Privacy Policy

1. Data Controller

As the data controller, we determine the purposes and means of processing your personal data.

2. Personal Data We Collect

We may collect and process the following categories of personal data:

• Account Information: Name, email address, username, password.
• Profile and Usage Data: Profile photo (if uploaded), preferences, settings, activity logs, timestamps.
• Social Media API Data: When you connect a social media account (Facebook, LinkedIn, YouTube, Instagram, TikTok, Twitter), we receive only the data you authorize through the official API (e.g., profile name, post content, analytics). We never collect your social media credentials directly.
• Content Data: Drafts, posts, comments, media (images, videos) you manage through the Services.
• Communications: Correspondence between you and our support or sales teams.

3. How We Use Your Personal Data

We use personal data to:

• Provide, maintain, and improve the Services (account creation, access management, feature usage).
• Facilitate the full content creation pipeline (drafting, scheduling, publishing).
• Integrate with social media platforms via official APIs, in compliance with their terms of service.
• Send administrative messages, updates, and marketing communications (with your consent).
• Monitor and analyze usage to enhance performance and user experience.
• Detect, prevent, and respond to security and technical issues.

4. Legal Bases for Processing

Under the GDPR, we rely on the following legal bases to process your personal data:

• Performance of a Contract: Processing necessary to provide the Services you request.
• Consent: Where you have given clear permission (e.g., marketing communications, social media connections).
• Legitimate Interests: For the operation and improvement of our Services, fraud prevention, and security, provided these interests do not override your fundamental rights.

5. Data Retention

• Account and Profile Data: Retained for as long as your account is active or as needed to provide you Services.
• Content Data: Stored until you delete it or request its deletion.
• Social Media Tokens: Stored only for the duration necessary to maintain API connections; you may revoke access at any time.
• Support Communications: Retained for up to 3 years for legal and operational purposes.

Upon request, we will delete or anonymize your personal data, except where otherwise required by law.

6. Your Rights under the GDPR

You have the right to:

• Access your personal data.
• Rectify inaccurate or incomplete data.
• Erasure (the “right to be forgotten”).
• Restrict processing of your data.
• Data Portability to another controller.
• Object to processing based on legitimate interests or direct marketing.
• Withdraw Consent at any time (without affecting past processing).

To exercise any of these rights, please contact us at privacy@contentmachine.so.

7. Sharing and Disclosure of Personal Data

We do not sell your personal data, and we do not share it with advertisers, data brokers, or any other third party for their own purposes. We disclose personal data only in the situations described below.

• Other members of your workspace: Content, connected accounts, and the analytics of those accounts are visible to the members of the workspace they belong to, according to each member’s role. Data is never shared between workspaces.
• Service providers (sub-processors): Companies that host or process data on our behalf, under contract, and only on our instructions. They may not use your data for their own purposes. They are:
  • Render (Frankfurt, EU) — application hosting, database, and background workers.
  • ClickHouse Cloud (eu-central-1, EU) — the analytics database.
  • Cloudflare R2 (Western Europe) — media and file storage.
  • Hatchet Cloud — scheduling and orchestration of background jobs.
  • Resend — transactional email (sign-in codes, invitations, notifications).
  • Anthropic — the AI features you choose to use. Only the text you submit to those features is sent, and it is not used to train Anthropic’s models.
  • Our error monitoring and tracing provider — technical diagnostics.
• The social platform you publish to: When you publish or schedule a post, we send that content to the platform you selected (for example LinkedIn, YouTube, TikTok), at your instruction, through its official API.
• Legal and regulatory authorities: Where we are required to do so by law, or to establish, exercise, or defend legal claims.
• A successor entity: If we are involved in a merger, acquisition, or sale of assets, we will inform you before your personal data is transferred and becomes subject to a different privacy policy.

Google user data. The data we receive from Google APIs (your YouTube channel information, the metadata of your own videos, and YouTube Analytics for the channels you connect) is disclosed only to the infrastructure sub-processors listed above — Render, ClickHouse Cloud, Cloudflare R2, and Hatchet Cloud — which store or process it on our behalf and may not use it for their own purposes. We do not share, transfer, or disclose Google user data to any other third party. We do not sell it, we do not use it for advertising or ad targeting, we do not send it to our AI providers, and we do not use it to develop, improve, or train generalized artificial intelligence or machine learning models. Inside Content Machine it is visible only to the members of the workspace that connected the channel. Content Machine’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

8. Social Media and Third-Party APIs

When you connect your Facebook, LinkedIn, YouTube, Instagram, TikTok, or Twitter account, we:

• Use only the official APIs provided by each platform.
• Request only the permissions necessary to perform the requested functions.
• Comply with each platform’s terms of service and data handling policies.
• Obtain your explicit consent before accessing your social media data.
• Permanently delete all retrieved content and tokens if you request disconnection or account deletion.

YouTube. Content Machine uses YouTube API Services. By connecting a YouTube channel you also agree to the YouTube Terms of Service, and the Google Privacy Policy describes how Google handles your data. You can revoke Content Machine’s access to your Google account at any time from the Google security settings page, or by disconnecting the account inside Content Machine. See section 7 for who we disclose Google user data to.

9. Data Security

We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, alteration, or disclosure. Measures include encryption in transit (TLS) and at rest, access controls, regular security assessments, and staff training.

10. International Data Transfers

Your account data, content, media, and analytics are stored within the European Economic Area (EEA), on infrastructure located in Frankfurt and Western Europe. Some of the service providers listed in section 7 — in particular those handling job orchestration, transactional email, AI features, and error monitoring — operate from outside the EEA. Where data is transferred outside the EEA, we ensure adequate safeguards such as Standard Contractual Clauses or reliance on an adequacy decision by the European Commission. Google user data is stored on our EEA infrastructure.

11. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance user experience, track feature usage, and analyze trends. You can manage cookies through your browser settings. For more details, please see our Cookies Policy.

12. Changes to this Privacy Policy

We may update this policy periodically. We will notify you of significant changes via email or an in-app notification and update the “Last updated” date.

13. Contact Us

If you have questions, concerns, or wish to exercise your GDPR rights, please contact: