Privacy Policy

Effective date: July 11, 2026

This policy explains how ContentFast ("we", "us") processes personal data when you use contentfast.ai (the "Service"). The data controller is the owner of ContentFast, an individual based in Portugal. Contact: hello@contentfast.ai. We process personal data in accordance with the EU General Data Protection Regulation (GDPR).

1. Data we process

Account data — email address, name (if provided), authentication identifiers (including Google sign-in identifiers if you use it).
Content — posts, captions, phrases, hashtags, photos and videos you upload or create.
Connections — identifiers of social accounts you connect (handles, platform account ids held by our publishing partner) and Telegram chat identifiers. We never see your social-network passwords.
Billing data — plan, credit balance and transaction history; Stripe customer and subscription identifiers. Card details are processed by Stripe and never touch our servers.
Usage data — actions that consume credits, timestamps, technical logs (IP address, user agent) produced by our hosting providers for security and operations.

2. Purposes and legal bases

Providing the Service (hosting your content, publishing to connected platforms, delivering to Telegram, billing) — performance of a contract, Art. 6(1)(b) GDPR.
AI features (text you select is sent to AI providers to generate suggestions) — performance of a contract, Art. 6(1)(b).
Security, fraud and abuse prevention, service improvement — legitimate interests, Art. 6(1)(f).
Accounting and tax records — legal obligation, Art. 6(1)(c).

We do not sell personal data and we do not use advertising trackers.

3. Processors and recipients

We share data only with processors needed to run the Service:

Supabase — database, authentication and file storage.
Cloudflare — hosting and content delivery.
Stripe — payment processing.
Post for Me — publishing to social networks you connect.
Telegram — delivery of your posts to your Telegram chats.
AI model providers (via the Lovable AI gateway) — processing of text you submit to AI features. We do not permit training on your data by contract where such controls are offered.
Google — optional sign-in.

Some processors are located outside the EU/EEA (including the United States). Transfers rely on adequacy decisions (e.g. the EU–US Data Privacy Framework) and/or Standard Contractual Clauses.

4. Retention

Account data and Content — for as long as your account exists; deleted within 30 days after account deletion.
Media (photos and videos) — deleted from storage when you delete the file, its post, or the brand profile it belongs to, and in full when you delete your account. We do not keep media beyond what is needed to run the Service.
Billing and tax records — retained for the period required by Portuguese law (up to 10 years).
Technical logs — short rotation periods set by our hosting providers.

5. Your rights

Under the GDPR you have the right to access, rectify, erase and receive a copy of your personal data, to restrict or object to processing, and to withdraw consent where processing is based on consent. To exercise any right, write to hello@contentfast.ai. You also have the right to lodge a complaint with a supervisory authority — in Portugal, the CNPD (Comissão Nacional de Proteção de Dados, cnpd.pt), or the authority of your country of residence.

6. Security

Data is encrypted in transit; media files are stored in private buckets and served only through short-lived signed links; database access is isolated per user (row-level security); bot tokens and API keys are kept server-side only. No system is perfectly secure — if we learn of a breach affecting your data, we will notify you and the authorities as required by law.

7. Cookies

We use essential cookies and local storage to keep you signed in and remember interface preferences (such as theme) — these are always active and require no consent. If analytics is enabled on the site, we additionally use Google Analytics (with IP anonymisation) to understand how the site is used — its cookies are set only after you accept them in the consent banner (legal basis: consent, Art. 6(1)(a) GDPR; Google may process this data in the US under the EU–US Data Privacy Framework). We do not use advertising or cross-site tracking cookies.

8. Children

The Service is not directed at persons under 18, and we do not knowingly process their data.

9. Changes

We may update this policy. For material changes we will give notice in the Service or by email. The current version is always available at this address.