Blueprint StudioOpen Asset Generator

Privacy Policy

Last updated: 3 October 2026

Overview

Blueprint Studio (“we”, “us”, “our”) operates the Blueprint Studio web application, its REST API, and the Blueprint Studio MCP server, which connects AI apps such as ChatGPT, Claude, Claude Code, Codex and Cursor to your account. This policy describes how we collect, use, and protect your information when you use our services, including through an AI app.

Service Availability

Blueprint Studio is operated from and intended for use within the United States. By using our services, you acknowledge that your data will be processed and stored in the United States. We do not target or market our services to users outside the United States, and we make no representations that our services are appropriate or available for use in other jurisdictions.

Information We Collect

Account information. When you create an account, we collect your email address. You sign in with a one-time code sent to your email, not a password. If you sign in via a third-party provider (e.g., Google), we receive your name, email and profile photo from that provider.

Generated content. Images and assets you generate using our service are stored in your account. Prompts used for generation are stored alongside the generated assets. So are images you add, such as logos, product photos and reference images. For each image, we also keep a record of what was sent to the AI model and what came back, so we can charge credits correctly and look into problems.

Brand setup. When you ask us to set up a brand from a website, we read that public website’s name, colors, fonts and images, and save them in a draft for you to review.

Organization data. If you create or join a brand/organization, we store the brand name, member list (email, role), and brand settings (default style, prompt templates).

Connected AI apps. When you connect an AI app, we issue it OAuth access and refresh tokens. We store only hashes of these tokens, never the tokens themselves. We also store the app’s name and when it connected.

API keys. If you create API keys, we store a SHA-256 hash of the key, a display prefix, and usage metadata (daily request count). The full key is shown once at creation and never stored.

Payments. Stripe handles payments for paid plans. We store your Stripe customer and subscription IDs. We don’t see or store your full card number.

Usage data. We log API requests and AI app tool calls (endpoint or tool, timestamp, latency, status code, and the browser or app that made the request) for operational purposes. For web and API requests, we also store a keyed hash of your IP address, not the address itself. For a tool call, the log includes a redacted summary of its inputs: lengths, counts, settings and record IDs, never your prompt text. We also record each step of connecting an AI app, so we can fix sign-in problems.

Analytics. We collect analytics events (feature usage, errors) to improve the product, and count visits to our public pages ourselves (the page, where the visit came from and the kind of device, with a random ID in your browser and no IP address). Google Analytics and the Meta Pixel measure visits to our web pages. When you sign up, we may send Meta a hashed copy of your email address and account ID, with your IP address and browser details, to measure our ads.

AI Apps and the API

You can use Blueprint Studio from AI apps that support MCP, including ChatGPT, Claude (web, desktop and mobile), Claude Code, Codex and Cursor, or from your own code through our REST API. Here’s what an AI app can and cannot access:

  • What we receive: Only what the app sends when it uses one of our tools. That is the tool’s inputs, such as a prompt, a brand, Style or image ID, a website to read, or links to reference images, which we fetch. API requests work the same way.
  • What we do NOT receive: Your conversation with the AI app, files you attach to it, your local files or code, or anything else outside Blueprint Studio. We can’t read your chat history.
  • What we send back: The results you ask for, such as image links and previews, an image’s prompt and settings, brand and Style details, your credit balance, team members’ names and email addresses, and your account’s email and name. ChatGPT uses your email and name to show which account is connected. The AI app handles these results under its own privacy policy.
  • Authentication: OAuth 2.1 with PKCE. You approve each app on a Blueprint Studio screen. A connected app works with your whole account: your personal library and the brands you belong to, with your role in each brand. API keys can be limited to one brand or your personal library.
  • Disconnecting: You can disconnect an AI app at any time in Settings, under Connected apps. This revokes its tokens straight away. API keys and share links it created stay active until you revoke them.
  • Data flow: Tool calls go from the AI app to the Blueprint Studio API, and results go back to the app. To make an image, we send your prompt and any reference images to the AI model you chose. Data Sharing below lists everyone who handles your data.

How We Use Your Information

  • To provide and operate the service (generate assets, manage brands, etc.)
  • To authenticate your identity and authorize access
  • To enforce rate limits and usage quotas
  • To monitor and improve service reliability
  • To take payments for paid plans
  • To send transactional emails (sign-in codes, invitations)
  • To understand how the product is used, and to measure our ads

Data Storage and Security

Your data is stored on Supabase (hosted on AWS in the United States). Generated assets are stored in Supabase Storage. All data is encrypted in transit (TLS) and at rest. API keys and OAuth tokens are stored only as SHA-256 hashes. OAuth tokens use family-based rotation with automatic revocation on suspected token reuse. Image files are stored at long, hard-to-guess web addresses that open without signing in. They aren’t listed anywhere, but anyone who has an image’s address can open it.

Data Sharing

We do not sell your data, and we don’t use your prompts, images or brand files to train AI models. We use OpenAI’s, Google’s and Anthropic’s paid business APIs, which don’t use API data to train their models. We share data only with:

  • OpenAI, Google and Anthropic (AI models): Your prompt and any reference images go to the image model you choose (OpenAI GPT Image or Google Gemini). Images and website content for brand setup and Styles are analyzed by an AI model from Google, OpenAI or Anthropic. Google Gemini also suggests prompt ideas. Background removal uses fal.ai, below.
  • fal.ai (background removal): When you ask us to remove an image’s background (or for a transparent background a model can’t make itself), that image goes to fal.ai, which sends the cutout straight back without keeping it in its request history.
  • Stripe: Payments.
  • Resend: Our email provider. It sends sign-in codes, invitations and other transactional emails, so it receives your email address.
  • Supabase: Our database, storage and sign-in provider.
  • Netlify: Hosts our web app and API.
  • Upstash: Rate limits, and a short-lived copy (up to 24 hours) of images used in a request.
  • Google Analytics and Meta: Visit and ad measurement, as described above.
  • Telegram: Our team’s internal alerts (for example a new sign-up, feedback or an error), which can include your name, email address and brand name.
  • AI apps you connect: The results you ask for, as described above.
  • Your brand’s members: The images, Styles and files in that brand.
  • Anyone you give a share link to: A share link shows the image and its brand name. Your prompt stays hidden unless you choose to show it. You can turn a link off in Settings, under Shared links.

Data Retention

Your account data and generated assets are retained as long as your account is active. If you ask us to delete your account, we delete it and the data linked to it. OAuth tokens expire automatically (access tokens: 1 hour, refresh tokens: 30 days). Disconnecting an app revokes its tokens straight away.

Age Requirement

Blueprint Studio is intended for users who are at least 13 years old. If you are under 18, you need a parent or guardian’s permission to use it. We do not knowingly collect information from anyone under 13. If we learn that we have collected data from a user under 13, we will promptly delete their account and associated data.

Your Rights

  • Access: You can view all your data through the app and API.
  • Delete: You can delete images, Styles and brands in the app. To delete your account, email us from the address you sign in with.
  • Revoke access: You can disconnect AI apps and revoke API keys at any time in Settings.
  • Export: You can download your images in the app, or through the API or MCP tools.

Contact

For privacy questions or data requests, contact us at blueprint.dao@gmail.com.