Privacy Policy

1. Introduction

Welcome to Kizod Blog API ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, API services, and related applications (collectively, the "Service").

We operate the website https://kizod-blog-api.onrender.com and provide a blogging API service that allows users to create, manage, and publish blog posts.

Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the Service. By accessing or using our Service, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

2.1 Personal Information You Provide to Us

We collect personal information that you voluntarily provide to us when you:

• Register for an account
• Create, update, or publish blog posts
• Contact our support team
• Subscribe to our newsletter
• Participate in surveys or promotions

The personal information we collect may include:

• Name (first name and last name)
• Email address
• Password (encrypted and stored securely using bcrypt hashing)
• Profile information
• Blog content (titles, descriptions, tags, body content)
• Communications with our support team

2.2 Information Automatically Collected

When you use our Service, we automatically collect certain information about your device and usage, including:

• Log Data: IP address, browser type, browser version, pages visited, time and date of visit, time spent on pages, referring URLs
• Device Information: Device type, operating system, unique device identifiers, screen resolution
• Cookies and Tracking Technologies: We use cookies and similar tracking technologies to track activity and hold certain information
• API Usage Data: Endpoints accessed, request frequency, response times, error rates

2.3 Information from Third Parties

We may receive information about you from third parties, such as:

• Social media platforms (if you choose to log in via social media - currently not implemented)
• Analytics providers (e.g., Google Analytics for usage statistics)
• Hosting providers (e.g., Render for server logs)

3. How We Use Your Information

We use the information we collect for various purposes, including:

3.1 Core Service Functions

• Create and manage your account
• Process and publish your blog posts
• Authenticate your identity and secure your account using JWT tokens
• Provide customer support and respond to your inquiries
• Send you administrative information (e.g., account verification, password reset)
• Track blog read counts and analytics

3.2 Service Improvement

• Analyze usage patterns to improve our Service
• Monitor and prevent technical issues
• Develop new features and functionality
• Optimize API performance and response times
• Conduct research and analysis

3.3 Communications

• Send you updates about the Service (with your consent)
• Respond to your comments and questions
• Send you newsletters (if you opted in)
• Notify you about changes to our Service or policies

3.4 Legal Compliance

• Comply with legal obligations
• Enforce our terms and conditions
• Protect our rights, privacy, safety, or property
• Prevent fraudulent or illegal activities

4. Legal Basis for Processing (GDPR Compliance)

If you are located in the European Economic Area (EEA), we process your personal information based on the following legal grounds:

• Consent: You have given us permission to process your data for specific purposes (e.g., receiving newsletters)
• Contract Performance: Processing is necessary for the performance of our contract with you (e.g., providing our blogging API service)
• Legal Obligation: Processing is necessary to comply with the law (e.g., tax and accounting requirements)
• Legitimate Interests: Processing is necessary for our legitimate business interests (e.g., improving our service, preventing fraud)

5. How We Share Your Information

We do not sell, trade, or rent your personal information to third parties. We may share your information in the following circumstances:

5.1 Public Information

When you publish a blog post, the following information becomes publicly available:

• Blog title, description, content, and tags
• Author name (as displayed on your profile)
• Publication date and last update date
• Read count and reading time

Note: Your email address and other personal information remain private and are not displayed publicly.

5.2 Service Providers

We may share your information with third-party vendors who perform services on our behalf, including:

• Hosting providers: Render (USA) - Stores our application and databases
• Database providers: MongoDB Atlas - Stores user accounts and blog data
• Email service providers: For sending notifications (if implemented)
• Analytics providers: Google Analytics - For usage tracking (anonymized data)

These service providers are contractually obligated to protect your information and only use it for the specific services they provide.

5.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court order, subpoena, government investigation).

5.4 Business Transfers

If we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information is transferred and becomes subject to a different privacy policy.

5.5 With Your Consent

We may share your information for any other purpose with your explicit consent.

6. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy:

• Account Information: Retained until you delete your account or request removal
• Blog Posts: Retained until you delete your account or delete individual posts
• Log Data: Retained for up to 30 days for security and analysis purposes
• Communications: Retained as necessary to provide support and comply with legal obligations
• Analytics Data: Retained in aggregated, anonymized form indefinitely for service improvement

When you delete your account, all associated blog posts and personal information will be permanently deleted from our active databases. However, some information may be retained in backups for a limited period (up to 30 days) before being permanently deleted.

7. Data Security

We implement appropriate technical and organizational security measures to protect your personal information, including:

• Encryption: Passwords are hashed and salted using bcrypt before storage
• JWT Authentication: Secure token-based authentication for API access with expiration times
• HTTPS: All data transmitted between your browser and our servers is encrypted using TLS/SSL
• Access Controls: Limited access to personal information on a need-to-know basis
• Regular Audits: Periodic security assessments and vulnerability scanning
• Environment Variables: Sensitive configuration data stored in environment variables, not in code
• Secure Cookies: Authentication tokens stored in HTTP-only, secure cookies

8. Your Rights and Choices

8.1 Account Management

You can manage your account directly through our Service:

• Update your profile information at any time
• Edit or delete your blog posts
• Change your password
• View your account activity
• Delete your account (contact support for assistance)

8.2 Privacy Rights (GDPR - EEA Residents)

If you are a resident of the European Economic Area (EEA), you have the following rights under the General Data Protection Regulation (GDPR):

• Right to Access: Request access to your personal data and obtain a copy
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restriction: Request restriction of processing your data
• Right to Data Portability: Request transfer of your data to another service
• Right to Object: Object to processing of your data for direct marketing or legitimate interests
• Right to Withdraw Consent: Withdraw your consent at any time (where processing is based on consent)
• Right to Lodge a Complaint: File a complaint with your local data protection authority

To exercise these rights, please contact us at kizodtechnology@gmail.com. We will respond to your request within 30 days.

8.3 California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with the following rights:

• Right to Know: Know what personal information we collect, use, disclose, and sell about you
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt-out of the sale of your personal information (we do not sell personal information)
• Right to Non-Discrimination: Not be discriminated against for exercising your privacy rights
• Right to Data Portability: Receive your data in a portable format

California residents may request information about our data practices by contacting us. We will respond to verified requests within 45 days.

8.4 Cookies and Tracking

Most web browsers are set to accept cookies by default. You can modify your browser settings to:

• Decline all cookies
• Notify you when a cookie is being sent
• Delete existing cookies

However, disabling cookies may affect your ability to use certain features of our Service (e.g., staying logged in).

8.5 Marketing Communications

You can opt-out of receiving marketing emails from us by:

• Clicking the "unsubscribe" link in any marketing email
• Contacting us directly to request removal from marketing lists

Even if you opt-out of marketing communications, we may still send you essential administrative messages (e.g., password reset, account verification).

9. Children's Privacy

Our Service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately. If we discover we have collected personal information from a child under 13 without verification of parental consent, we will delete that information promptly.

For users between 13 and 18 years of age, we recommend reviewing this Privacy Policy with a parent or guardian before using our Service.

10. International Data Transfers

Your information may be transferred to and maintained on servers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ from those in your jurisdiction. Our servers are currently located in the United States.

By using our Service, you consent to the transfer of your information to the United States or other countries where we operate. We take appropriate measures to ensure that your data receives an adequate level of protection in the jurisdictions where we process it, including:

• Using Standard Contractual Clauses (SCCs) approved by the European Commission
• Ensuring our service providers are Privacy Shield certified (where applicable)
• Implementing additional safeguards as required by applicable laws

11. Third-Party Links

Our Service may contain links to third-party websites, products, or services (e.g., social media share buttons, external references). We are not responsible for the privacy practices or content of these third parties. We encourage you to read the privacy policies of any third-party sites you visit.

Links to third-party services do not constitute an endorsement, sponsorship, or affiliation by us. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party websites or services.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last Updated" date at the top of this page
• Sending you an email notification (if you have provided your email address)
• Displaying a prominent notice on our Service before the changes become effective

We encourage you to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page. Your continued use of the Service after the effective date of any changes constitutes your acceptance of those changes.

If you do not agree to the updated Privacy Policy, you should discontinue using our Service and delete your account.

13. Your Acceptance of These Terms

By using our Service, you signify your acceptance of this Privacy Policy. If you do not agree to this policy, please do not use our Service. Your continued use of the Service following the posting of changes to this policy will be deemed your acceptance of those changes.

When you create an account with us, you explicitly consent to our collection, use, and sharing of your information as described in this Privacy Policy.

14. Contact Us

If you have any questions or concerns about this Privacy Policy, our data practices, or your dealings with our Service, please contact us:

For data protection inquiries, please contact our Data Protection Officer (DPO) at the same email address.

We will respond to all inquiries within 30 days.

15. Cookie Policy

What Are Cookies?

Cookies are small text files placed on your device (computer, tablet, or mobile) when you visit a website. They are widely used to make websites work more efficiently and provide information to website owners.

Types of Cookies We Use

• Essential Cookies: Required for basic functionality including authentication, security, and account management. These cannot be disabled as our Service would not function properly without them.
• Preference Cookies: Remember your preferences and settings (e.g., language preferences, theme settings).
• Analytics Cookies: Help us understand how users interact with our Service (e.g., page visits, time spent, bounce rates). We use Google Analytics for this purpose.
• Authentication Cookies: Store your JWT token to keep you logged in between sessions (if you select "Remember Me").

Specific Cookies We Use

• jwt: Stores your authentication token (HTTP-only, secure)
• _ga: Google Analytics cookie for user tracking
• _gid: Google Analytics cookie for user tracking
• session: Stores session information

Managing Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to:

• View cookies stored on your device
• Delete existing cookies
• Block cookies from specific websites
• Block all cookies
• Receive notifications when cookies are set

To learn more about cookies and how to manage them, visit www.allaboutcookies.org.

16. GDPR Compliance Statement

For users in the European Economic Area (EEA) and the United Kingdom:

• Data Controller: Kizod Technology, Benin City, Nigeria
• Data Protection Officer (DPO): Available at kizodtechnology@gmail.com
• Supervisory Authority: You have the right to lodge a complaint with your local data protection authority if you believe your data protection rights have been violated. A list of EU Data Protection Authorities is available at https://edpb.europa.eu.
• Data Protection Impact Assessment (DPIA): We have conducted a DPIA for our data processing activities and will conduct additional assessments as needed.
• Data Processing Agreement (DPA): We have DPAs in place with all third-party service providers who process personal data on our behalf.
• Data Breach Notification: We will notify affected users and relevant authorities within 72 hours of discovering a data breach.