Privacy Policy

The Content Engine("we", "us", or "our") operates the website at aicoursefinaly.vercel.app and related services. This Privacy Policy describes how we collect, use, and protect your information when you use our platform.

1. Information We Collect

Account Information

When you create an account, we collect your name, email address, and authentication credentials. If you sign up via a third-party provider (e.g., Google), we receive your basic profile information from that provider.

Social Media Account Data

When you connect social media accounts (Twitter/X, Facebook, Instagram, TikTok, LinkedIn), we receive and store OAuth access tokens and refresh tokens to act on your behalf. These tokens are encrypted at rest using AES-256-GCM encryption. We also collect:

• Your social media profile name and account identifiers
• Post performance metrics (likes, shares, comments, reach) for connected accounts
• Page and profile metadata necessary to publish content

We only request the minimum permissions (scopes) needed to read analytics and publish content on your behalf. We do not access your private messages, friend lists, or personal browsing activity on any platform.

Payment Information

Payment processing is handled by Stripe. We do not store your credit card number or full payment details on our servers. We store your Stripe customer ID and subscription status to manage your plan.

Content and Usage Data

We store content you create or generate through the platform, including drafts, published posts, research results, and brand guidelines. We also collect basic usage data such as pages visited and features used to improve the service.

2. How We Use Your Information

• To provide and operate the platform, including content generation, scheduling, and publishing
• To analyze social media performance on your connected accounts
• To run automated content workflows (for eligible plans)
• To process payments and manage subscriptions
• To communicate with you about your account and service updates
• To improve and develop new features

3. How We Protect Your Information

• Token encryption: All social media OAuth tokens are encrypted at rest using AES-256-GCM before being stored in our database
• Secure connections: All data is transmitted over HTTPS/TLS
• CSRF protection: OAuth flows use state parameters and httpOnly cookies to prevent cross-site request forgery
• Payment security: Payment processing is handled entirely by Stripe (PCI DSS compliant)
• Webhook verification: All incoming webhooks are cryptographically verified before processing

4. Third-Party Services

We integrate with the following third-party services:

• Social platforms (Twitter/X, Facebook, Instagram, TikTok, LinkedIn) — to publish content and read analytics on your behalf
• Stripe — for payment processing
• AI/LLM providers (Anthropic, or your own API key on BYOK plans) — to generate content. Prompts may include your brand data and topic preferences but not personal identifying information
• Vercel — for hosting and infrastructure

Each third-party service has its own privacy policy. We encourage you to review them.

5. Data Sharing

We do not sell your personal information. We share data only in these circumstances:

• With third-party services listed above, as needed to operate the platform
• When required by law, regulation, or legal process
• To protect the rights, safety, or property of our users or the public

6. Data Retention and Deletion

We retain your data for as long as your account is active. You can disconnect social media accounts at any time, which immediately removes stored tokens for that platform. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law.

7. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Disconnect any social media account at any time
• Export your content and data
• Withdraw consent for data processing

8. Cookies

We use essential cookies for authentication and OAuth security (e.g., CSRF state tokens). These are httpOnly cookies that expire within 10 minutes. We do not use tracking or advertising cookies.

9. Children

Our service is not directed to children under 13. We do not knowingly collect personal information from children under 13.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the platform.

11. Contact

For privacy-related questions or requests, contact us at privacy@thecontentengine.com.