Privacy policy

This policy explains how Blissfulplan Publishing Ltd (“ContentArc”, “we”) handles personal data when you use contentarc.app and the ContentArc app at app.contentarc.app. We are the controller of this data.

Data we collect

• Account data: email address, name (optional), preferred language, sign-in history.
• Content you provide: products and brands in your Brand Brain (including your brand kit and logo), campaign ideas, the content generated and edited in the app, and the images created or uploaded for your posts.
• Usage data: counts of campaigns and AI rewrites (to apply plan limits).
• Billing data: plan, subscription status and a Stripe customer reference. Card details are collected and stored by Stripe, never by us.
• Email preferences: whether you opted in to marketing emails, and when.
• Contact form: your name, email and message when you write to us.
• Technical data: IP address and request logs kept by our hosting provider for security.
• Connected social accounts: the name, handle and profile picture of each account you connect, the posts you schedule, their images and their publishing results. Access to your social accounts is held by our publishing provider (Upload-Post), not by us.
• Performance data: the counters each network reports for your published posts (such as views, likes, comments, shares and clicks).
• Link clicks: if you turn on click tracking, the number of clicks on each short link and the time of the latest click. We don't store who clicked.
• Niche and competitor watch: your niche description, the competitors you choose to follow (names, websites or public handles) and the reports written from public web pages.
• SaaS demo videos: your app's address or the app build you upload, the test account you provide (stored encrypted), the storyboard, and the screenshots, recordings and videos made of your app.
• API and webhooks: a fingerprint of each API key (never the key itself), your webhook addresses and a log of their deliveries.

How we use it

• To provide the service: authenticate you, store your work and generate campaigns (contract).
• To process payments and manage subscriptions (contract, legal obligations).
• To send service emails such as sign-in links, welcome and billing messages (contract).
• To send product updates and tips, only if you opted in (consent, withdrawable anytime).
• To keep the service secure and prevent abuse (legitimate interest).
• To answer your messages (legitimate interest).

We do not sell your personal data and we do not use your content to train AI models.

Service providers

We share data only with providers that process it on our behalf to run ContentArc:

• Supabase: database, authentication and file storage.
• Cloudflare: website and application hosting, security and spam protection for forms.
• Stripe: payments and subscription billing.
• Brevo: transactional email, contact management and (if you opted in) newsletters.
• AI model providers (such as Anthropic, OpenAI, Google or DeepSeek): your product details and campaign ideas are sent to the model that generates or rewrites your content. We use their business APIs; how each provider handles API data is set out in its own terms.
• Upload-Post: publishes the posts you approve to the social accounts you connect, and holds the access you grant to those accounts.
• Image model providers (such as Black Forest Labs, Ideogram, OpenAI, Google or Cloudflare Workers AI): a text description of the image, written from your post or slide, is sent to generate post and slide images.
• Stock photo providers (such as Pexels, Pixabay or Unsplash): when you choose stock photos, a few search words written from your post or slide are sent to find matching photos. No personal data is sent.
• Other publishing routes: depending on how you connect an account, posts go out directly through the network's own API (Meta for Facebook and Instagram, Threads, Bluesky) or through Zernio or Buffer, which then hold the access you grant.
• Browserless: runs the cloud browser that opens your web app to record SaaS demo videos.
• Appetize: runs the hosted Android and iPhone devices for mobile demo videos, using the app build you upload.
• Shotstack: assembles videos from scripts, screenshots and recordings. Voice-overs are generated by an AI text-to-speech provider (such as OpenAI).
• AI video and voice providers (such as fal.ai, Hugging Face, LTX, Google Gemini, ElevenLabs or Microsoft Azure): a short text prompt describing a reaction clip, or the script lines of a video, is sent to generate video clips or voice-overs. Recordings and reaction clips you upload are stored with Supabase and sent to the video renderer (Upload-Post's FFmpeg service or Shotstack).
• Web research: the niche and competitor watch uses an AI model provider's web search (such as Anthropic's). It receives your niche description and the competitors you follow, not your account data.

Some providers process data outside the UK and the European Economic Area, including in the United States. Where required, transfers rely on appropriate safeguards such as the UK International Data Transfer Addendum and the European Commission's standard contractual clauses.

Cookies and local storage

The app uses strictly necessary cookies to keep you signed in and remember your language and time zone (so dates and posting times are shown in your local time), and your browser's local storage to remember your theme and unsaved drafts. This website uses a language cookie and local storage for your theme; it does not use advertising or tracking cookies.

Retention

We keep your account and content while your account is active. You can ask us to delete your account at any time by email; we then delete your personal data within 30 days, except records we must keep for legal or accounting reasons (such as invoices). Contact-form messages are kept for up to 24 months.

Your rights

Depending on where you live (including under the UK GDPR and the EU GDPR), you can access, correct, export or delete your data, object to or restrict certain processing, and withdraw consent at any time. Unsubscribe from marketing emails with the link in any email or in the app's Settings. To exercise your rights, email [email protected]. You may also complain to a data protection authority: in the UK, the Information Commissioner's Office (ico.org.uk), or the authority in your EU country of residence.

Security

Data is encrypted in transit, access is restricted with row-level security, and secrets are held server-side only. No system is perfectly secure, but we work to protect your information.

Children

ContentArc is not intended for anyone under 16, and we do not knowingly collect their data.

Changes

We'll update this page when our practices change and notify you of significant changes by email or in the app.

Contact

Questions about privacy? Write to [email protected] or use our contact form. You can also reach Blissfulplan Publishing Ltd at [email protected] or by post at Covent Garden, 71-75 Shelton Street, London, WC2H 9JQ, UK.

Who we are

ContentArc is operated by Blissfulplan Publishing Ltd, a company registered in England & Wales under company number 15418196, with its registered office at Covent Garden, 71-75 Shelton Street, London, WC2H 9JQ, UK. Company email: [email protected].