Privacy Policy

This Privacy Policy explains what personal data Writegarden processes when you use the Writegarden website (writegarden.com) and product (app.writegarden.com), why we process it, how long we keep it, who we share it with, and your rights under the EU General Data Protection Regulation (GDPR).

1. Data Controller

The data controller for personal data processed in connection with Writegarden is Writegarden. For any data-protection enquiry — including to identify the responsible party for a formal request — contact privacy@writegarden.com.

A formal Data Protection Officer (DPO) has not been appointed, as it is not mandatory for our type and scale of processing. All data-protection enquiries are handled at the address above.

2. Data We Collect

2.1 Account Data

• Email address (used for authentication and communication)
• Password (hashed and salted; we never store or access your plaintext password)
• Account creation date and last login timestamp

2.2 Business Profile Data

• Company name, website URL, and industry
• Business type, description, and tone of voice
• Target audience, unique value proposition, and business goals
• Competitor information

2.3 Website Content Data

• For connected platforms (e.g. Webflow, Shopify): your site's page list and structure, page titles and SEO metadata, extracted page text, and sampled CMS collection entries or product data — retrieved exclusively through the platform's official APIs under the access you grant via OAuth
• For websites without a connected platform: site structure and page metadata gathered from your website at your request during onboarding
• Articles you import from a connected CMS to improve: the original and the proposed versions, and the record of where each version was published

2.4 SEO and Keyword Data

• Keywords and keyword research results
• Search volumes, keyword difficulty scores, CPC data
• SERP analysis data and competitor keyword analysis

2.5 Generated Content

• AI-generated articles (HTML content)
• AI-generated images and, where the feature is available, other media such as short videos
• Meta descriptions, titles, and SEO scores
• Article status history (draft, published, etc.)

2.6 Integration Data

• OAuth access and refresh tokens for connected platforms (Webflow, Shopify, WordPress, Wix, Framer, Google Search Console)
• These tokens are encrypted using AES-256-GCM before storage and are used solely to publish content or retrieve data on your behalf

2.7 Usage Data

• Article generation and publishing events
• Keyword analysis completions
• Onboarding progress
• Feature usage patterns

2.8 Approximate Country for Market Suggestions

When you open the audience-market picker on our website or in the setup wizard, our hosting provider, Vercel, derives an approximate country from the IP address of your connection. We use that country to show your country's markets and nearby countries first, making the list easier to browse. This only changes the order of the options: it does not select a market for you, limit the available markets, or change a market you have already chosen. You can search and choose any available country and language. The estimate can be inaccurate, for example when you use a VPN.

This feature uses only a country code. It does not request device location, GPS, city or precise coordinates, and it does not use a separate geolocation service. The country hint is kept temporarily in memory while the market picker is open; it is not saved to your account, database, cookies or browser storage. The country lookup does not include your account credentials. Vercel still processes network request information, including IP addresses, to host and deliver the Service; the temporary handling of the country hint does not mean that hosting logs contain no IP addresses.

Your right to object: You may object to this use of your approximate country on grounds relating to your particular situation by contacting privacy@writegarden.com. See Section 8 for your data-protection rights.

2.9 Media You Upload or Select

Image and video files you upload, images you insert by URL, your saved brand images, and media you select as a reference when you ask the Service to generate images or video. This media may show people. We use it only to provide the feature you request. We do not use it to identify, verify, or authenticate anyone, and we do not create facial or other biometric templates from it.

2.10 Personal Data About Other People

Your content may include personal data about other people: team members you invite (their email address and, if given, their name), people shown in media you upload, or people named in content you create or import. Where we process this data on your behalf, we act as your processor under our Data Processing Addendum, and you are responsible for having a lawful basis for it and for informing those people. Please do not include special categories of personal data (such as health data, religious beliefs, or ethnic origin), government identification numbers, payment card details, or passwords in prompts or other content you submit.

2.11 Records of Your Acceptance of Our Terms

When you accept our Terms of Service, this Privacy Policy, or another of our legal documents, we record which document and version you accepted, when, and where in the Service you accepted it.

3. Purpose and Legal Basis

We process your data under the following legal bases as defined by the GDPR:

4. AI Data Processing

To generate content, we send certain data to third-party AI providers. This section explains what data is sent, to whom, and what safeguards are in place.

Safeguards: We do not send your email address, password, or OAuth tokens to AI providers. Raw content from your website reaches AI providers only in these cases: Google Gemini receives page text, titles and CMS samples to generate your business profile; for Webflow-connected sites, an Anthropic model receives the site preview image that Webflow generates, to extract your brand colours and style; and when you ask us to improve an imported article, its HTML is sent through OpenRouter with provider data collection denied, while Perplexity receives short dated claims from it (without HTML or links) for fact verification. All other AI processing uses only the derived business profile and the content being generated. Your saved brand images and any reference media you select are sent to Higgsfield when it generates images or video for you. Under the commercial API terms of OpenRouter, Google, and Perplexity, data submitted through their APIs is not used to train their models. Higgsfield's terms differ, as explained in Section 4.1. All requests are made server-side through our secure backend, not from your browser.

4.1 Higgsfield and Media That May Show People

Higgsfield, which powers our social carousels and some other image and video features, processes the content we send it under its own terms of use and privacy policy. It never receives your account data. Under its standard terms, Higgsfield may use the prompts, reference media, and generated results submitted to it to train and improve its own AI models, and it acts as an independent controller for that use. Deleting content from Writegarden does not remove it from Higgsfield models that have already been trained on it. Higgsfield states that generated results remain retrievable through its API for at least seven days; we copy them to your workspace as soon as they are ready. Higgsfield is based in the United States and states that it also processes data in other countries, including Kazakhstan.

We send content to Higgsfield only when a Higgsfield-powered feature runs: when you choose a post idea for the carousel preview we offer during onboarding, when you create a carousel or other media from an article, or when you choose a Higgsfield model in Creator Studio. The Service tells you before such a feature runs. If you do not want content used in this way, do not start the carousel preview, do not select the content as a reference for a Higgsfield model, and choose another model where one is offered.

Images that show people are processed only to generate the result you asked for. We do not use them to identify anyone or to create facial or other biometric templates. Higgsfield states that any biometric information it derives is used only to provide the requested feature, is processed transiently, and is not stored. Only use media that shows a person if you have that person's consent or another lawful basis, as our Terms of Service require.

For more information about how AI is used in our Service, please see our AI Disclosure Policy.

5. Third-Party Data Processors

We use the following third-party service providers (sub-processors) to deliver our Service. We do not sell your personal data.

We also interact with third-party platforms (Webflow, Shopify, WordPress, Wix, Framer, Strapi and Google Search Console) when you connect them or choose to publish content. When you connect a platform such as Webflow or Shopify, your site's pages, content, structure, and CMS or product data are retrieved exclusively through the platform's official APIs under the access you grant via OAuth — never by crawling your site. If you enter the address of a website hosted on Webflow, we ask you to connect it through Webflow instead of reading it from the web. These interactions are initiated by you and governed by the respective platform's terms and privacy policies.

6. International Data Transfers

Some of our sub-processors operate outside the European Economic Area (EEA). When your data is transferred to countries without an EU adequacy decision, we ensure appropriate safeguards are in place:

• OpenRouter (US): Transfer is covered by Standard Contractual Clauses (SCCs) as approved by the European Commission, supplemented by a Transfer Impact Assessment.
• Google (US): Gemini API processing is covered by Standard Contractual Clauses; under Google's paid API terms, submitted data is not used to train models.
• Postmark (US): Covered by Standard Contractual Clauses under its data processing agreement.
• Perplexity (US): Covered by Standard Contractual Clauses under its Data Processing Addendum.
• Higgsfield (US): Receives only the content described in Section 4.1, only when a Higgsfield-powered feature runs, and never account data. Higgsfield is based in the United States and states that it also processes data in other countries, including Kazakhstan. For personal data it receives from Europe, Higgsfield states that it relies on the EU-U.S. Data Privacy Framework or Standard Contractual Clauses; as of 20 October 2026, Higgsfield is not on the Data Privacy Framework list and has not signed Standard Contractual Clauses with us. Transfers to Higgsfield therefore take place only when you run a Higgsfield-powered feature, after the Service asks you to confirm and lets you decline. For your own personal data we rely on the derogation for a transfer necessary to perform the feature you requested (Article 49(1)(b) GDPR); for other people shown in media you send, we rely on your confirmation that they have consented, as our Terms require.
• Bright Data (Israel): Israel benefits from an EU adequacy decision.
• Webflow / Shopify (US/Canada): Only when you connect your site or initiate content publishing; governed by their respective data processing agreements.

You may request a copy of the applicable transfer safeguards by contacting privacy@writegarden.com.

7. Data Retention

We retain your data only for as long as necessary for the purposes described in this policy:

After the retention period, data is permanently deleted from our active systems and from our processors' systems. Backup copies are kept for a limited period and then overwritten. Content that a provider may use for its own purposes, as described in Section 4.1, cannot be withdrawn from models already trained on it.

8. Your Data Protection Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15): You may request a copy of all personal data we hold about you.
• Right to rectification (Art. 16): You may correct inaccurate or incomplete data through your account settings or by contacting us.
• Right to erasure (Art. 17): You may request deletion of your personal data ("right to be forgotten").
• Right to restriction (Art. 18): You may request that we restrict processing of your data in certain circumstances.
• Right to data portability (Art. 20): You may request your data in a structured, machine-readable format.
• Right to object (Art. 21): You may object to processing based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact privacy@writegarden.com. We may ask you to confirm your identity before acting on a request. We respond within one month of receiving it; for complex or numerous requests, we may extend this by up to two further months, and we will tell you why within the first month. Requests are free of charge unless they are manifestly unfounded or excessive. Where a request concerns personal data that we process on behalf of a customer, such as content in a workspace managed by your employer, we pass it to that customer, who decides how to respond, and we help them do so.

You also have the right to lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados — CNPD) or your local supervisory authority.

9. Cookies

Our use of cookies is described in our Cookie Policy. Essential cookies required for authentication and basic functionality are set without consent. Non-essential cookies (analytics, marketing) require your explicit consent before being set.

10. Security Measures

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption in transit (TLS/HTTPS for all communications)
• Encryption at rest for stored data
• AES-256-GCM encryption for OAuth tokens
• Row-Level Security (RLS) policies ensuring data isolation between organizations
• Server-side credential management (API keys and secrets are never exposed to browsers)
• Hashed and salted passwords
• Regular security reviews and updates

If a personal data breach occurs, we notify the CNPD within 72 hours of becoming aware of it where the breach is likely to result in a risk to people's rights, and we inform affected users without undue delay where it is likely to result in a high risk.

11. Children's Data

The Service is a B2B platform designed for business use by adults; you must be at least 18 years old to use it. We do not knowingly collect personal data from children as users of the Service. Only upload images that show a child if you have the consent of the child's parent or guardian. If you become aware that a child has provided us with personal data, contact privacy@writegarden.com and we will take steps to delete such data.

12. Automated Decision-Making

The Service uses AI and automated processing in the following ways:

• Market ordering: An approximate country supplied by Vercel is used to show nearby markets first on our website and in the setup wizard. You choose the audience market yourself.
• Keyword suggestions: AI analyzes your business context to suggest relevant keywords and identify negative keywords.
• Business inference: AI infers business characteristics from your domain data to improve content relevance.
• Content generation: AI generates articles, images, and other media based on your inputs.

These automated processes assist in setup and content creation but do not produce legal effects or similarly significant effects on you. All AI-generated outputs are recommendations that you review and control before publication.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email and/or by displaying a prominent notice in the Service before they take effect, and where a change requires your consent, we will ask for it. The "Last updated" date at the top of this page indicates when this policy was last revised. Previous versions are available on request.

14. Contact

For privacy-related questions, data subject requests, or complaints, contact privacy@writegarden.com.

Supervisory authority: Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt.