Privacy Policy

Effective date: July 11, 2026

This policy explains how ContentFast ("we", "us") processes personal data when you use contentfast.ai (the "Service"). The data controller is the owner of ContentFast, an individual based in Portugal. Contact: hello@contentfast.ai. We process personal data in accordance with the EU General Data Protection Regulation (GDPR).

1. Data we process

Account data — email address, name (if provided), authentication identifiers (including Google sign-in identifiers if you use it).
Content — posts, captions, phrases, hashtags, photos and videos you upload or create.
Connections — identifiers of social accounts you connect (handles, platform account ids held by our publishing partner) and Telegram chat identifiers. We never see your social-network passwords.
Billing data — plan, credit balance and transaction history; Stripe customer and subscription identifiers. Card details are processed by Stripe and never touch our servers.
Usage data — actions that consume credits, timestamps, technical logs (IP address, user agent) produced by our hosting providers for security and operations.

2. Purposes and legal bases

Providing the Service (hosting your content, publishing to connected platforms, delivering to Telegram, billing) — performance of a contract, Art. 6(1)(b) GDPR.
AI features (text you select is sent to AI providers to generate suggestions) — performance of a contract, Art. 6(1)(b).
Security, fraud and abuse prevention, service improvement — legitimate interests, Art. 6(1)(f).
Accounting and tax records — legal obligation, Art. 6(1)(c).

We do not sell personal data and we do not use advertising trackers.

3. Processors and recipients

We share data only with processors needed to run the Service:

Supabase — database, authentication and file storage.
Cloudflare — hosting and content delivery.
Stripe — payment processing.
Post for Me — publishing to social networks you connect.
Telegram — delivery of your posts to your Telegram chats.
AI model providers (via the Lovable AI gateway) — processing of text you submit to AI features. We do not permit training on your data by contract where such controls are offered.
Google — optional sign-in.

Some processors are located outside the EU/EEA (including the United States). Transfers rely on adequacy decisions (e.g. the EU–US Data Privacy Framework) and/or Standard Contractual Clauses.

4. Retention

Account data and Content — for as long as your account exists; deleted within 30 days after account deletion.
Media (photos and videos) — deleted from storage when you delete the file, its post, or the brand profile it belongs to, and in full when you delete your account. We do not keep media beyond what is needed to run the Service.
Billing and tax records — retained for the period required by Portuguese law (up to 10 years).
Technical logs — short rotation periods set by our hosting providers.

5. Your rights

Under the GDPR you have the right to access, rectify, erase and receive a copy of your personal data, to restrict or object to processing, and to withdraw consent where processing is based on consent. To exercise any right, write to hello@contentfast.ai. You also have the right to lodge a complaint with a supervisory authority — in Portugal, the CNPD (Comissão Nacional de Proteção de Dados, cnpd.pt), or the authority of your country of residence.

6. Security

Data is encrypted in transit; media files are stored in private buckets and served only through short-lived signed links; database access is isolated per user (row-level security); bot tokens and API keys are kept server-side only. No system is perfectly secure — if we learn of a breach affecting your data, we will notify you and the authorities as required by law.

7. Cookies and analytics

We use essential cookies and local storage to keep you signed in and remember interface preferences (such as theme and language) — these are always active and require no consent. We also store your cookie choice itself locally so we do not ask again.

For statistics we use Google Analytics 4, provided by Google Ireland Limited, with IP anonymisation enabled. Its cookies (_ga, _ga_*, typically valid up to 24 months) are set only after you accept them in the consent banner, and no analytics script is loaded before that. Legal basis: your consent, Art. 6(1)(a) GDPR — you may withdraw it at any time using the link below. We collect aggregated usage data only (pages viewed, referrer, approximate region, device and browser type); we do not use advertising, remarketing or cross-site tracking cookies, and we do not sell this data. Google may process this data in the United States under the EU–US Data Privacy Framework and Standard Contractual Clauses. Google's own privacy information: policies.google.com/privacy. If you decline, the Service works exactly the same.

8. Children

The Service is not directed at persons under 18, and we do not knowingly process their data.

9. Changes

We may update this policy. For material changes we will give notice in the Service or by email. The current version is always available at this address.