Privacy Policy

Personal Information You Provide

We collect information you provide directly when you:

• Create an account: Name, email address, password
• Complete your profile: Business name, industry, timezone, profile picture
• Subscribe to a plan: Payment information (processed by Stripe)
• Use the Service: Content you create, social media account connections
• Track a competitor: The public handle and the title and excerpt of the public posts of any account you choose to track, to power the competitor digest in your dashboard. We do not collect anything from a private account, and this stops the moment you remove the tracked competitor or delete your account.
• Contact support: Communications and support tickets

Automatically Collected Information

When you use our Service, we automatically collect:

• Device information: Browser type, operating system, device type
• Usage data: Features used, pages visited, actions taken
• Log data: IP address, access times, referring URLs
• Cookies: Session and preference data (see Cookie section below)

Information from Third Parties

• Google Sign-In: Name, email, profile picture (if you choose to sign in with Google)
• Social Media Platforms: Account information when you connect platforms for publishing
• Stripe: Payment status and subscription information (not full payment details)

We use collected information to:

• Provide the Service: Create and manage your account, process subscriptions
• Draft with AI help: Process your inputs so AI can help draft your social media posts
• Content Review Tracking: Record when you complete final reviews of scheduled posts to enable safe auto-publishing
• Improve the Service: Analyze usage patterns to enhance features
• Communicate: Send transactional emails, support responses, important updates
• Process Payments: Handle subscriptions and billing through Stripe
• Ensure Security: Detect and prevent fraud, abuse, and unauthorized access
• Legal Compliance: Comply with applicable laws and regulations

Final Review Data

When you complete a final review for scheduled posts, we store:

• Whether the final review has been completed (true/false)
• The timestamp when the review was completed

This data is used to determine which posts are eligible for auto-publishing and to provide you with a record of reviewed content.

Inbox: Comments and Instagram Messages

When you use the Inbox, we store the comments people leave on your posts. If you approve message access when you connect Instagram, we also store the direct messages between your Instagram account and the people who write to it:

• The text of each message and any link to an attachment
• The other person's Instagram name and picture, as Instagram shows them, and their Instagram user id
• When each message was sent and whether it was delivered or read
• The replies you send, and which member of your team sent them

We keep this so you and your team can read and answer your conversations in one place. Only your workspace can see it. It is deleted when you delete your account, and disconnecting Instagram stops new messages from arriving. A private reply to a comment is only ever sent when a person on your team writes and sends it.

We do not sell your personal information.

We may share information with:

• Stripe (Payment Processor): To process payments and manage subscriptions
• Paddle (Payment Processor): For subscriptions bought before we moved to Stripe, until they end
• DeepSeek AI: Content generation inputs are sent to DeepSeek for processing (inputs are not permanently stored by them)
• Image Generation Providers (Pollinations): Your image prompt, and any reference image you attach, are sent to Pollinations to generate your image, or, when you choose Match this style, to read the look of that image (colours, layout and type feel) so we can follow it. A product photo you add to your Brand Kit is cut out on our own servers; only when that cannot be done there is the photo sent to Pollinations, once, to find where the product ends and the background begins. When your text compares your brand with another named brand, that brand's name, the product category, the country and your listed features are sent to Pollinations' web search model (Perplexity Sonar) to look up public facts with their sources; nothing about you or your account is sent
• Hosting Providers: Vercel for application hosting and file storage (Vercel Blob, where your uploads and generated images are kept), Neon for database services
• Clerk (Authentication): Your name, email address and sign-in details, to sign you in, including Google sign-in and two-step verification
• Outstand (Publishing): The posts, media and account connections needed to publish to the social networks you connect, and, if you turn on Instagram messages, the messages sent and received on that account
• Resend (Email delivery): Your email address and the emails we send you
• PostHog (Product analytics): How the product is used (pages viewed and actions taken), to improve it, and, only if you accept analytics cookies, recordings of the screens you use, with passwords, billing details, API keys and private messages hidden
• Sentry (Error monitoring): Error reports, which can include technical details of the request that failed
• Upstash (Caching and queues): Short-lived technical data such as rate-limit counters and background job payloads
• Social Media Platforms: When you connect accounts for direct publishing
• Google: For authentication if you use Google Sign-In
• Legal Requirements: When required by law, court order, or to protect our rights
• Business Transfers: In connection with mergers, acquisitions, or asset sales (users will be notified)

We implement industry-standard security measures to protect your data:

• Encryption: All data transmitted via HTTPS/TLS encryption
• Sign-in Security: Passwords are held by Clerk, our authentication provider, hashed and never stored in plain text; two-step verification is available
• Access Controls: Strict internal access controls and authentication
• Database Security: Encrypted database connections with role-based access
• Rate Limiting: Protection against brute force and abuse attempts
• Regular Audits: Periodic security reviews and updates

While we strive to protect your information, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security but commit to promptly addressing any security incidents.

We retain your information as follows:

• Active Account: Data is retained while your account is active
• After Cancellation: Your account moves to the Free plan and keeps your posts, drafts and connections. On Free, files you uploaded are kept while a draft or scheduled post uses them, then 7 days after that post is published; a file no post uses is removed 7 days after you upload it.
• After Deletion Request: Data deleted within 30 days, backups within 90 days
• Free-Trial Record: So the free trial is given once to a person, we keep scrambled (hashed) copies of your sign-up email address, the id of the browser you signed up in and the social accounts you connect for 24 months, and your network prefix (the first part of your IP address) for 30 days only. The legal basis is our legitimate interest in preventing fraud and abuse of a free offer. The copies are one-way and keyed with a secret only we hold, so they do not show your address or your IP, and we use them for nothing else. They stay after you delete your account, which is what stops the same person taking the trial again within that time; a repeat is never refused sign-up, the account just starts on Free. You can object under Your Rights below
• Legal Requirements: Some data may be retained longer if required by law
• Analytics Data: Aggregated, anonymized data may be retained indefinitely
• Competitor Tracking Data: Retained while you track that competitor; removed with the rest of your account data if you stop tracking it or delete your account

We use cookies and similar technologies for:

• Essential Cookies: Required for the Service to function (authentication, security)
• Preference Cookies: Remember your settings and preferences
• Analytics Cookies: Understand how you use the Service to improve it

Managing Cookies: You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the Service.

For more details, see our Cookie Policy.

Our Service is not intended for children under 13 (or under 16 in the EEA). We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately at admin@contentdrifter.com, and we will promptly delete such information.

Your information may be transferred to and processed in countries other than your own, including the United States. These countries may have different data protection laws.

We ensure appropriate safeguards are in place for international transfers, including:

• Standard Contractual Clauses approved by relevant authorities
• Data processing agreements with service providers
• Compliance with applicable data protection frameworks

Our Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal reasons. We will notify you of significant changes by:

• Posting a notice on our website
• Sending an email to the address associated with your account
• Updating the “Last Updated” date at the top of this policy

We encourage you to review this Privacy Policy periodically.