sign in with Google, as independent controller.
• Public authorities, where required by law.

Our processors have signed a data processing agreement with Blockema in accordance with Article 28 GDPR.

5. International Transfers

Our servers are hosted in the European Union. Resend, Polar.sh and Google may process data in the United States. These transfers rely on the EU-U.S. Data Privacy Framework or, failing that, on the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR). You may request a copy of these safeguards by writing to hello@blockema.com.

6. Retention Periods

• Account: while your account is active. When you delete it, your data, history and results are erased within 30 days.
• Files uploaded to the server: deleted as soon as processing finishes.
• Validation history and results: until you delete them or your account.
• Billing data: 6 years, as required by Article 30 of the Spanish Commercial Code.
• Contact messages and error reports: as long as needed to handle them and no longer than 12 months.
• Technical and error logs: up to 14 days.
• Analytics: aggregated Umami data does not identify you and may be kept indefinitely.

After these periods, data may be kept blocked for the limitation period of any potential legal liability.

7. Your Rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw any consent given, by writing to hello@blockema.com. We will reply within one month.

If you believe your data is not being processed lawfully, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) or the supervisory authority of your country of residence.

We do not make decisions based solely on automated processing that produce legal effects concerning you, and we do not carry out profiling.

8. Security

We apply appropriate technical and organizational measures to protect your data, including encryption in transit (TLS), encryption of stored email addresses, password hashing and restricted access to internal systems. No system is completely secure, but we review these measures regularly.

9. Children

The Service is intended for people aged 18 or over. We do not knowingly collect data from minors. If we find that a minor has registered, we will delete the account.

10. Changes to This Policy

We may update this Policy to reflect legal or Service changes. If the changes are significant, we will notify you by email or through a notice in the Service before they take effect.