Privacy Policy

This Privacy Policy explains what personal data Writegarden processes when you use the Writegarden website (writegarden.com) and product (app.writegarden.com), why we process it, how long we keep it, who we share it with, and your rights under the EU General Data Protection Regulation (GDPR).

1. Data Controller

The data controller for personal data processed in connection with Writegarden is Writegarden. For any data-protection enquiry — including to identify the responsible party for a formal request — contact privacy@writegarden.com.

A formal Data Protection Officer (DPO) has not been appointed, as it is not mandatory for our type and scale of processing. All data-protection enquiries are handled at the address above.

2. Data We Collect

2.1 Account Data

• Email address (used for authentication and communication)
• Password (hashed and salted; we never store or access your plaintext password)
• Account creation date and last login timestamp

2.2 Business Profile Data

• Company name, website URL, and industry
• Business type, description, and tone of voice
• Target audience, unique value proposition, and business goals
• Competitor information

2.3 Website Content Data

• For connected platforms (e.g. Webflow, Shopify): your site's page list and structure, page titles and SEO metadata, extracted page text, and sampled CMS collection entries or product data — retrieved exclusively through the platform's official APIs under the access you grant via OAuth
• For websites without a connected platform: site structure and page metadata gathered from your website at your request during onboarding
• Articles you import from a connected CMS to improve: the original and the proposed versions, and the record of where each version was published

2.4 SEO and Keyword Data

• Keywords and keyword research results
• Search volumes, keyword difficulty scores, CPC data
• SERP analysis data and competitor keyword analysis

2.5 Generated Content

• AI-generated articles (HTML content)
• AI-generated images (PNG files)
• Meta descriptions, titles, and SEO scores
• Article status history (draft, published, etc.)

2.6 Integration Data

• OAuth access and refresh tokens for connected platforms (Webflow, Shopify, WordPress, Wix, Framer, Google Search Console)
• These tokens are encrypted using AES-256-GCM before storage and are used solely to publish content or retrieve data on your behalf

2.7 Usage Data

• Article generation and publishing events
• Keyword analysis completions
• Onboarding progress
• Feature usage patterns

2.8 Approximate Country for Market Suggestions

When you open the audience-market picker on our website or in the setup wizard, our hosting provider, Vercel, derives an approximate country from the IP address of your connection. We use that country to show your country's markets and nearby countries first, making the list easier to browse. This only changes the order of the options: it does not select a market for you, limit the available markets, or change a market you have already chosen. You can search and choose any available country and language. The estimate can be inaccurate, for example when you use a VPN.

This feature uses only a country code. It does not request device location, GPS, city or precise coordinates, and it does not use a separate geolocation service. The country hint is kept temporarily in memory while the market picker is open; it is not saved to your account, database, cookies or browser storage. The country lookup does not include your account credentials. Vercel still processes network request information, including IP addresses, to host and deliver the Service; the temporary handling of the country hint does not mean that hosting logs contain no IP addresses.

Your right to object: You may object to this use of your approximate country on grounds relating to your particular situation by contacting privacy@writegarden.com. See Section 8 for your data-protection rights.

3. Purpose and Legal Basis

We process your data under the following legal bases as defined by the GDPR:

4. AI Data Processing

To generate content, we send certain data to third-party AI providers. This section explains what data is sent, to whom, and what safeguards are in place.

Safeguards: We do not send your email address, password, or OAuth tokens to AI providers. Raw content from your website reaches AI providers only in these cases: Google Gemini receives page text, titles and CMS samples to generate your business profile; for Webflow-connected sites, an Anthropic model receives the site preview image that Webflow generates, to extract your brand colours and style; and when you ask us to improve an imported article, its HTML is sent through OpenRouter with provider data collection denied, while Perplexity receives short dated claims from it (without HTML or links) for fact verification. All other AI processing uses only the derived business profile and the content being generated. Under our providers' commercial API terms, data submitted through their APIs is not used to train their models. All requests are made server-side through our secure backend, not from your browser.

For more information about how AI is used in our Service, please see our AI Disclosure Policy.

5. Third-Party Data Processors

We use the following third-party service providers (sub-processors) to deliver our Service:

We also interact with third-party platforms (Webflow, Shopify, WordPress, Wix, Framer, Strapi and Google Search Console) when you connect them or choose to publish content. When you connect a platform such as Webflow or Shopify, your site's pages, content, structure, and CMS or product data are retrieved exclusively through the platform's official APIs under the access you grant via OAuth — never by crawling your site. If you enter the address of a website hosted on Webflow, we ask you to connect it through Webflow instead of reading it from the web. These interactions are initiated by you and governed by the respective platform's terms and privacy policies.

6. International Data Transfers

Some of our sub-processors operate outside the European Economic Area (EEA). When your data is transferred to countries without an EU adequacy decision, we ensure appropriate safeguards are in place:

• OpenRouter (US): Transfer is covered by Standard Contractual Clauses (SCCs) as approved by the European Commission, supplemented by a Transfer Impact Assessment.
• Google (US): Gemini API processing is covered by Standard Contractual Clauses; under Google's paid API terms, submitted data is not used to train models.
• Postmark (US): Covered by Standard Contractual Clauses under its data processing agreement.
• Perplexity (US): Covered by Standard Contractual Clauses under its Data Processing Addendum.
• Higgsfield (US): Used only when you ask for social images for an article; receives article excerpts and brand design tokens, never account data.
• Bright Data (Israel): Israel benefits from an EU adequacy decision.
• Webflow / Shopify (US/Canada): Only when you connect your site or initiate content publishing; governed by their respective data processing agreements.

You may request a copy of the applicable transfer safeguards by contacting privacy@writegarden.com.

7. Data Retention

We retain your data only for as long as necessary for the purposes described in this policy:

After the retention period, data is permanently and irreversibly deleted from our systems and sub-processor systems.

8. Your Data Protection Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15): You may request a copy of all personal data we hold about you.
• Right to rectification (Art. 16): You may correct inaccurate or incomplete data through your account settings or by contacting us.
• Right to erasure (Art. 17): You may request deletion of your personal data ("right to be forgotten").
• Right to restriction (Art. 18): You may request that we restrict processing of your data in certain circumstances.
• Right to data portability (Art. 20): You may request your data in a structured, machine-readable format.
• Right to object (Art. 21): You may object to processing based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact privacy@writegarden.com. We will respond within 30 days as required by the GDPR.

You also have the right to lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados — CNPD) or your local supervisory authority.

9. Cookies

Our use of cookies is described in our Cookie Policy. Essential cookies required for authentication and basic functionality are set without consent. Non-essential cookies (analytics, marketing) require your explicit consent before being set.

10. Security Measures

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption in transit (TLS/HTTPS for all communications)
• Encryption at rest for stored data
• AES-256-GCM encryption for OAuth tokens
• Row-Level Security (RLS) policies ensuring data isolation between organizations
• Server-side credential management (API keys and secrets are never exposed to browsers)
• Hashed and salted passwords
• Regular security reviews and updates

11. Children's Data

The Service is a B2B platform designed for business use and is not directed at individuals under 16 years of age. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, contact privacy@writegarden.com and we will take steps to delete such data.

12. Automated Decision-Making

The Service uses AI and automated processing in the following ways:

• Market ordering: An approximate country supplied by Vercel is used to show nearby markets first on our website and in the setup wizard. You choose the audience market yourself.
• Keyword suggestions: AI analyzes your business context to suggest relevant keywords and identify negative keywords.
• Business inference: AI infers business characteristics from your domain data to improve content relevance.
• Content generation: AI generates articles and images based on your inputs.

These automated processes assist in setup and content creation but do not produce legal effects or similarly significant effects on you. All AI-generated outputs are recommendations that you review and control before publication.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email and/or by displaying a prominent notice in the Service. The "Last updated" date at the top of this page indicates when this policy was last revised.

14. Contact

For privacy-related questions, data subject requests, or complaints, contact privacy@writegarden.com.

Supervisory authority: Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt.