Privacy Policy

1. Who this policy covers

This policy covers your use of Marketing Content Studio as a registered business customer ("you", "your Organisation"). It does not cover internal apps this platform may also generate content for, which are separate products with their own data flows.

2. What we collect

At signup: your name, email address, and password (stored as a one-way hash - we never store or can retrieve your actual password); your business/Organisation name; your confirmation that you are authorised to provide information about, and connect digital assets on behalf of, your business.

As you use the Service: Organisation profile details you provide (website, timezone, description); team membership and roles for anyone you invite; action history for security and support purposes (audit log - what was done, by whom, when, and the IP/browser the request came from); billing and subscription status. Payment card details are handled entirely by Stripe and never reach our servers.

Once knowledge/content features ship: business information you choose to provide or approve, and - only if you opt in - a website URL you ask us to scan or documents you upload. Nothing you do not explicitly approve is used to generate content on your behalf.

3. What we do not collect

We do not read your business's private systems beyond what you explicitly connect. We do not collect payment card numbers. We do not use your content to train AI models.

4. How we use your data

To provide the Service (authentication, Organisation management, billing, support); to secure your account (fraud/abuse prevention, audit trail, session management); to communicate with you about your account, billing, and product updates; and, once content features ship, to generate marketing content drafts only from information you have explicitly approved, within your own Organisation's isolated data.

5. Who we share it with

See our Subprocessor Disclosure for the current, itemised list - our hosting provider and payment processor today; an AI provider and email provider once those features are switched on. We do not sell your data to anyone.

6. Data isolation between customers

Every Organisation's data is logically isolated from every other Organisation's. Our support staff do not have standing access to your business content - access requires your explicit consent for a specific support case.

7. Data retention and deletion

You can export your Organisation's data at any time. Deleting your Organisation or account starts a 30-day retention grace period, after which the data is permanently purged. If your subscription lapses, your data becomes read-only after a grace period before deletion, with advance email warnings.

8. Security

Passwords are hashed. Sessions use short-lived access tokens with rotating refresh tokens; a stolen/replayed refresh token automatically revokes the affected session(s).

9. Your rights

You can access, correct, export, or delete your data at any time from within the product, or by contacting us.

10. Changes to this policy

We'll notify account owners by email of material changes before they take effect.