Privacy Policy

2.1 Account and profile information

• When you register or sign in to ContentX we may collect name, email address, and authentication identifiers.
• Organization / workspace / brand identifiers you create.
• Account preferences and settings.

2.2 Lead and marketing site information

• Lead form submissions: name, company, work email, and project details you choose to share.
• Campaign context (UTM parameters, click identifiers, referrer, landing path).
• Booking details if you schedule a call (handled by Calendly under its own privacy policy; the widget loads after you choose to open it).
• Payment data for checkout (processed by Stripe; we do not store full card numbers).

2.3 Content and brand materials you provide

• Scripts, briefs, media files, brand kits, logos, and other assets you upload or generate in ContentX for production and publishing.

2.4 Google user data (OAuth / YouTube and related Google APIs)

• When you choose Connect for YouTube or another Google-powered integration, Google may ask you to authorize ContentX (and our publishing bridge described below). Depending on the scopes you approve, we may access and process:

• We only request Google scopes needed for the features you use (connect channel, publish/schedule, and show analytics). We do not request Google user data for unrelated features.

2.5 Technical and usage data

• IP address, device/browser type, approximate location derived from IP, logs, cookies or similar technologies, and product usage events needed to secure and operate the service.
• Site analytics may include Google Analytics 4 and privacy-respecting analytics; advertising pixels may run when campaigns are active.
• Google Analytics and advertising pixels are disabled when your browser sends a Do Not Track or Global Privacy Control signal.

Limited use of Google user data

• We use Google user data only to provide or improve user-facing features of ContentX that are visible in the application (channel connect, publishing/scheduling, and analytics displays).
• We do not sell Google user data.
• We do not use Google user data for advertising, including personalized or retargeting ads.
• We do not use Google user data to train generalized AI/ML models.
• We do not transfer Google user data to third parties except as disclosed in Section 4 and as needed to operate those features.

4.1 Service providers that process Google user data for ContentX

• To operate social connect and publishing, Google user data (including OAuth tokens and channel identifiers) may be processed by:

• These parties process data on our instructions to provide the ContentX service, not to sell your Google user data.

4.2 Other processors (non-Google-API product data)

• Stripe — payments (card data handled by Stripe).
• Calendly — meeting scheduling if you book a call.
• Analytics / marketing tools — e.g. Google Analytics 4, Plausible or similar, and advertising pixels when campaigns are active (marketing site; separate from Google API limited use).
• Email / support / CRM tooling — to respond to leads and tickets.

4.3 Legal and safety disclosures

• We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, safety, and security of ContentX, our users, or the public.

4.4 Business transfers

• If we are involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction under appropriate confidentiality safeguards. Google user data will remain subject to this policy (or a successor policy with notice).

4.5 What we do not do

• We do not share Google user data with unrelated third parties for their own independent marketing.
• We do not allow human reading of Google user data except as needed for security, compliance, or support when you ask us for help, or where required by law.

5.1 Encryption

• In transit: TLS (HTTPS) for ContentX Studio, APIs, and connections to Google and our publishing bridge.
• At rest: credentials and application data stored in our cloud environment are protected using provider-managed encryption at rest (industry-standard encryption offered by our cloud host).

5.2 Access control

• Access to production systems and secrets is limited to authorized personnel with a need to know.
• Administrative access uses authentication controls; secrets (API keys, OAuth client secrets) are stored in secured configuration / secret managers, not in public repositories.

5.3 Token and credential handling

• OAuth access and refresh tokens are stored only as needed to maintain your channel connection and to publish/schedule or fetch analytics you request.
• Tokens are transmitted only to Google and to our publishing bridge as required for those features.
• When you disconnect a channel in ContentX (or revoke access in your Google Account), we stop using those tokens for new actions and delete or invalidate stored connection records in line with Section 6.

5.4 Application security practices

• Authentication required for Studio account features.
• Least-privilege design for service-to-service calls.
• Logging and monitoring for abuse and operational failures.
• Dependency and infrastructure updates as part of normal operations.

5.5 Organizational measures

• Internal access policies and confidentiality expectations for staff and contractors.
• Enterprise customers may request a Data Processing Agreement (DPA) and security questionnaire.
• No method of transmission or storage is 100% secure; we work to protect your information using reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the data.