Privacy Policy

1. Information we collect

We collect information you provide, such as your name, email address, business profile, project requirements, conversations, files, approvals, and support requests. We also collect service records needed to operate and secure the product, such as authentication events, browser and device details, IP address, feature usage, audit events, and error diagnostics.

Payment card and bank details entered in Stripe-hosted payment surfaces are handled by Stripe. The Block receives billing status, transaction identifiers, amounts, and other records needed to administer your subscription or funded work; it does not receive full card numbers from Stripe Checkout.

2. How we use information

We use information to authenticate users, provide and improve the workspace, scope and deliver requested work, process billing, maintain security and audit trails, provide support, and comply with legal obligations. The Block does not sell personal information or connected-provider data, or use connected-provider data for its own advertising.

The Block uses AI services for product features such as planning, research, chat, and approved implementation. Workspace inputs may be sent to an AI service provider when needed to fulfill a request. This includes AI decision services that classify and route requests, such as choosing a planning path, sizing a change, or checking which data a question needs; they receive only the text needed for that decision. The Block does not use proprietary workspace information or connected-provider data to train its own general-purpose models, and it does not authorize its AI service providers to use that data to train their general-purpose models.

3. Figma connection

The Figma connection is read-only. After you authorize it, The Block stores encrypted OAuth credentials and basic connection identity. It requests only the Figma files or frames whose links or keys you intentionally paste into The Block; it does not browse or index your Figma workspace.

For an item you choose to import, The Block reads the selected file or frame metadata and image content needed to show and store its preview in Design Assets. That selected preview may be used as reference for design or implementation work you request in The Block. Figma credentials and imported content are not used for advertising or model training, and The Block does not write to or publish into Figma.

4. Stripe account connection

The read-only Stripe connection is separate from paying The Block through Stripe Checkout. After you authorize it, The Block stores encrypted connection credentials and account identity, country, test-or-live mode, and whether charges and payouts are enabled.

A Stripe data sync reads the datasets you select: balance transactions, charges, refunds, disputes, payouts, invoices, subscriptions, and customers. It also reads product names and subscription items to describe subscription plans. Stored reporting fields include customer names and email addresses, record identifiers, dates, amounts, fees, currencies, statuses, descriptions, payment-method type, dispute deadlines, and subscription plan and revenue summaries. Synced rows omit card numbers, card details, bank details, addresses, client secrets, and hosted invoice or receipt URLs.

Each sync reads transactional records from the last 36 months and reads customers and subscriptions without that date limit. Imported rows are stored in workspace Loaded Data as reporting history, subject to the workspace's retention limits. Disconnecting stops new reads and removes connection credentials; imported reporting data remains until deleted or removed under normal retention rules. The connection does not create payments, issue refunds, make transfers, or change the Stripe account.

5. Facebook, Instagram, and Meta Ads connections

If you connect Facebook, The Block stores encrypted Meta credentials, your Meta account identity, and the Facebook Pages you choose to share in Meta's login dialog, including the business portfolios you allow so that Pages owned by a business can be listed. For a Page you select, The Block reads the Page name and identifier and the details needed to publish and confirm results. On the Social Media page, a person in your workspace reviews and approves each post before it publishes, either now or at a later time they choose. The Block's team can help you revise and edit posts before they are sent. The Block's administrators can also publish posts on your behalf. Each time, the administrator confirms they are posting for you, and the post records who approved it and when. An AI agent you connect can publish only with an access token you created with permission to publish. That permission starts off and ends when you revoke the token. The Block does not post to personal profiles or publish without authorization.

Instagram works the same way for a professional account linked to a Page you manage: The Block reads the account identifier and username and publishes posts under the same rules. The Meta Ads connection is read-only. The Block lists the ad accounts you authorize, with their name, currency, and status, and saves the account you choose. For a selected account, it reads campaigns, ad sets, ads, creative names, titles, text and thumbnail links, and performance metrics such as spend, impressions, clicks, and click-through rate. It does not read lead records, create or edit ads or campaigns, change budgets, or spend money.

Meta data is used only to provide the connection features you authorize, including ad-performance reporting. The Block does not sell Meta data, use it for its own advertising, or use it to train its own AI models. Disconnecting in The Block deletes the stored Meta credentials. You can also remove The Block in Facebook under Settings, Business integrations. To ask The Block to delete Meta data it holds, email support@theblock.me.

6. Google services and Gmail

For an available Google connection, The Block requests only the scopes shown on Google's consent screen and uses the returned data only to provide the feature you authorize. Google user data is not sold, used for advertising, or used to train general-purpose AI models. The Block's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

If you connect Gmail, The Block requests only two Gmail permissions: read email (gmail.readonly) and send email (gmail.send). It stores your mailbox address and the inbox email it syncs (sender, recipients, subject, date, a short preview, and up to 20,000 characters of message text; attachments are not downloaded) so you can see your email in The Block, and it sends only email that a person in your workspace writes and sends from your address. It does not modify, archive, label, or delete email. Disconnecting revokes The Block's access at Google and deletes the stored email. You can also remove The Block from your Google Account under Security, Third-party apps.

7. Bank connections through Plaid

The Block connects to banks through Plaid. A connection starts only when a person in your workspace selects Connect a bank and completes Plaid Link, where they sign in to a US bank and allow access. Your bank username and password go to Plaid and your bank, never to The Block. Each workspace can connect one bank. The connection is read-only and cannot move money.

After you connect, Plaid gives The Block an access token for that bank connection. The Block stores the token encrypted in Google Cloud Secret Manager, with the bank's name, account names, and the connection's status. It reads your accounts, their balances as last reported by Plaid, and up to two years of past transactions, then new ones. It syncs once a day, and sooner when Plaid reports new transactions. Synced rows in Loaded Data include account names and types, the last four digits of each account number, current and available balances, credit limits, and each transaction's date, description, merchant name, amount, currency, category, pending status, and payment channel. The Block does not store full account or routing numbers, your bank login, or transaction locations.

Disconnecting deletes the stored access token and asks Plaid to remove the bank connection, which ends The Block's access to that bank. When you disconnect, you can also choose to delete the synced bank data. Otherwise it remains in Loaded Data until you delete it or it is removed under normal retention rules. Plaid handles the information it collects under its own End User Privacy Policy.

8. Credentials, retention, and disconnection

Provider access and refresh tokens are encrypted, masked in the interface, limited to the authorized workspace, and retained while the connection remains active. Disconnecting a provider removes the stored connector credentials and stops new provider requests. You can also revoke access from the provider's own account settings.

Disconnecting does not silently delete content you intentionally imported into a workspace. Imported previews, source records, audit history, and project deliverables remain until you delete the applicable content or account, or until they are removed under The Block's normal retention obligations. Limited security, billing, dispute, and compliance records may be retained when required by law or a legitimate operational need.

9. Sharing and service providers

The Block shares information only with vendors that help operate the service, with people or providers you direct us to involve, when required by law, to protect users or the service, or as part of a business transaction subject to appropriate safeguards. Vendors may include hosting, storage, authentication, email, payment, monitoring, and AI processing and decision providers. They receive only the information needed for their role and are not authorized to use it for their own advertising.

A provider you connect, such as Figma, Stripe, Google, Meta, or Plaid, continues to handle information under its own terms and privacy policy. The Block sends requests to that provider only after you authorize the connection.

10. Requests from public authorities

For a government or public-authority request for personal data, The Block requires verification of the requester and qualified legal review before any disclosure. The review must establish a valid legal basis and the scope of any required response. Where the law permits, The Block challenges unlawful or improper demands and seeks to narrow requests that are excessive or unclear.

Any authorized disclosure must contain only the minimum data necessary to meet the reviewed legal requirement. The Block requires a named person's approval and keeps a restricted record of the request, legal reasoning, challenge or narrowing decisions, response, data disclosed, and people who reviewed, approved, and carried out the response. Public-authority requests can be directed to info@theblock.me.

11. Security

The Block uses technical and organizational safeguards designed to protect information, including access controls, encryption for connector credentials, restricted service identities, and audit records. No internet service can guarantee absolute security. Please report a suspected security issue promptly and do not send passwords or tokens through ordinary support messages.

12. Your choices and requests

You may update account information, disconnect providers, revoke provider access, opt out of marketing messages, and request access to or deletion of personal information. Some records may be retained when legally or operationally required. Send privacy and deletion requests to support@theblock.me from the email address associated with your account so we can verify the request.

13. Cookies, children, and international processing

The Block uses cookies and similar storage needed for authentication, security, preferences, and service measurement. Browser controls can limit cookies, but required cookies are necessary to sign in. The service is not directed to children under 18, and The Block does not knowingly collect personal information from children.

The Block uses Google Analytics to count visits to its site and app. On its public pages, The Block also uses Microsoft Clarity to understand how visitors use the site. Clarity records clicks, scrolling and mouse movement and can replay a visit. Clarity does not run after you sign in or on the sign-in and registration pages. Google and Microsoft process this data under their own privacy terms. Visitors whose browser reports a time zone in the EEA, the UK or Switzerland are asked before analytics start, including the visit count below. You can change your choice with "Cookie settings" in the site footer or your account menu.

The Block also keeps its own count of visits to its public pages by visitors who are not signed in: the pages a visit opened and in what order, the website that referred it, campaign tags in the link, whether the device was a phone, tablet or computer, and whether the visit reached the sign-up page. A visit is identified by a random number held in your browser tab until you close it, not by a cookie. The Block does not store your IP address, name, account or anything you type with it, and deletes it after 90 days. When Clarity also records the visit, The Block keeps Clarity's identifiers for that recording so it can find it.

Information may be processed in the United States and other countries where The Block or its vendors operate. Those locations may have different data-protection laws.

14. The Block Runway iPhone app

The Block Runway is The Block's iPhone app for your runway. You sign in with your The Block email address and password, with Google, or with Sign in with Apple. In the app, Google and Sign in with Apple only sign in to an account that already exists; they never create one. With Sign in with Apple, The Block receives the email address Apple shares for your Apple ID and keeps an encrypted Apple token, which it uses to end that link when you delete your account.

The app handles your account's name, email address and account identifier, and the content of your runway: the questions waiting on you, your answers and notes, today's items and meetings, drafts, files and finished work. Photos and files you choose to attach are sent to your runway. The app sees only the photos and files you pick.

The app keeps your sign-in in the iPhone's Keychain and a copy of your runway on the iPhone, under iOS data protection, so it opens quickly. Search runs on the iPhone. Signing out removes the sign-in and the copy; the app keeps only your last email address to fill in the sign-in form.

AI in the app is off until you choose where it runs. With On this iPhone, Apple Intelligence answers on the iPhone, and your question and its answer stay there. With The Block AI, the app sends your question and a short summary of your runway to The Block, which sends them to its AI service provider for an answer. The summary leaves out links, sign-in details and passwords, and you can read it in the app before you choose. Those questions and answers are kept with your account's chats. If Apple Intelligence isn't available, the app says so and never switches to The Block AI by itself.

The app shows no ads, contains no analytics or advertising tools, and does not track you across other companies' apps or websites. Connections you add from the app are approved on the provider's own page and work as the sections above describe.

To delete your account in the app, open Account and tap Delete account. This deletes your The Block account, ends the Sign in with Apple link if you used it, and removes what the app kept on the iPhone. A sign-up still waiting for approval can be deleted on its screen with Delete this sign-up. Some records may be kept when legally or operationally required, as described in Your choices and requests.

15. Changes and contact

We may update this policy as the service or legal requirements change. Material updates will be posted here with a new revision date. Questions, security reports, and privacy requests can be sent to support@theblock.me.