Content PlannerContent Planner Privacy Policy
This Privacy Policy describes how UConvert Marketing (“UConvert,” “we,” “us,” or “our”) collects, uses, stores, and protects personal information when you use Content Planner (the “Platform”), our SaaS application for social media content planning, AI-assisted generation, review, and publishing. By accessing or using the Platform, you agree to the practices described in this Policy.
1Data Controller
The data controller responsible for your personal information is:
Website: content-planner.uconvertmarketing.com
Privacy inquiries: privacy@uconvertmarketing.com
Response time: within 30 days (45 days for CCPA requests)
2Information We Collect
We collect only the data necessary to operate the Platform:
Account Data
- Name and email address — used to create and identify your account.
- Password — stored as a one-way bcrypt hash; we never store or access your plain-text password.
- Workspace role — admin, editor, or reader, as assigned within your organization’s workspace.
- Google profile data (optional) — if you register or log in via Google OAuth, we receive your name, email, and profile picture solely for account creation and authentication.
Social Platform Data (OAuth Connections)
When you connect a social media account, we receive only the data required to operate that integration:
- Access token and refresh token — issued by the respective platform; stored encrypted with AES-256-GCM. We never access your social media password.
- Public account identifiers — Page ID, Instagram Business Account ID, LinkedIn Organization ID, or TikTok Open ID.
- Public profile metadata — account name, avatar URL, and category as returned by the platform’s API.
- TikTok-specific — display name and avatar URL obtained via TikTok Login Kit.
Content and Campaign Data
- Content calendars, post drafts, captions, images, videos, carousel slides, and story frames you create within the Platform.
- Internal review comments, approval statuses, and editorial feedback from workspace members.
- AI-generated draft content created at your request using Anthropic Claude.
Publishing and Performance Data
- Post identifiers returned by social platform APIs after successful publication.
- Publication timestamps and status (success / failure).
- Performance metrics (impressions, reach, engagement, follower count) retrieved from platform APIs only when you explicitly request them.
Technical and Usage Data
- IP address, browser user-agent, and access timestamps — retained for 90 days for security and debugging purposes.
- Error logs and API response metadata — retained for 90 days.
Cookies
We use strictly necessary cookies to maintain authenticated sessions. We do not use tracking, advertising, or analytics cookies. No third-party cookies are set by the Platform. If this changes, we will update this Policy and seek your consent where required by law.
3How We Use Your Information
- Service delivery — authenticate users, manage sessions, route content across workspaces, and operate the publishing pipeline.
- Publishing on your behalf — post content to connected social accounts only when explicitly scheduled or triggered by an authorized workspace member.
- Insights retrieval — fetch performance metrics from platform APIs on your request.
- AI content generation — transmit your editorial instructions to Anthropic Claude to produce draft copy. Your prompts and generated drafts are not used to train any AI model by UConvert or Anthropic.
- Transactional communications — send account verification emails, workspace invitations, and publishing-failure alerts via Resend.
- Security and fraud prevention — detect unauthorized access, abuse, or API misuse.
4Legal Basis for Processing (GDPR)
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under the following legal bases:
| Processing Activity | Legal Basis |
|---|---|
| Account creation, authentication, and session management | Performance of contract (Art. 6(1)(b) GDPR) |
| Publishing content to connected social accounts | Performance of contract + explicit consent via OAuth authorization flow |
| Retrieving social media insights and metrics | Performance of contract + your explicit on-demand request |
| Sending transactional emails | Performance of contract (Art. 6(1)(b) GDPR) |
| Security logging and fraud prevention | Legitimate interest (Art. 6(1)(f) GDPR) |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c) GDPR) |
5Platform-Specific Data Practices
Our use of data obtained through each platform’s API is strictly limited to the purposes stated below and complies with each platform’s developer policies.
- We use Meta API data (Page IDs, IG Business Account IDs, access tokens, post metrics) solely to publish content and retrieve insights on your behalf.
- We do not use Meta user data to serve advertisements, build audience profiles, or train machine learning models.
- We do not sell or transfer Meta user data to third parties for any purpose.
- We do not retain Meta user data after you revoke access or your account is deleted, except as required by applicable law.
- We comply with the Meta Platform Terms and the Meta Platform Policy.
- For data deletion requests initiated through Meta, see our Data Deletion page.
- We use LinkedIn API data (Organization IDs, access tokens, post metrics) solely to publish content and retrieve basic analytics on behalf of accounts you connect.
- We do not use LinkedIn data to build user profiles for advertising, benchmarking, or any purpose beyond providing the Platform to you.
- We do not sell LinkedIn user data or share it with third parties for commercial gain.
- We comply with the LinkedIn API Terms of Use.
- We use TikTok APIs (Login Kit, Content Posting API, Video API) solely to authenticate connected TikTok accounts, read video metrics, and publish content on your behalf.
- We collect your TikTok Open ID, display name, and avatar URL exclusively to identify your account within the Platform.
- We do not use TikTok user data for advertising, profiling, or any purpose unrelated to the Platform service.
- We do not sell or transfer TikTok user data to third parties.
- We do not retain TikTok user data after you revoke access or your account is deleted.
- We comply with the TikTok Developer Terms of Service. Content Planner is not affiliated with TikTok Inc.
- When you connect a TikTok account, TikTok Inc. may independently collect data pursuant to TikTok’s own Privacy Policy.
- If you sign in with Google, we receive your name, email address, and profile picture from Google as permitted by your Google account settings.
- We use this data exclusively for account creation and authentication. We do not access your Google Drive, Gmail, Calendar, or any other Google service.
- Our use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not shared with any third party for advertising, analytics, or any purpose other than authentication.
6AI-Assisted Content Generation
The Platform uses the Anthropic Claude API to generate draft content based on your editorial instructions. Key points:
- Your prompts and the generated drafts are processed by Anthropic, Inc. pursuant to Anthropic’s Privacy Policy.
- Anthropic does not use API inputs or outputs to train its models under its API usage policy.
- UConvert does not use your content, prompts, or generated drafts to train any AI model.
- AI-generated content is a draft suggestion requiring your review and approval before publication. UConvert does not guarantee the accuracy, originality, or legal compliance of AI-generated content.
7Data Sharing and Third Parties
We share data only with the following service providers, each bound by confidentiality obligations and data processing agreements:
| Provider | Purpose | Data Shared |
|---|---|---|
| Railway | Application hosting and database | All application data (encrypted at rest) |
| Resend | Transactional email delivery | Name and email address |
| Anthropic | AI content generation | Editorial prompts and instructions you provide |
| Meta Platforms Inc. | Content publishing and insights API | Post content for connected accounts |
| LinkedIn Corporation | Content publishing and insights API | Post content for connected accounts |
| TikTok Inc. | Content publishing and insights API | Post content for connected accounts |
| Google LLC | OAuth authentication (optional) | Name and email (only if you sign in with Google) |
We do not sell personal data. We do not share data with advertisers, data brokers, or any party for commercial monetization. We may disclose data if required by law, court order, or government authority, or to protect the rights and safety of UConvert, its users, or third parties.
8Data Retention
- Account data — retained while your account is active and for 30 days after deletion to allow recovery.
- Content and campaigns — retained until you or a workspace administrator deletes them.
- OAuth tokens — retained until you revoke the connection or your account is deleted; deleted immediately upon revocation.
- Technical logs — retained for 90 days for security and debugging.
- Legally mandated records (e.g., invoicing, anti-fraud) — retained for the minimum period required by applicable law.
9International Data Transfers
UConvert is based in Argentina. Your data may be processed in servers located in the United States or other countries through our service providers (Railway, Anthropic, Resend). When transferring data from the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms recognized under applicable data protection law.
10Your Rights
Rights Under GDPR (EEA / UK / Switzerland)
- Access — obtain a copy of the personal data we hold about you.
- Rectification — correct inaccurate or incomplete data.
- Erasure (“right to be forgotten”) — request deletion of your personal data. See our Data Deletion page.
- Data portability — receive your data in a structured, machine-readable format.
- Restriction — request that we limit processing of your data under certain circumstances.
- Objection — object to processing based on legitimate interests.
- Withdraw consent — disconnect social media accounts at any time from the Connections settings page.
- Lodge a complaint — if you believe we have violated applicable data protection law, you may file a complaint with your local supervisory authority.
Rights Under CCPA (California Residents)
If you are a California resident, the California Consumer Privacy Act (CCPA) grants you additional rights:
- Right to Know — request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months.
- Right to Delete — request deletion of personal information we have collected, subject to certain exceptions.
- Right to Opt-Out of Sale — we do not sell personal information. If our practices change, we will update this Policy and provide an opt-out mechanism.
- Right to Non-Discrimination — we will not discriminate against you for exercising any CCPA right.
- Shine the Light (Cal. Civil Code § 1798.83) — we do not disclose personal information to third parties for their direct marketing purposes.
To exercise California rights, contact privacy@uconvertmarketing.com. We respond within 45 days.
To exercise any rights listed above, contact us at privacy@uconvertmarketing.com. We respond within 30 days.
11Security
We implement reasonable technical and organizational measures to protect your data, including:
- Encryption in transit (HTTPS/TLS for all connections).
- Encryption at rest for OAuth tokens (AES-256-GCM).
- One-way bcrypt hashing for passwords.
- Role-based access control limiting data access to authorized workspace members.
- Periodic security reviews and dependency audits.
No system is perfectly secure. In the event of a data breach affecting your personal information, we will notify affected users and relevant authorities as required by applicable law.
12Children’s Privacy
The Platform is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you become aware that a child has provided us with personal information, please contact us at privacy@uconvertmarketing.com and we will promptly delete such information.
13Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above. For material changes, we will notify active users via email with at least 14 days’ notice before the changes take effect. Continued use of the Platform after the effective date constitutes acceptance of the revised Policy.
14Contact
For questions, requests, or concerns about this Privacy Policy or our data practices:
Email: privacy@uconvertmarketing.com
Response time: within 30 days (45 days for CCPA requests)