Privacy Policy

1. Information We Collect

We collect the following information:

• Account information: email, name, profile image (collected through Clerk at sign-up)
• Payment information: payment method identifier, subscription status, billing history (processed by Polar; sensitive data such as card numbers are not stored on our servers)
• Service usage data: card news, ideas, and other content you create; AI prompts you submit; credit usage history; system logs
• Connected social account data (only if you connect Instagram or Threads): the access token and the permissions you granted; account identifiers; profile information (username, display name, profile picture, verification status, and follower count); and the links and metrics of posts you publish through the Service
• Automatically collected: IP address, browser/device information, access time, page usage, cookies

2. How We Use Information

Collected information is used only for the following purposes:

• Account authentication and management
• Providing service features such as AI card news generation, editing, and export
• Processing payments and refunds
• Sending service notices, customer support replies, and policy updates
• Preventing abuse and maintaining service stability
• Improving the service and analyzing usage statistics

3. Sub-processors and Third Parties

We rely on the following providers to operate the Service. Each processes personal data only within the scope of their assigned task:

• Clerk — authentication and account management
• Convex — database and backend
• Polar — payment and subscription processing
• Resend — transactional email delivery
• Vercel — hosting and access analytics
• OpenAI — AI card news generation (the prompts and related content you submit are transmitted to OpenAI)
• Unsplash — image search
• Pexels — background image search (your search keywords are transmitted)
• Meta (Instagram, Threads) — publishing to the accounts you connect (the slides and caption you choose to publish are sent to the platform you select, only when you click publish)

Except as required by law, we do not share your personal data with other third parties without your consent.

4. Retention Period

We delete collected personal data without undue delay upon account deletion. Where applicable laws (e.g., e-commerce, electronic financial transactions, communications secrecy) require retention for a specified period, we retain only the required data for that period and then delete it.

5. AI Content Processing

When you use AI card news generation, the text you provide (topic, prompt, brand voice, etc.) is transmitted to the OpenAI API for processing. OpenAI states that data received via its API is not used to train its models; however, we recommend that you do not submit sensitive personal data. You retain ownership of the content you generate, and we do not use it for any purpose other than providing the Service.

6. Your Rights

You may exercise the following rights at any time:

• Request access, correction, deletion, or restriction of processing
• Close your account (see Section 7 for the procedure)
• Withdraw consent

You can exercise these rights through the in-app settings page or by contacting us at the address below. We will respond without undue delay.

7. Account and Data Deletion

You may request deletion of your account and associated data at any time. The procedure is as follows:

• In the app: sign in and go to Settings > Data > Delete account to delete it yourself right away. If you have an active paid subscription, you can delete the account after it ends.
• Email request: send an email to hello@contentlog.xyz from the address you signed up with, with the subject "Account deletion request". After identity verification, your account and data are deleted within 30 days.
• Scope of deletion: account profile (email/name/profile image), all content you have created (ideas, briefs, card news, posts, newsletters), uploaded attachments, social channel access tokens and publish history, credit usage history, and logs.
• Data held by connected social platforms (Threads / Instagram, etc.) is governed by each platform's policy. Posts already published to those platforms are NOT removed automatically — please remove them in the respective app (Threads posts can also be removed with the "Delete from platform" action provided in the Service).
• Meta (Instagram / Threads) users: removing ContentLog from the apps and websites list in your Instagram or Threads settings revokes our access, and we delete the access token automatically. If you send a data deletion request from those settings, the data stored on our side for that account is deleted automatically. You can also email hello@contentlog.xyz; after identity verification, all related data is deleted within 30 days. Details: contentlog.xyz/data-deletion

Information that we are legally required to retain (e.g., billing records and access logs under e-commerce / electronic financial transactions / communications secrecy laws) is kept only for the required period and then deleted. We notify you by email once deletion is complete.

8. Security Measures

We apply reasonable technical and organizational measures to protect personal data, including encryption in transit (HTTPS), access controls, and separation of administrator accounts.

9. Cookies and Analytics

We use cookies to keep you signed in and to analyze service usage. You can disable cookies in your browser settings, but some features may become unavailable. Access analytics is powered by Vercel Analytics and an analytics tool we operate ourselves. It stores a randomly generated visitor identifier in your browser storage (localStorage) and collects the pages you visit (with identifying parts of the address masked), how you arrived (the previous site's domain such as a search engine or social network) and campaign tags, your country, and your device type. If you are signed in, it also records whether and when you signed up, used key features, and made your first payment (payment amounts are not recorded). We do not store your IP address, and when you are signed in the data is linked to your account only through an irreversible derived value, never your email or name. Raw records are deleted after 90 days, and daily visit and activity records and visitor/account linkage data (the random identifier, first referral source, first landing page, country, and device) are deleted 400 days after your last visit, and records linked to your account are deleted when you delete your account (only the record that the deletion request was delivered to the analytics tool is kept for 7 days after delivery). If you block site data (browser storage) in your browser settings, the analytics tool collects nothing. Clearing storage starts you over as a new visitor.

10. Changes to This Policy

We will notify you in advance through the Service or by email if we make material changes to this policy. Changes take effect from the effective date stated in the notice.

11. Contact

For privacy inquiries or to exercise your rights, please contact us:

hello@contentlog.xyz