This policy explains how TrueThinks Ltd ("we", "us") handles personal data when you visit our website or use Contentrue. We are a company registered in England and Wales (number 16779253), registered office 128 City Road, London, EC1V 2NX, United Kingdom. We comply with the UK GDPR and the Data Protection Act 2018. Questions or requests: hello@contentrue.com.
1. Our roles
- Controller. For your account, billing, security, support and the use of our website and app, we decide why and how personal data is used, so we are the controller.
- Processor. For the content you put into Contentrue (brand material, media, captions, comments and the like) and the data of your social accounts and audience, you decide what we do with it, and we process it on your behalf as your processor. Our Data Processing Addendum sets out those terms. If you are an individual using Contentrue for yourself, we are still the processor for your content as far as it contains other people's data.
2. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account | Name, email address, language, sign-in method (email code or Google), session information | You; Google if you choose Sign in with Google |
| Workspace and team | Members, roles, invitations, activity and audit records | You and your team |
| Billing | Billing email and address, VAT number, plan, invoices, payment status and a Stripe customer reference. Card details go to Stripe; we do not see or store them. | You; Stripe |
| Connected social accounts | Account identifiers, handles and profile names, the access tokens you authorise, granted permissions, publishing quotas, performance statistics (such as reach and engagement) and, where enabled, comments and messages | Meta (Instagram and Facebook) and X, when you connect an account |
| Your content | Brand kits, recipes, topics, prompts, uploaded and generated images, video and audio, captions, schedules, reviews and comments, including any personal data they contain | You; AI providers on your instructions |
| Client reviewers | Name and comments entered on a client approval link | The person using the link |
| Usage and technical | IP address, device and browser details, pages and actions, credit usage, error and performance reports, security logs | Your device; our systems |
| Communications | Emails and messages you send us, and service emails we send you | You; us |
We do not intentionally collect special category data. Please do not put it in Your Content unless you need to. We do not sell personal data and we do not use it for advertising.
3. Why we use it, and our lawful bases
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Create and run your account, authenticate you, provide the Service, generate and publish content you approve | Contract |
| Take payment, issue invoices, keep tax and accounting records | Contract; legal obligation |
| Keep the Service secure, prevent fraud and abuse, fix errors, monitor reliability | Legitimate interests (running a safe, reliable service) |
| Respond to your questions, send service messages (approvals, failed posts, expiring connections, renewal reminders) | Contract; legitimate interests |
| Improve the Service from aggregate usage data | Legitimate interests |
| Send product news or marketing, if we ever do | Consent, or soft opt-in for existing customers under PECR, always with an easy opt-out |
| Comply with law, respond to lawful requests, establish or defend legal claims | Legal obligation; legitimate interests |
| Process the content and audience data in Your Content for you | Under your instructions as your processor (you are responsible for your own lawful basis) |
Where we rely on legitimate interests we have weighed them against your rights; you can object (see section 9).
4. Who we share it with
- Service providers (subprocessors) who host, secure, pay, email, monitor or generate content for us, listed on our Subprocessors page: DigitalOcean, Cloudflare, Stripe, OpenAI, Google (Gemini), Anthropic, Resend and Sentry.
- Social networks you connect (Meta and X), to publish content, read statistics and, where enabled, handle comments, under their terms.
- Your team members according to the roles you set, and anyone you give an approval link.
- Professional advisers, authorities and others where required by law or to protect rights, and a successor if our business is sold or restructured (with the same protections for your data).
AI providers receive only what is needed to complete a request (for example a prompt, reference images and text to be narrated). We use their business or API services, whose terms do not permit them to train their models on your content by default.
5. International transfers
Our application and database run on a server operated by DigitalOcean in London, UK, behind Cloudflare, which acts as a content delivery network and security proxy and operates globally. Some other providers process data in the United States or other countries outside the UK. Where we transfer personal data from the UK to a country without a UK adequacy decision, we use a lawful safeguard: the UK-US data bridge where the recipient participates in it, otherwise the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment where needed. You can ask us for a copy of the safeguards at hello@contentrue.com.
6. How long we keep it
- Account data: while your account is open; deleted or anonymised after closure.
- Your content and connected-account data: while your workspace exists. If a workspace has had no active plan for 90 days (and has not been granted free access by us) we schedule it for deletion, after emailing you 14 days and 3 days beforehand. If you delete a workspace yourself, or it is scheduled for deletion, it stays read-only for 7 days so it can be restored, then its content and media are permanently deleted (about 97 days in total after a plan ends). If you disconnect a social account or the platform tells us you removed our app, we delete the tokens and data we received from that account.
- Billing and tax records: 6 years, as UK tax and company law require. We keep the minimum and anonymise usage records tied to a deleted account.
- Security and operational logs and error reports: application logs are rotated daily and kept for 30 days, unless needed to investigate an incident. Error reports are kept by our monitoring provider for a limited period.
- Backups: the database is backed up daily and each backup is kept for 14 days. Uploaded media is archived weekly and the last 4 copies are kept. Backups are held on access-restricted infrastructure of our hosting provider. Deleted data therefore remains in backups until those copies expire.
- Support emails: for as long as needed to help you and handle any follow-up, then deleted.
7. Security
We use measures appropriate to the risk, including encryption in transit between you and our service, access controls and least privilege for staff, workspace-level separation of customer data, secure handling of social-account tokens, monitoring and backups. No system is perfectly secure. If a breach is likely to put your rights at risk we will notify you and, where required, the ICO.
8. Automated decisions and AI
We use AI to generate content you ask for. We do not make decisions about you that have legal or similarly significant effects by purely automated means. Nothing is published to your accounts without human approval. See our AI Transparency note.
9. Your rights
Under UK GDPR you have the right to be informed, to access your data, to have it corrected, to have it erased, to restrict or object to its use, to data portability, and to withdraw consent at any time. Contact us at hello@contentrue.com; we reply within one month and may ask you to verify your identity. You can export and delete much of your data yourself in the app; see Data Deletion. If you are someone whose data is in a customer's content, please contact that customer first; we will help them respond. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.
10. Children
Contentrue is for people aged 18 and over. We do not knowingly collect children's personal data. If you believe a child has given us data, email us and we will delete it.
11. Cookies
We use only strictly necessary cookies. See our Cookie Policy.
12. Changes
We will update this policy as our service or the law changes. The date at the top shows the latest version, and we will tell you of material changes by email or in the app.