Privacy Policy

1. Information We Collect

We collect information you provide directly to us when you create an account, use the platform, or contact us. This includes your name, email address, and any content you upload or generate through the service. We also collect usage data automatically, such as pages visited and features used, where you have given analytics consent.

2. How We Use Your Information

We use the information we collect to provide, maintain, and improve our services; to communicate with you; to monitor and analyze trends and usage; and to personalise the experience.

3. Sharing of Information and Data Processors

We do not sell your personal information. We share data with the following third-party service providers solely as necessary to operate the platform:

• Supabase — user authentication and database hosting
• Railway — backend compute and infrastructure
• Vercel — frontend hosting and delivery
• Google (Gemini), OpenAI (GPT-4), Anthropic (Claude), OpenRouter — AI processing of content you submit for generation
• Firecrawl — extraction of content from URLs you submit
• Lemon Squeezy — payment processing and subscription management
• Resend — transactional email delivery

Content you submit for AI generation is processed by the AI providers listed above. We do not control how those providers store or use data beyond the immediate API request, and their own privacy policies apply.

We may also disclose information where required by law or with your explicit consent.

4. Data Retention

We retain your information for as long as your account is active or as needed to provide you with our services. You may request deletion of your account and associated data at any time through the Settings page.

5. Security

We take reasonable measures to protect your information from unauthorised access, loss, misuse, or disclosure. All data is transmitted over HTTPS. Authentication is handled via Google OAuth through Supabase; we do not store passwords directly. OAuth tokens are stored encrypted at rest using industry-standard symmetric encryption.

6. Cookies and Local Storage

We use two categories of tracking technologies: browser cookies and localStorage. You can manage your preferences at any time via the banner that appears on your first visit.

6a. Necessary — always active

These are essential for the site to function. They handle authentication and session continuity and cannot be disabled.

6b. Analytics cookies — optional

These cookies help us understand how visitors use the product so we can improve it. They are only set after you click Accept all. No personal data is shared with or sold to third parties. If you revoke consent, these cookies are deleted from your browser immediately.

7. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes we will notify you by email or through the platform. Continued use of the service after such changes constitutes acceptance.

8. Contact Us

If you have questions about this Privacy Policy, please contact us at privacy@contentflow.my.