Privacy Policy

ContentFlow AI is a software-as-a-service platform providing AI-powered content generation tools for marketing agencies and content professionals. For privacy enquiries, contact us at support@contentflowai.agency.

We operate in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where we process personal data of individuals in the European Economic Area or United Kingdom, we also comply with the General Data Protection Regulation (GDPR) and UK GDPR as applicable.

Account information: When you create an account, we collect your email address and any profile details you provide (such as your name or company name).

Payment information: Subscription payments are processed by Stripe, Inc. We do not store your credit card number, expiry date, or CVV. Stripe provides us with a tokenised reference and basic billing details (last four digits, card type, billing address). Stripe's privacy policy is available at stripe.com/privacy.

Content and usage data: We store the prompts you submit and the content our platform generates on your behalf so you can access your content history. We also collect usage data such as which templates you use, generation counts, and feature interactions to operate and improve the Service.

Technical data: We automatically collect standard server log information including your IP address, browser type, referring URL, and pages visited. This data is used for security, fraud prevention, and analytics.

Communications: If you contact us by email, we retain that correspondence to respond to your enquiry and improve our support.

We use your personal information only for the following purposes:

• To create and manage your account and authenticate your identity
• To process subscription payments and manage billing
• To provide the content generation service, including storing your generation history
• To send transactional emails (account confirmation, password reset, billing receipts)
• To respond to support requests and enquiries
• To detect and prevent fraud, abuse, or violations of our Terms of Service
• To improve the platform through aggregated, anonymised analytics
• To comply with legal obligations

We do not sell your personal information to third parties. We do not use your content inputs to train AI models without your explicit consent.

We work with the following third-party providers to operate the Service. Each processes only the data necessary to perform their function:

• Supabase — authentication and database hosting. Your account credentials and content history are stored on Supabase infrastructure. supabase.com/privacy
• OpenAI — AI content generation. Your prompts and context are sent to OpenAI's API to generate content. OpenAI's data use policy applies to API data. openai.com/policies/privacy-policy
• Stripe — payment processing. stripe.com/privacy
• Vercel — website hosting and infrastructure. vercel.com/legal/privacy-policy

We use essential cookies to maintain your authenticated session. These cookies are strictly necessary for the Service to function and cannot be disabled without breaking core functionality.

We do not currently use advertising or tracking cookies. If this changes, we will update this policy and provide appropriate controls.

We retain your account data and content history for as long as your account is active. If you cancel your subscription, your data is retained for 90 days after the end of your final billing period, after which it is deleted from our systems.

Anonymised, aggregated usage data may be retained indefinitely for platform improvement purposes.

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you
• Correction: request that we correct inaccurate or incomplete data
• Deletion: request that we delete your account and personal data
• Portability: request your data in a structured, machine-readable format
• Objection: object to certain types of processing

To exercise any of these rights, email us at support@contentflowai.agency. We will respond within 30 days.

We implement industry-standard security measures including TLS encryption in transit, encrypted data storage, and role-based access controls. Authentication is managed via Supabase, which uses industry-standard PKCE flows and secure session handling.

While we take reasonable steps to protect your data, no internet-based service can guarantee absolute security. If you believe your account has been compromised, contact us immediately at support@contentflowai.agency.

ContentFlow AI is not directed at children under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

Our infrastructure providers (Supabase, Vercel, OpenAI, Stripe) may process data in the United States and other jurisdictions. Where data is transferred outside Australia or the EEA, we rely on appropriate safeguards including standard contractual clauses and service provider certifications.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by posting a notice on the platform at least 14 days before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.

Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

For any privacy questions or concerns, contact us at support@contentflowai.agency.

If you are located in Australia and are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.