Privacy policy

1. Who this policy covers

• Visitors to our marketing site (for example the home page and this privacy page).
• Account holders who sign up or sign in (authentication is provided by Clerk).
• Workspace members who use product features inside a workspace (brand setup, content, captures, review, connections).

2. Information we collect

2.1 Account and identity

When you create or use an account, Clerk processes your email address and authentication credentials (for example password or email verification codes), and may store basic profile fields you provide (such as name or avatar). We receive identifiers and profile fields from Clerk needed to recognize you in the product. We do not store your password.

2.2 Workspace and product content

You or your workspace may provide:

• Brand profile details (product name, URL, voice, claims you allow or prohibit).
• Product updates and related text (for example from a connected GitHub repository or content you paste).
• Draft posts, review decisions, and publication choices you make in the product.
• Capture recipes and settings that describe how an automated browser should navigate your product for demos.
• Screenshots, video recordings, and related artifacts produced by capture runs you start, stored in object storage tied to your workspace.
• Optional demo login details you choose to store for capture. Those secrets are stored encrypted and are used only to drive the capture you configure — not written into recipes as plaintext, and not sent to model providers as raw passwords.

2.3 Connected third-party services

If you connect integrations (such as GitHub for product updates, or X / LinkedIn for trends or publishing when enabled), we receive OAuth tokens and account metadata from those providers. Tokens are stored encrypted, scoped to your workspace, and used to call the provider APIs for the features you turn on (for example reading releases, searching recent public posts, or publishing an approved draft). Disconnecting an integration removes or invalidates that credential path in our system.

2.4 Trend and public sources

When trend collection is enabled, we may fetch public posts or feeds you configure (for example X recent search with your workspace's queries, or public RSS). That content is stored as evidence for ranking and drafting inside your workspace and is subject to retention settings.

2.5 Browser capture observations

Capture runs operate a browser against origins you allowlist. We store action logs, safe diagnostic codes, optional traces, and media you asked the run to produce. Page content is treated as data for the capture — not as instructions that can reveal secrets or change recipes outside the policy engine. Publishing media requires redaction and processing checks; raw or failed-redaction assets are not treated as publishable.

2.6 Technical and operational data

• Standard request metadata (for example IP address, user agent) in hosting logs.
• Application logs and audit events (who did what in a workspace), which avoid secret values and provider response bodies.
• Billing-related identifiers if you use paid plans (processed via our payment provider).

3. How we use information

• Authenticate you and keep workspace membership isolation.
• Generate grounded draft content from your product evidence and configured trends.
• Run capture recipes you approve and process media derivatives for review.
• Publish to connected destinations only after an explicit human approval of a specific draft version.
• Operate, secure, debug, and improve the service.
• Communicate about the product (for example account or security messages).
• Meet legal obligations and enforce our terms.

We do not sell personal information.

4. Human approval and automation

Content generation and capture can be automated, but publication is gated: only an approved draft version may be queued for a destination. You remain responsible for what you approve and for ensuring you have the rights to capture and publish material from your product and connected accounts.

5. Model providers

Drafting, ranking, and some capture-planning steps may send text you provide (and evidence derived from connected sources) to a model provider we configure (for example OpenAI). We design prompts so OAuth tokens, browser storage state, and decrypted demo passwords are not included as model input. Model outputs are checked against grounding and policy rules before they become reviewable drafts.

6. Subprocessors and infrastructure

Depending on deployment, we use providers such as:

• Clerk — authentication and account management.
• Hosting and edge — for example Vercel for the web application.
• Database and object storage — workspace data, drafts, and capture media (for example PostgreSQL and S3-compatible storage).
• Job/queue infrastructure — background workers for content, media, and publication.
• Model providers — generation and related AI features.
• Payment providers — if billing is enabled (for example Stripe).
• Connected APIs you authorize — GitHub, X, LinkedIn, and similar, only for the scopes and actions you enable.

These parties process data under our instructions to provide the service, except where they act as independent controllers (for example when you log into Clerk or a social network under that provider's own terms).

7. Sharing

We share information only:

• With subprocessors as described above.
• With destinations you connect, when you approve a publish action.
• With workspace members according to roles in that workspace.
• If required by law, or to protect the service and users from abuse or harm.
• In a merger, acquisition, or asset transfer, with notice where appropriate.

8. Retention

• Account data lasts while your account remains active, plus a short period needed for backups and abuse prevention after deletion requests.
• Workspace content (drafts, events, trend evidence, capture artifacts) follows product retention settings; expired capture and media objects are removed by retention jobs.
• Encrypted credentials for integrations and demo capture are removed when you disconnect them or delete the workspace path that holds them.
• Audit logs are kept to investigate security and tenancy issues.

9. Security

Controls we rely on in the product include:

• TLS in transit for the web application.
• Encrypted storage of OAuth and capture credentials (envelope encryption).
• Workspace-scoped authorization for reads and writes.
• Capture policy limits (HTTPS origin allowlists, blocked private network targets, declarative steps rather than arbitrary script, redaction gates on media).
• Separate kill switches for browser capture and publication.

No system is perfectly secure. Report suspected vulnerabilities or privacy incidents to support@contentlayer.media.

10. International transfers

We and our subprocessors may process data in the United States and other countries where those providers operate. If you access the service from elsewhere, you understand that your information may be processed outside your country, subject to applicable safeguards those providers offer.

11. Your choices and rights

You can:

• Access and update account profile fields through Clerk / in-product settings.
• Disconnect integrations and remove stored demo credentials.
• Request deletion of your account or workspace data by contacting us.

Depending on where you live (for example under GDPR or similar laws), you may have rights to access, correct, delete, export, or restrict processing of personal data, and to lodge a complaint with a supervisory authority. Contact support@contentlayer.media. We may need to verify your request and will respond within the time required by law.

12. Children

ContentLayer is a business product and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child provided data, contact us and we will delete it.

13. Changes

We may update this policy as the product evolves. The "Last updated" date will change when we do. For material changes, we will take additional steps when appropriate (for example a notice in the product or by email).

14. Contact

Privacy questions and requests: support@contentlayer.media.