Who we are
Holhjem Development AS, Sinsenveien 3a, 0572 Oslo, Norway, operates Blockquote. Contact hello@blockquote.com. We are the controller for our accounts, waitlist, support and service operations. Customers determine how personal data in their sites is used; we process that data on their instructions.
Data and purposes
We process names, email addresses, authentication information, permissions, customer content and uploads, form submissions, support messages, and technical records such as IP addresses, request logs and browser information. We use these to provide requested services, deliver content, manage accounts, answer enquiries and prevent abuse. Google login provides identity information for authentication.
Legal bases
We process account and service data to perform our agreement with you. Our legitimate interests in running a secure and reliable service support necessary security logging, abuse prevention and support. We rely on consent for waitlist updates and optional tracking where required, and on legal obligations for records required by law. You can withdraw consent by contacting us without affecting earlier lawful processing.
Google connections
With your authorization, we access selected Google resources and reports. These may include Analytics accounts, properties, streams and event reports; Search Console properties, performance, inspection and sitemaps; Tag Manager accounts, containers and versions; Ads and AdSense resources and reports; and Reader Revenue Manager publications. Additional permissions allow actions you request, including creating Analytics resources, verifying a website, submitting a sitemap and publishing a reviewed Tag Manager version.
Google storage and controls
We encrypt Google refresh tokens on the server and store connection details, granted scopes, selected resource identifiers and settings. Reports are requested when you use the feature rather than kept in a durable report cache. Current site administrators can use the shared connection and see resource names and reports. Disconnecting deletes the local connection and attempts Google revocation. You can also revoke access in your Google account. Revocation may affect other sites using the same grant. Disable separately configured website tags separately.
Limited Use
Our use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy, including its Limited Use requirements where applicable. We do not sell Google user data, use it for advertising targeting or train general-purpose AI models with it. Staff access is limited to consented support, security investigations, legal requirements or other uses permitted by that policy.
Cookies and tracking
We use cookies and browser storage for authentication, security, preferences and supported local drafts. Blockquote's own website does not use Google Analytics or advertising tracking in v1. Customer websites can optionally enable statistics and Google tags; this is separate from tracking on our own website. The bundled website gates Google tags on consent and relevant privacy signals. Website operators are responsible for visitor notices and consent settings. Google receives technical visitor information when its tags load.
Providers and transfers
Our application hosting and database are in a datacenter in Oslo, Norway. Amazon Web Services provides storage and email in the Ireland region, eu-west-1. Hosting and infrastructure providers process information needed to deliver and secure the service under our instructions. Google processes information when you choose Google login or connect a Google service. Authorized site administrators and members can access information according to their roles. We may disclose information where required by law or necessary to protect rights and investigate abuse. We do not sell personal data. Google and other international providers may process some information outside the European Economic Area. Where such transfers require safeguards, we use applicable adequacy decisions or standard contractual clauses, as appropriate. Contact hello@blockquote.com for information about recipients and applicable safeguards.
Retention and deletion
Unconfirmed waitlist entries are deleted after 30 days. Confirmed entries are kept until launch updates end, you withdraw consent, or 24 months pass without an affirmative interaction with us, whichever happens first. Routine request logs are retained for up to 30 days and security logs for up to 90 days. Following a verified account closure request, we delete the account and content we are instructed and authorized to remove from active systems within 30 days. Shared organization content may remain under that organization's control; we explain this when handling your request. Backup copies expire within 90 days after deletion from active systems and are isolated from ordinary use. If a backup is restored, deletion requests must be reapplied. Limited records may be retained longer to meet legal obligations or resolve active disputes. Request deletion or waitlist removal at hello@blockquote.com.
Customer content and saved version history remain while needed to provide the service, unless the customer deletes them or a configured form retention period expires. Billing and accounting records are kept for the legally required period. We retain the minimum email bounce or complaint suppression record needed to prevent further unwanted email, until it is validly cleared. Scoped legal holds may preserve relevant records for a dispute, investigation or legal obligation. Each hold has a documented reason and review date; access remains restricted, and ordinary use does not resume merely because the review date passes. Withdrawing waitlist consent stops further updates even if a record must be preserved under a hold.
Your rights
Subject to applicable law, you can request access, correction, deletion, restriction or a portable copy of personal data and object to processing based on legitimate interests. Contact hello@blockquote.com; we may verify your identity. For data controlled by a customer website, contact its operator first. You can complain to Datatilsynet, the Norwegian Data Protection Authority, or your local supervisory authority.
Age and AI
Blockquote accounts are for people aged 18 or older. We do not knowingly collect account information from children. Contact us if you believe a child has opened an account. V1 has no built-in AI service, and we do not automatically send customer content to an AI model. If you authorize an external AI agent, that agent can access information within its granted permissions and its provider applies its own privacy terms. Any future built-in AI feature will be explained before it is enabled.
Security and updates
We use access controls and technical safeguards, including encryption of Google refresh tokens. No system guarantees absolute security. Report privacy or security concerns to hello@blockquote.com, which is monitored by the operator. We will update this notice as practices change and communicate material changes where required.