Privacy Policy

Last Updated: November 9, 2026

1. Introduction

BLAZE LABS PTY LTD (ABN 66 694 592 553) ("we," "our," or "us") operates BlazeXL, a platform for running Python and shared business logic in Excel, on the web and through APIs. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the choices you have.

This policy applies to our website (blazexl.com), the BlazeXL web workspace, the Excel add-in, and related APIs and SDKs (collectively, the "Service").

2. Information We Collect

  • Account information: name, email address, organisation, role and team membership, collected when you sign up, are invited or request early access, and the details you give in the contact form (such as your company). Passwords are stored only as bcrypt hashes.
  • Content you compute with: code, cell values and data you send to BlazeXL for execution, the data objects (handles) that execution produces, and the Blocks and Apps you save.
  • Execution and audit records: when logic runs on our servers, and when you take administrative actions, we record who acted (with their email and IP address), when, from which interface (Excel, web or API), which Block versions ran, and any error message.
  • Service logs: IP address, browser or client details and request times, recorded by our servers and our hosting providers for security and operations.
  • Support communications: the content of messages you send us.

We do not collect payment card details through the Service. Paid plans are invoiced directly.

3. Lawful Basis for Processing (GDPR)

  • Contract performance: account information, content you compute with, and execution records are needed to provide the Service.
  • Legitimate interest: service logs and audit records are used to keep the Service secure and reliable. We balance this against your privacy rights.
  • Consent: we will ask for your consent before using any non-essential cookies or sending marketing email. We do neither today.
  • Legal obligation: we may retain certain records where the law requires it.

4. How We Use Your Information

  • Provide, operate and maintain the Service
  • Authenticate users and enforce access controls
  • Keep audit trails of governed logic execution for you and your organisation
  • Respond to support requests
  • Keep the Service secure and reliable
  • Send service and security notices, such as invitations and password resets

5. The AI Analyst

When you use the AI Analyst, your request is sent to one of the AI model providers on our Sub-processors page to generate Python code and explanations; if a provider fails, the request can be retried with another. A request includes your prompt and the conversation so far; the workbook, sheet and table names; for the data you select, its column names, types, summary statistics and a few sample values, and the cell comments and drop-down lists in that range; the code and any errors of your last few runs; and the names and signatures of your functions and Blocks. When you send a range to the Analyst, its values are stored on our servers as a data object. The providers process requests to return a response. BlazeXL does not use your data to train AI models.

6. Data Retention

  • Account information: kept while your account is active. Contact us to ask for it to be deleted (section 10).
  • Data objects: expire automatically after a period set by your plan.
  • Blocks and Apps: drafts and Apps are kept until they are deleted. Published Block versions cannot be deleted, so workbooks that use them keep working; they are kept while your organisation's account is active and, after an organisation is deleted in the workspace, until it asks us to delete them (Terms of Service, section 11).
  • Execution and audit records: kept while your organisation's account is active, so the audit trail stays complete, and after an organisation is deleted until it asks us to delete them. They are not deleted automatically today.
  • Service logs: kept for a limited period for security and operations.

7. Sub-Processors and Third Parties

We use providers in these categories to operate the Service:

  • Hosting and compute: runs the gateway, compute and databases.
  • Content delivery and network: serves the website, the Excel add-in and the local Python runtime, and carries all traffic to our API and gateways, so it handles your requests, including their content, in transit.
  • AI model providers: generate code and explanations for the AI Analyst (section 5).
  • Email delivery: sends service email, such as invitations and password resets.

The providers, what each one processes and where are listed on our Sub-processors page. We add a provider to that page before it receives any of your personal data. We also run compute on our own servers in Australia. When Excel runs the add-in, it loads Microsoft's Office.js and Office telemetry from Microsoft, under your own agreement with Microsoft. We do not sell personal information. We share it with these providers only as needed to operate the Service. Business customers who need a data processing addendum, for example under the EU or UK GDPR, can agree one with us at privacy@blazexl.com.

8. Cookies and Local Storage

  • Strictly necessary cookies: sign-in cookies for the web workspace, a 15-minute access token and a refresh token that lasts up to 30 days. The workspace does not work without them.
  • Local storage: your preferences on this device, such as theme and your cookie-banner choice, and unsaved drafts you were editing. The Excel add-in keeps its sign-in in Office's storage for the add-in, along with its settings, the Block approvals you chose to remember and the list of your data handles.
  • No analytics or advertising: we do not run analytics or advertising cookies or scripts. The cookie banner records your choice, but there is nothing optional for it to turn on.

9. Execution Data

  • Local compute: when an Excel cell runs locally, it runs in your browser or Excel, and its data is not sent to our servers for that run. If local Python fails or runs too long, that cell's next recalculation runs on our servers. When a local cell calls blazexl_fetch_json or blazexl_fetch_csv, your browser downloads the public HTTPS address written in the cell; your cell data is not sent.
  • Server compute: data sent for server-side execution is processed in our executors. Results you keep as data objects are stored encrypted until they expire (section 6).
  • Blocks: when logic is saved as a Block, its code is versioned and stored with its name, description and review history. Saving a Block does not attach your workbook; anything you write into its code, description or review comments is stored with it.

10. Your Rights Under GDPR

If you are located in the European Economic Area, you have the following rights:

  • Access: request a copy of the personal data we hold about you.
  • Rectification: request correction of inaccurate personal data.
  • Erasure: request deletion of your personal data, subject to legal retention requirements.
  • Portability: receive a copy of the personal data you gave us, in a commonly used format.
  • Objection: object to processing based on legitimate interest.
  • Withdraw consent: where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact privacy@blazexl.com. We will respond within 30 days. If your information reached BlazeXL because an organisation that uses it put it into a workbook, Block or prompt, that organisation decides how it is used: we pass your request to them and help them respond.

11. Your Rights Under CCPA/CPRA (California)

  • Right to know: you may request what personal information we collect and how it is used.
  • Right to delete: you may request deletion of your personal information.
  • Right to opt out of sale or sharing: we do not sell or share personal information for advertising.
  • Non-discrimination: we will not deny service or change pricing because you exercise these rights.

12. Where Data Is Stored

Account information, Blocks, Apps and audit records for every organisation are stored with Amazon Web Services in the United States. Compute and short-lived session data run in the United States or on our own servers in Australia, depending on the deployment that serves your organisation. BLAZE LABS PTY LTD is based in Australia. Personal information may be stored or processed outside Australia, in the countries where our providers operate; the Sub-processors page lists where each provider processes data. Enterprise customers can ask us about a regional deployment.

13. Children's Privacy

BlazeXL is a business service for people aged 18 or over (Terms of Service, section 1). We do not knowingly collect personal information from children. If we learn that someone under 18 has an account, we close it and delete their personal information.

14. Data Breaches

We follow the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth). If a breach involves personal information we hold for our own purposes, such as account information, and is likely to cause serious harm, we notify the people affected and the Office of the Australian Information Commissioner. If it involves data we process for a business customer, we tell that customer without undue delay, and within any period our agreement with them sets, and help it assess the breach and make any notification it requires. Report a suspected breach to security@blazexl.com.

15. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes to this policy will be communicated by email at least 30 days before they take effect; changes required by law or urgently needed for security may take effect sooner, with notice as soon as practicable. Changes to the list of providers are published on the Sub-processors page before a new provider receives personal data.

16. Contact

For privacy inquiries, data requests, or to exercise your rights under GDPR or CCPA, contact us at privacy@blazexl.com.

BLAZE LABS PTY LTD (ABN 66 694 592 553)
Registered office: Level 1, 63-73 Ann Street, Surry Hills NSW 2010, Australia
We operate from Melbourne, Victoria, Australia