Privacy Policy

1. Who we are

ContentFlow ("ContentFlow", "we", "us") is an AI platform that helps people create, schedule and publish content to social networks, available at https://contentflow.fyi. This Privacy Policy explains what data we collect, why we collect it, how we process and store it, who we share it with, and how you can have it deleted. It is our own policy and applies to the ContentFlow web app, its API, and the ContentFlow MCP server.

We are the controller of the data described here. For any privacy question, including deletion requests, contact us at aitkalirassul@gmail.com.

By creating an account or connecting a social network to ContentFlow, you agree to the processing described in this policy.

2. Information you provide to us

• Account data — email address, password (stored only as a bcrypt hash), and display name. If you sign in with Google, we receive your Google account ID, email address, name and profile picture instead of a password.
• Profile and brand settings — brand name, niche, brand description, avatar, tone of voice, content languages, emoji and hashtag preferences, default platforms, and any custom system prompt you configure.
• Content inputs — the text, links or ideas you submit for generation, and the voice recordings you make when using voice input.
• Knowledge base material — documents, notes and files you upload so the AI can use them as context.
• Media — images and other files you upload for publishing, and your avatar image.
• Generated content — posts, hashtags, calls to action, scheduling times and the AI reasoning attached to each generated post.
• Sources you ask us to track — the public Telegram channels and Instagram accounts you add as trend or competitor sources.

3. Information we receive from connected platforms

Connecting a social network is always optional and always initiated by you. When you connect an account, we receive and store only what is needed to run the features you asked for:

• Instagram (Meta) — your Instagram user ID, username and an access token, granted through Instagram Login with the instagram_business_basic, instagram_business_content_publish, instagram_business_manage_comments, instagram_business_manage_messages and instagram_business_manage_insights permissions. For content you publish through ContentFlow we also store the resulting media ID, permalink, media type and the insights Meta returns (likes, comments, impressions, reach and saves).
• Threads (Meta) — your Threads user ID, username and an access token, granted with the threads_basic, threads_content_publish and threads_profile_discovery permissions, plus the post ID and permalink of content you publish through ContentFlow.
• Telegram — the bot token you supply, the channel ID and channel name you connect, the message IDs of posts we publish, and the public statistics of those posts (views, forwards, reactions).
• Google — your Google account ID, email address, name and profile picture, used only to sign you in.
• Public content from sources you add — posts, captions, engagement counts, thumbnails, author handles and post dates from the public Telegram channels and Instagram accounts you choose to track, used to show you trends.

We request the narrowest set of permissions needed for these features. We do not use Meta platform data for advertising, we do not sell it, and we do not transfer it to data brokers or to anyone building independent profiles of you. Our use of data from Meta platforms complies with the Meta Platform Terms and Developer Policies.

4. Information collected automatically

• Technical data — IP address, browser and device type, referring page, and the date and time of your requests, recorded in server logs.
• Cookies we set ourselves — a "cf-token" HttpOnly session cookie that keeps you signed in for 7 days, and short-lived state cookies used during the OAuth flow ("cf-ig-oauth-state", "cf-ig-oauth-from") that expire after 5 minutes. Your language preference is kept in your browser's local storage, not on our servers.
• Usage analytics — we use a self-hosted Umami instance to count page views and understand which features are used. It is configured not to use tracking cookies and not to build cross-site profiles.
• Error and performance data — when something breaks, diagnostic information about the error is recorded so we can fix it.

We do not use advertising cookies and we do not run third-party ad or social tracking pixels on our site.

5. How and why we use your data

We process your data only for the purposes below. Where the GDPR applies, our legal basis is noted in brackets.

• To create and secure your account and keep you signed in (performance of our contract with you).
• To generate content with AI from your inputs, brand settings and knowledge base, and to transcribe your voice input into text (performance of our contract).
• To learn your brand voice — posts you select for style training are converted into embeddings and stored as vectors so future generations match your style (performance of our contract).
• To publish and schedule posts to the accounts you connected, on your instruction and on your behalf (performance of our contract).
• To show performance data for what you published, by reading back the statistics the platform reports for those posts (performance of our contract).
• To collect and rank public trends from the sources you added, so you can see what is working in your niche (performance of our contract).
• To let external AI clients and tools act on your content through our MCP server, using access tokens you issue yourself and can revoke at any time (performance of our contract).
• To operate, debug, secure and improve the service, including aggregate usage analytics and monitoring the quality of AI responses (our legitimate interest in running a reliable service).
• To respond to your support and privacy requests, and to comply with legal obligations (legal obligation / legitimate interest).

We do not use your content or your connected-platform data to make automated decisions with legal or similarly significant effects about you.

6. AI processing

To generate content, ContentFlow sends your input, your brand settings, relevant knowledge base excerpts and relevant trend data to our AI provider alem.plus, which performs text generation, speech-to-text transcription, embeddings and reranking. Voice recordings are sent for transcription and are not stored by us after the transcript is produced. Prompts and responses are traced in Langfuse so we can monitor and improve output quality. Style and knowledge embeddings are stored as vectors in our Milvus instance and are linked to your account.

Your content is processed by these providers only to fulfil the requests you make in ContentFlow. We do not sell your content and we do not publish it anywhere other than to the accounts you explicitly instruct us to publish to.

7. Who we share data with

We do not sell your personal data and we do not share it for anyone else's marketing. We share data only with the service providers that make ContentFlow work, and only to the extent needed:

• Meta Platforms (Instagram Graph API, Threads API) — to authenticate you, publish the content you asked us to publish, and read back its statistics.
• Telegram — to publish content through the Bot API to the channel you connected.
• Google — to authenticate you when you choose Google sign-in.
• alem.plus — AI generation, transcription, embeddings, reranking and knowledge base retrieval.
• Langfuse — technical tracing of AI requests for quality monitoring.
• MinIO — object storage for uploaded images, media and avatars.
• Redis — background job queue and response caching.
• Hetzner — hosting of our application servers and database.

Each of these providers has its own privacy policy. We may also disclose data if we are legally required to do so, or where necessary to establish, exercise or defend legal claims, or to protect the safety of our users.

8. How long we keep your data

• Account, profile and brand settings — kept while your account exists, and deleted when you delete your account.
• Generated posts, knowledge base entries and uploaded media — kept until you delete them, or until your account is deleted.
• Access tokens for Instagram, Threads and Telegram — kept only while the integration is connected; deleted immediately when you disconnect it, when you remove ContentFlow from your Instagram or Facebook settings, or when the token expires.
• Voice recordings — not retained after transcription; only the resulting text is stored with your generation.
• Trend and competitor data — kept while the source is active in your account and deleted when you remove the source.
• Job and server logs — kept for a limited period for debugging and security, then deleted.

After you request deletion, backups containing your data are overwritten in the normal backup rotation.

9. How we protect your data

• Passwords are stored only as bcrypt hashes and are never readable by us.
• All traffic to ContentFlow is encrypted with HTTPS.
• Platform access tokens and MCP tokens are stored in an access-controlled database.
• Session cookies are HttpOnly and SameSite-scoped; OAuth flows are protected with state parameters, and Meta callbacks are verified against the app secret signature.
• Access to production systems is restricted to the people who need it to operate the service.

No system can be completely secure, but we work to protect your data and will notify you and the competent authority if a breach affecting your personal data occurs, as required by law.

10. How to delete your data

You can have your data deleted at any time, in any of the following ways.

a) Delete specific items yourself. Sign in and delete individual posts, knowledge base entries or uploaded media from the app. Deleted items are removed from our database.

b) Disconnect a platform. In Settings, click "Disconnect" next to Instagram, Threads or Telegram. The stored access token, platform user ID and username for that integration are deleted from our database immediately, and we stop requesting any data from that platform.

c) Remove ContentFlow from Instagram or Facebook. Open Instagram → Settings → Website permissions → Apps and websites (or Facebook → Settings & privacy → Settings → Apps and websites), and remove ContentFlow. Meta notifies our deauthorization endpoint and we delete the Instagram or Threads data we hold for you.

d) Delete your entire account and all associated data. Send an email to aitkalirassul@gmail.com from the address registered with your account, with the subject "Data deletion request". We will verify the request, delete your account, generated content, knowledge base, uploaded media, style vectors and all stored platform tokens, and confirm by email. We complete deletion within 30 days of receiving the request.

e) Meta-initiated data deletion requests. If you submit a data deletion request through Instagram or Facebook, Meta sends a signed request to our data deletion callback — https://contentflow.fyi/api/auth/instagram/data-deletion for Instagram and https://contentflow.fyi/api/auth/threads/data-deletion for Threads. We delete the Meta data associated with your account and return a confirmation code together with a status URL of the form https://contentflow.fyi/api/auth/instagram/data-deletion/status?code=CONFIRMATION_CODE, which you can open at any time to check the status of that request.

Deletion is permanent: once your data is deleted, we cannot restore it.

11. Your rights

Depending on where you live, you have the following rights over your personal data:

• Access — ask for a copy of the personal data we hold about you.
• Rectification — correct data that is wrong or out of date; most of it you can edit yourself in your profile settings.
• Erasure — have your data deleted, as described in section 10.
• Restriction and objection — ask us to stop or limit certain processing, including processing based on our legitimate interests.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent — disconnect any integration or revoke any MCP token at any time, without affecting processing already carried out.
• Complain — lodge a complaint with your local data protection authority.

To exercise any of these rights, email aitkalirassul@gmail.com. We respond within 30 days.

12. Children

ContentFlow is not directed at children and is not intended for anyone under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

13. International transfers

ContentFlow is operated from Kazakhstan and hosted in Europe. Some of the providers listed in section 7 process data in other countries. When we transfer personal data across borders, we rely on appropriate safeguards, such as the standard contractual clauses offered by those providers.

14. Changes to this policy

We may update this policy as the service changes. The "last updated" date at the top always reflects the current version, and this page remains publicly accessible at https://contentflow.fyi/privacy. If we make a material change, we will notify you in the app or by email before it takes effect.

15. Contact us

For any question about this policy, about the data we hold, or to request deletion, email aitkalirassul@gmail.com. We aim to reply within 5 business days and in any case within 30 days.