Privacy policy

What we collect

• Your account: your email address and, if you sign in with Google, your name and profile picture from your Google account.
• Your business: what you tell the strategist about your business, customers, products, prices and plans, your brand kit (name, colours, fonts, logo), and any brand document you upload to read a kit from. Brand documents are deleted as soon as they have been read.
• Your campaigns: the strategies, plans, posts and images ContentOS generates for you, your edits and approvals, and the publishing schedule.
• Photos and videos you give us: files you upload from your device, and files you choose from Google Drive.
• Connected accounts: when you connect Google Drive, Instagram or a Facebook Page, the access tokens those services issue, and the account or Page name and id. Tokens are encrypted before they are stored.
• Technical data: the cookies needed to keep you signed in and to complete a connection safely, and server logs used to run and secure the service. We do not use advertising or tracking cookies.

Google user data

ContentOS asks Google for your basic profile and email (to sign you in) and for drive.file access to Google Drive. drive.file gives ContentOS access only to the files you pick in the Google Picker or that ContentOS itself creates. It cannot see the rest of your Drive.

For each file you pick, ContentOS downloads it to make a small thumbnail, describes what is in the photo with an AI model so it can match photos to posts, and uses the photo in the posts it designs for you. We store the thumbnail, the description, and the file’s Drive id and name; the original stays in your Drive.

We use Google user data only to provide these features to you. We do not sell it, use it for advertising, or use it to train AI models, and people at Common Memory Labs do not read it except with your permission, for security, or where the law requires.

ContentOS’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Instagram and Facebook

When you connect Instagram or a Facebook Page, ContentOS uses the access Meta grants to publish the posts you have approved at the times you scheduled, to check that they were published, and to keep the connection working. ContentOS does not read your messages, followers or other accounts’ content.

How we use your information

• To run the conversation, and to write, check, design and publish your content.
• To send you sign-in links and messages about your account and your posts.
• To keep the service secure, fix problems, and prevent abuse.
• To meet legal obligations.

We do not sell your information, and we do not use it for advertising.

AI processing

ContentOS uses Google’s Gemini models on Google Cloud Vertex AI to run the conversation, write and check your content, and describe your photos. Google processes this data as our service provider under the Google Cloud terms and does not use it to train its models.

Who processes data for us

We use these providers to run ContentOS. Each processes data only on our instructions:

• Supabase: database, sign-in, and file storage (EU).
• Railway: application hosting (EU).
• Trigger.dev: background jobs such as generation and publishing.
• Google Cloud: AI models (Vertex AI).
• Resend: sign-in and account emails.
• Cloudflare: network and security.
• Meta and Google: when you connect them, to publish to and read from your accounts.

How long we keep it

• Photos and videos uploaded from your device: the original file is deleted 30 days after upload. The thumbnail and the posts already made from it are kept with your campaigns.
• Brand documents: deleted as soon as they have been read.
• Connected account tokens: until you disconnect the account, or it stops working and is not reconnected.
• Everything else: for as long as you have an account, then deleted as below.

Your choices and rights

• Disconnect Google Drive, Instagram or Facebook at any time in ContentOS. You can also remove ContentOS’s access to your Google account at myaccount.google.com/permissions.
• Edit or remove your posts, photos and brand kit in the app.
• To get a copy of your data, correct it, or delete your account and everything in it, email [email protected]. We delete accounts within 30 days of a request.

Security

Data is encrypted in transit. Access tokens are encrypted at rest with a key the database does not hold, and access to each business’s data is enforced in the database itself.

Children

ContentOS is a tool for businesses and is not meant for anyone under 18.

Changes

If we change this policy, we will update the date above, and tell you in the app or by email before a significant change takes effect.

Contact

Common Memory Labs, operator of ContentOS: [email protected].