Draft. Last updated November 2026.

Privacy Policy

The Content Machine Pty Ltd, ACN 703 914 890, an Australian company ("we", "us") runs this website and the service behind it. This policy explains what personal information we collect, why, who we share it with, and what you can do about it. It is written to follow the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). We intend to follow them whether or not the Act binds us today.

Contact for anything in this policy: the contact form on this website at /request-access. Choose "Privacy request" (to see, correct or delete what we hold about you) or "General question". We do not have a public email address yet; a person reads every message and replies by email.

1. Who this policy covers

People who ask for access or write to us through the form on this website.
Customers: people who sign in to a workspace (owners, admins, editors, approvers, viewers).
People connected to a customer's accounts: for example the person whose Facebook, Google or TikTok login was used to connect an account.
Our customers' customers and website visitors: people whose orders, payments or website visits are read so a customer can see which ads led to sales. For this information our customer decides what is collected and why; we handle it on their behalf.
Members of the public whose public posts, reviews, comments or ads appear in research results.

2. What we collect

2.1 The request form on this website

Accounts are by request. When you ask for access, ask a question or make a privacy request through the form, we collect:

what you type: your name, email address, business name, website, role, industry, country, a rough monthly ad spend band, where you advertise now, and your message;
what kind of message it is (request for access, general question, privacy request) and when you sent it;
your browser's user-agent text, and a one-way scrambled fingerprint of your internet (IP) address. We do not store the address itself. The address is also used briefly to limit how many requests one connection can send;
for a request for access: our decision (approved or declined), who on our staff made it and when, and any note they wrote.

Why: to decide whether we can take you on as a customer, to reply to you, to answer privacy requests, and to stop robots and abuse. We do not use these details for marketing and we do not sell them.

If you are approved: we give your email address to our sign-in provider (Clerk) so it can email you an invitation to set up your sign-in. Your request then stays linked to your account.

How long: a request for access is kept while it is open and, if you become a customer, for as long as you have an account. Questions and privacy requests are kept so we have a record of what was asked and answered. No fixed deletion period has been set yet for requests that are declined or never taken up; until one is set, we delete them when asked.

To have it deleted: send a "Privacy request" through the same form from the email address you used. We will delete your request and tell you when it is done, unless the law requires us to keep it.

The form does not set cookies.

2.2 Account details

Your email address, name and a sign-in ID. Sign-in is run by Clerk, a sign-in provider. Clerk handles your password or social sign-in; we never see your password. A sign-in can only be created from an invitation: after we approve your request for access, or when a workspace invites you as a teammate (in both cases we give Clerk your email address so it can send the invitation).
Your workspace: name, country, currency, time zone, plan, and each member's role.
Invitations you send (the email address invited).
A record of important actions (who did what, when), including who approved or signed each ad and what they ticked.
Error reports from your browser when something breaks.

2.3 Billing details

Plan, payment status, invoices and credit use. Card payments are taken by Stripe; we do not see or store card numbers. We store Stripe's customer and subscription IDs.

2.4 Brand materials and content

Everything in your brand kit: logos, fonts, colours, images, voice samples, product details, claims, offers, tone, audience notes.
Text we read from your website when you ask us to set up a brand from it.
Videos, images and audio you upload, and videos fetched from a link you paste.
Transcripts of your videos (words with timings). A transcript can contain the names and voices of people who appear in the video.
Ads, storyboards, scripts, captions, thumbnails and clips made in the service, and notes people leave on them.
A record of which parts of each ad were AI-made.

2.5 Information read from accounts you connect

We only read what is listed here. You choose which account, page or channel we may use; we do not touch the others.

Facebook & Instagram (Meta)

Permissions we ask for: ads_management, ads_read, business_management, pages_show_list, pages_read_engagement, pages_manage_posts, instagram_basic, instagram_content_publish.
At sign-in: your Facebook app-scoped user ID and display name, the client business ID if there is one, and the list of permissions granted.
To let you choose: the ad accounts you can use (ID, name, currency, time zone, status, owning business name and whether it is verified), the Pages you manage (ID, name, category, linked Instagram business account ID and username), and the pixels on the ad account (ID, name, when last used).
What we keep for the connection: the ad account, Page, Instagram account and pixel you picked (IDs and names), currency, time zone, business ID, name and verification status.
Ad results, for ads the service created only: spend, impressions, reach, link clicks, 3-second video views, ThruPlays, complete views, landing-page views, purchases, purchase value, frequency, by day and half-hour, plus the raw result row Meta returned. Ads in your account that we did not create are not stored.
If you turn on "send sales to Meta": we send purchase events to the pixel/dataset you picked (see 2.7).

Google Ads

Permission: https://www.googleapis.com/auth/adwords.
To let you choose: the Google Ads accounts your login can reach (ID, name, currency, time zone, whether it is a manager or test account, status).
What we keep: the account you picked (customer ID, login customer ID, name, currency, time zone, test-account flag).
We create campaigns you approved (created paused) and read account status. Reading Google Ads results into the service is not built yet.

YouTube

Permissions: https://www.googleapis.com/auth/youtube.upload, https://www.googleapis.com/auth/youtube.readonly, https://www.googleapis.com/auth/yt-analytics.readonly.
To let you choose: your channels (ID, title, handle, subscriber count unless hidden, upload status).
What we keep: the channel you picked (ID, title, handle, country, whether long uploads are allowed).
We upload videos you approved; read your channel's recent uploads (title, description, length) so you can make clips from them; read per-video numbers (views, likes, comment count, shares, watch minutes, average percentage viewed); and read public comments on videos we posted, which are summarised by an AI model so you can see what your audience is saying. We store the numbers and the summary and sentiment score.

TikTok

Permissions: user.info.basic, video.upload, video.publish.
We read your TikTok open ID and display name, and keep those two. Posting straight to TikTok is not built yet; today TikTok posts go through the posting service.

Shopify

Permissions: read_orders, read_products, read_customers (read only).
What we keep for the connection: store address, store name, domain, currency, time zone, Shopify plan name.
From paid orders (from 7 days before you switch this on, then onwards): order ID and number, dates, subtotal and currency, the Shopify customer ID, cart attributes, the first and last visit's landing page and campaign tags, whether it is a subscription order. The buyer's email address is read, turned into a one-way hash (SHA-256) and only the hash is stored.

Stripe (your own Stripe account, as a sales source)

Access: a restricted read-only key you paste, or Stripe Connect with read_only.
What we keep for the connection: Stripe account ID, display name, default currency, country, live or test mode.
From completed Checkout Sessions: session ID, time, amount, currency, mode (one-off or subscription), Stripe customer ID, tracking values in the session's metadata. The buyer's email is hashed (SHA-256) and only the hash is stored.

Posting service (upload-post.com)

We create a profile for your brand at the vendor under a made-up name (not your business name). You sign in to each social network on the vendor's hosted screens; we never see those passwords or tokens.
We keep: which networks you linked and the handle or name of each.
When a post is due we send the vendor the video or image, caption and title.

2.6 Sales you upload

If you upload a spreadsheet of sales: date, order ID, value, currency, tracking tags. An email column, if present, is hashed and only the hash is stored.

2.7 The website tag (visitors to our customers' sites)

A customer can paste a small script on their own website. It:

sets a first-party cookie on the customer's site called cm_aid (a random ID, kept for 90 days);
when a visitor arrives from an ad, sends us: that random ID, the page address, the referring address, campaign tags (utm_source, utm_medium, utm_campaign, utm_content, utm_term), click IDs (fbclid, gclid, ttclid, msclkid), the values of Meta's _fbp and _fbc cookies if present, and the browser's user-agent text;
if the customer adds the purchase call to their thank-you page, sends us the order ID, value, currency and the buyer's email. We hash the email on arrival and store only the hash.

The visitor's IP address is used briefly to limit abuse and is not stored. We link the random visitor ID to a hashed email or shop customer ID when a sale is recorded, so a sale can be matched to the ad that led to it (the last paid click within 90 days by default).

Sending sales to Meta. Off by default. If a customer turns it on, for each sale we send Meta's Conversions API: the event (purchase or subscribe), time, order ID, value, currency, the hashed email, a hash of the visitor ID, the _fbp/_fbc values, the user-agent, and the page address.

The customer is responsible for telling their visitors about this tracking and getting any consent the law requires.

2.8 Research

When you run research we collect public material about your market: search results, public web pages (including review and forum pages), search suggestions, and ads in Meta's public Ad Library (through a data vendor). We store short quotes with their source address, competitor ads and summaries. This can include publicly posted comments or reviews written by individuals. We do not use anyone's login to collect it.

2.9 Sensitive information

We do not ask for sensitive information (such as health information). Please do not upload it. If your brand is in health, the claims you enter are business information, not personal health records.

3. How we collect it

From you, when you send the request form, sign in, upload, or type something in.
From platforms, when you connect an account and afterwards on a schedule (ad results about every 30 minutes; sales about every 10 minutes; connection health checks).
From our customers' websites through the website tag.
From public sources during research.

4. Why we collect, hold, use and disclose it

To provide the service: make, check, approve, post and advertise your content and show you results.
To keep the approval and audit record.
To bill you and manage credits.
To keep the service secure, find faults, and prevent misuse.
To contact you about your account (invitations, billing notices, service messages).
To meet legal obligations and platform rules.

We do not sell personal information. We do not use information from your connected accounts to advertise to you or to build profiles for other customers. We do not train AI models, on customer content or anything else.

5. How access to your accounts is stored

The access tokens and keys for your connected accounts are sealed with AES-256-GCM encryption before they are stored. The key is held separately from the database.
They are opened only on our servers, at the moment a job needs them. They are never sent to your browser, never shown on screen, and never written to logs.
When you disconnect, we delete our copy straight away and ask the platform to cancel the access.
Each customer's data is separated in the database so one workspace cannot read another's.
Files are stored under each customer's own folder and served through time-limited links.

No system is perfectly secure. If there is a data breach likely to cause serious harm, we will tell affected people and the Office of the Australian Information Commissioner as the law requires.

6. Cookies and similar

On this website and in the app:

Name	Who sets it	Purpose	How long
`__session` (and related Clerk cookies)	Clerk	Keeps you signed in	Set by Clerk
`cm_conn`	Us	Protects the account-connection sign-in from being hijacked	10 minutes
Browser storage (not cookies)	Us	Remembers the workspace and brand you last used, your light or dark colour choice, that this browser has signed in before (so the home address opens the app instead of the public page), and where to return you after sign-in	Until you sign out or clear it

Every page of this website and the app loads its typefaces from Google Fonts, and brand fonts are loaded from there when you preview them. This tells Google your IP address.

The public pages of this website (the home page, About, the request form and these legal pages) set no cookies.

We do not use advertising or analytics cookies on our own site today.

On our customers' sites: cm_aid, described in 2.7.

7. How long we keep it

What the service does today:

Information	Today
Access tokens for a connected account	Deleted when you disconnect, or when the platform tells us access was removed
Account choices for a connection	Deleted when you disconnect, or on a Meta data-deletion request
Connection history	Kept while the workspace exists
Ad results, sales records, hashed emails, website-tag visits	Kept with no time limit while the workspace exists
Videos, transcripts, brand materials, finished ads	Kept until you delete them or the workspace is deleted
Research results	Kept while the workspace exists
Approval and audit record	Kept while the workspace exists
Billing records	Kept as tax law requires
A workspace whose trial or plan has ended	Kept, so you can come back, until the owner deletes it
A workspace the owner has asked to delete	Deleted 7 days after the request (the owner can cancel before then). A record that the deletion happened is kept
Requests sent through the form on this website	See section 2.1
Backups	No fixed period has been set yet
The `cm_aid` cookie in a visitor's browser	90 days

Apart from the rows above, the service does not yet delete old information automatically while a workspace exists. We are setting fixed periods and will update this table when they are in place. Until then, a workspace owner can delete the workspace, and anyone can ask us to delete what we hold about them (section 8).

8. Deleting your information

Disconnect an account in the app. Connected accounts → Disconnect. We delete our copy of the access and the saved choices straight away and ask the platform to cancel it.
Remove our app at the platform.
- Facebook: if you remove the app in your Facebook settings, Facebook tells us and we delete our copy of your access at once. If you also send a deletion request, we delete the saved choices and your Facebook user ID as well, and Facebook gives you a confirmation code and a link to a status page on this website.
- Google and YouTube: remove access at https://security.google.com/settings/security/permissions (or https://myaccount.google.com/connections).
- TikTok: Settings and privacy → Security and permissions → Manage app permissions.
- Shopify: uninstall the app in your Shopify admin. Stripe: delete the restricted key, or remove the connected platform in Stripe.
Delete your workspace. The workspace owner can do this in the app: Workspace settings → "Delete this workspace". Everything in the workspace (brands, files, connected accounts, results) is deleted 7 days after the request, and the owner can cancel before then. An admin can delete a single brand the same way.
Ask us. Anyone can use the contact form on this website, choosing "Privacy request", to ask what we hold about them, to correct it, or to have it deleted. If the information was collected for one of our customers (for example you bought from a shop that uses us), we may pass your request to that customer and help them answer it.

We may keep what the law requires us to keep, and what we need to resolve a dispute.

We share personal information with the service providers below, only as needed to run the service. Most are outside Australia. By using the service you understand that information will be sent overseas to these providers.

9.1 Providers used by the service today

Provider	What is sent	Why	Where
Clerk	Email, name, sign-in session; the email address of a person we have approved or a workspace has invited	Sign-in, and emailing sign-in invitations	United States (believed; not yet confirmed)
Stripe (our billing)	Workspace owner's email, workspace ID, plan; card details go straight to Stripe	Taking payment	United States and other countries (not yet confirmed)
Anthropic (Claude AI models), reached through a "key router"	Brand kit text, briefs, scripts, ad copy, research text and quotes, transcripts, images for checking, audience comments for summarising	Writing, checking and summarising	Not yet confirmed. Requests pass through a key-routing service on their way to Anthropic; its operator and location are still to be named in this policy
Google — Gemini API	Prompts, brand images, scripts for voice-over, audio/video for transcription and checking	Generating video, images, voice and music; transcription when Deepgram is not set up	Not yet confirmed
Google — Google Ads API, YouTube Data API, YouTube Analytics API, Google sign-in	Campaigns and videos you approved; requests for your account and channel data	Publishing and reading results for accounts you connect	Not yet confirmed
Google Fonts	Your IP address (browser) or ours (server), the font name	Loading brand fonts	Not yet confirmed
Meta (Facebook, Instagram)	Ads you approved; requests for your account data; sales events if you turn that on (2.7)	Publishing, results, sales reporting	United States and other countries (not yet confirmed)
TikTok	Sign-in and profile request	Connecting your account	Not yet confirmed
Shopify	Requests to your store (read only)	Reading sales	Not yet confirmed
Stripe (your account as a sales source)	Requests to your Stripe account (read only)	Reading sales	Not yet confirmed
Deepgram	The audio of videos you ask us to clip (voices)	Transcription	United States (believed; not yet confirmed)
upload-post.com (posting service)	A made-up profile name, your videos/images, captions, titles; you link your social accounts on their screens	Posting to social networks	Not yet confirmed
Apify	Search words, country, competitor names or page IDs	Reading Meta's public Ad Library; web search	Not yet confirmed
SerpAPI (used when its key is set)	Search words, country	Web search for research	Not yet confirmed
Firecrawl (used when its key is set and the two above are not)	Search words, country	Web search for research	Not yet confirmed
DuckDuckGo, Brave Search (fallback when no search key is set), Google search suggestions	Search words, country	Web search for research	Not yet confirmed
Resend	Recipient email address, subject, message text	Sending service email (invitations, billing notices)	United States (believed; not yet confirmed)
File storage provider (to be named here before launch)	All uploaded and generated files	File storage	Not yet confirmed
Hosting and database provider (to be named here before launch)	Everything in section 2 except files	Running the service and its database	Not yet confirmed

Research also fetches public web pages directly from our servers, and a pasted video link is fetched from the site it points to. Those sites see our server's address and the page requested, not your details.

9.2 Not used today

We do not use advertising trackers, analytics vendors or error-tracking vendors on this website or in the app.
Reddit, X, LinkedIn, Pinterest, Snapchat and Microsoft Ads are shown in the app as "coming soon"; no information flows to or from them.
AI providers other than those listed above are not used.

9.3 Other disclosures

To the platforms you connect, as you direct.
To other members of your workspace.
To professional advisers, insurers, or a buyer of our business, under confidentiality.
Where the law requires it.

10. Google user data: Limited Use

The Content Machine's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain words, for information we get through your Google sign-in (Google Ads and YouTube):

we use it only to provide the features you can see in the service (choosing your account or channel, publishing what you approved, showing your results);
we do not sell it, and we do not use it for advertising to you;
we do not let people read it, except with your permission, for security, to comply with the law, or where it has been aggregated for internal operations;
we transfer it to others only as needed to provide those features, to comply with the law, or as part of a merger or sale with notice to you;
we do not use it to create, train or improve AI models. Public comments and statistics for videos we posted are sent to an AI model (Anthropic) only to write your audience summary.

11. YouTube API Services

The service uses YouTube API Services to connect your channel, upload videos you approve, and read your channel's video statistics.

By connecting YouTube you agree to be bound by the YouTube Terms of Service: https://www.youtube.com/t/terms
Google's Privacy Policy applies to that data: http://www.google.com/policies/privacy
What we access, store and use from YouTube is listed in section 2.5.
You can remove our access at any time from Google's security settings page: https://security.google.com/settings/security/permissions. You can also disconnect in the app (Connected accounts → Disconnect), which deletes our stored access.
To ask us to delete YouTube data we hold, use the contact form on this website and choose "Privacy request". We will delete it within 7 calendar days of your request.
Today, disconnecting YouTube in the app deletes our stored access straight away, but the video statistics already stored are not yet removed automatically; they are deleted when you ask, or when the brand or workspace is deleted. Automatic deletion and a 30-day refresh are being built.

12. Access, correction and complaints

You can ask for a copy of the personal information we hold about you, or ask us to correct it, through the contact form on this website (choose "Privacy request"). We will answer within 30 days.
To complain about how we handled your information, use the same form. We will acknowledge within 7 days and answer within 30 days.
If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au, phone 1300 363 992.

13. Dealing with us anonymously

You can ask general questions without saying who you are. To use the service we need to know who you are.

14. Children

The service is for businesses. It is not for anyone under 18, and we do not knowingly collect information from children. Minimum ages are applied to ad targeting for age-restricted products.

15. Changes

We may update this policy. The current version and date are on this page (/privacy). We will tell workspace owners by email about a significant change.

16. Contact

The Content Machine Pty Ltd, ACN 703 914 890 Privacy contact: the contact form on this website, "Privacy request".