Privacy Policy

1. Overview

This Privacy Policy explains how Contents Lab ("we", "us") collects, uses, and shares your personal information when you use our website, mobile apps, and APIs (the "Service").

We are committed to handling your information transparently and securely. We only collect what we need to operate, support, and improve the Service. We never sell your personal data.

If you are located in the European Economic Area, the United Kingdom, Nigeria, or California, you have specific rights under the GDPR, the NDPR, or the CCPA respectively. Those rights are described in Section 7.

2. What We Collect

Information you provide: name, email, password (stored as a bcrypt hash, never plaintext), profile fields you choose to fill in, and any content you create in the Service.

Information collected automatically: IP address, browser User-Agent, pages visited within the Service, time of visit, and referring URL. We use these for security, rate limiting, and aggregate analytics.

Information from payment partners: when you upgrade to a paid plan, our payment partners (Stripe, PayPal, Paystack, Flutterwave) share the minimum needed to confirm payment — typically a transaction reference and the last four digits of your card. We do not store your full card number.

Information from AI providers: when you use the AI agents, your input (e.g. a research question or a topic outline) is sent to your configured AI provider (OpenAI-compatible, Gemini, Anthropic, or Groq). The provider processes it under their own privacy policy.

3. How We Use Your Information

We use your information to:

operate, maintain, and improve the Service — including the AI agents, the publishing queue, and the Source Library;

authenticate you and keep your account secure;

process payments and prevent fraud;

send transactional emails (receipts, password resets, security notices) and, with your consent, marketing emails (the monthly digest);

respond to support requests and contact-form submissions;

comply with legal obligations and enforce our Terms of Service.

4. How We Share Your Information

We share your information only as needed to operate the Service:

with our hosting provider (Cloudflare) and database provider (Lightbase) for the infrastructure that runs the Service;

with our payment partners when you upgrade to a paid plan;

with our AI provider partners when you use the AI agents — your inputs are sent to the provider you configured;

with email delivery services to send transactional and marketing email;

when required by law, regulation, or legal process — we disclose only what is required.

We never sell your personal information. We never share your content with third parties for advertising purposes.

5. Retention

We keep your personal information for as long as your account is active. After account termination, we delete your content within 30 days. We retain transactional records (receipts, audit logs) for 7 years for tax and accounting purposes.

Newsletter subscribers can unsubscribe at any time; we delete unsubscribed email addresses after 12 months unless a legal basis requires longer retention.

6. Security

We use industry-standard technical and organisational measures to protect your information:

passwords are stored as bcrypt hashes with a work factor of 12;

API keys and OAuth tokens for connected social channels are encrypted at rest;

all traffic is HTTPS; security headers (CSP, HSTS, X-Frame-Options) are set on every response;

access to production data is restricted to a small number of authorised engineers, all of whom use 2FA.

No system is 100% secure. If we become aware of a breach affecting your personal information, we will notify you within 72 hours as required by Article 33 of the GDPR.

7. Your Rights

Depending on where you live, you may have the following rights:

access: request a copy of the personal information we hold about you;

rectification: ask us to correct inaccurate information;

erasure: ask us to delete your personal information ("right to be forgotten");

restriction: ask us to limit processing in certain circumstances;

portability: receive your personal information in a machine-readable format;

objection: object to processing based on legitimate interests or for direct marketing;

withdrawal of consent: withdraw consent at any time where we rely on it.

To exercise any of these rights, write to privacy@contentslab.app or use the contact form. We respond within 30 days.

8. Cookies

We use a small number of cookies and similar technologies:

a session cookie (cl_sid) that identifies you while you are signed in — deleted when you sign out or after 7 days of inactivity;

a theme cookie (cl_theme) that remembers whether you prefer light or dark mode — persists for 1 year;

Cloudflare analytics cookies for aggregate, privacy-preserving traffic measurement.

We do not use third-party advertising cookies. Most browsers let you control cookies in their settings; disabling cookies does not break the Service.

9. International Transfers

The Service is hosted on Cloudflare, which may process your data in data centres outside your country of residence. We rely on Cloudflare's Binding Corporate Rules and Standard Contractual Clauses for such transfers.

AI provider requests may be processed in the United States, the European Union, or other jurisdictions. Your provider's privacy policy governs that transfer.

10. Children

The Service is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe we have collected such information, contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you by email and in-app at least 30 days before material changes take effect. The "Last updated" date at the top of this page indicates when the policy was last revised.

12. Contact

If you have questions about this Privacy Policy or your personal information, write to privacy@contentslab.app or use the contact form. Our Data Protection Officer can be reached at the same address. We respond within 30 days — usually much faster.