Privacy Policy

1. Two different roles

We are the controller for the data we need to run the business: your account, your billing relationship, our own website analytics and our logs. We are a processor when we handle personal data inside the content and configuration you give us — including the visitors of a blog we host for you, and any Google Analytics tag you choose to add to it. For that processing you are the controller and our data processing agreement applies.

2. What we collect

• Account data: name, email address, a hash of your password, organisation name, and the settings you choose.
• Billing data: subscription status, invoices and payment outcomes. Card details are entered with Stripe and never reach our servers.
• Project configuration: your website address, the domain you attach, brand settings derived from your site, and — only if you enter one — a Google Analytics measurement ID.
• Content and generation records: the topics, articles, images and translations produced for your projects, and technical records of the generation runs behind them.
• Technical logs: IP address, user agent, requested URL and timestamps, kept for security, abuse prevention and debugging.
• Contact form submissions on this website: what you type in the form, plus the page you sent it from.
• Website analytics on generated.app: aggregate usage measurement, where enabled.

3. Why we process it

To provide the service and perform our contract with you (accounts, generation, hosting, billing); for our legitimate interests in keeping the service secure, preventing abuse and improving it; to comply with legal and tax obligations; and, where consent is required — for example non-essential analytics cookies — on the basis of your consent, which you can withdraw.

4. Who else processes it

We use a small set of providers, each for a stated purpose and under contract:

• Stripe — payment processing, subscriptions and invoices.
• Cloudflare — TLS certificates for customer domains, content delivery and protection for hosted blogs.
• AI model providers — generation of article text, translations, FAQ blocks, calls to action and cover images. Content is sent to them to be processed; we do not sell it and it is not our customers' data to sell.
• Sentry — error monitoring for our own applications.
• LeadPending — delivery of contact-form submissions from this website.
• Our own servers — the platform, the databases and the hosting of built blog pages run on infrastructure we operate.

5. What we never do

We do not sell personal data, we do not share it with advertisers, and we do not use your content to train models we own.

6. International transfers

Some of the providers above operate outside your country. Where personal data leaves the European Economic Area or the United Kingdom, we rely on the appropriate safeguards for that transfer, including standard contractual clauses.

7. How long we keep it

• Account and project data: for as long as your account exists, and for a short period afterwards to handle disputes and legal obligations.
• Generated content: it stays in your account until you delete it or your account is closed. Ending a subscription stops the site being served; it does not delete your content.
• Billing records: as long as tax and accounting law requires.
• Technical logs: a limited retention window, measured in weeks rather than years.

8. Your rights

Depending on where you live, you can ask for a copy of your personal data, ask us to correct or delete it, object to or restrict certain processing, and ask for it in a portable form. Write to [email protected] and we will answer within the period the applicable law allows. If a request concerns data we process on a customer's behalf — for example a visitor of a hosted blog — we will pass it to that customer, who is the controller. You can also complain to your local data protection authority.

9. Security

Access to production systems is restricted and authenticated, traffic is encrypted in transit, passwords are stored hashed, and customer domains are served over TLS. No system is perfect; if a breach affects your personal data, we will notify you and the relevant authority as the law requires.

10. Cookies

This website uses the cookies it needs to function, plus analytics where enabled. Blogs we host for customers carry no cookies from us; if a customer configures a Google Analytics measurement ID, that customer's tag runs on their own domain and is their responsibility to disclose.

11. Children

The service is for business use and not directed at children. We do not knowingly collect personal data from anyone under 18.

12. Changes and contact

We will update this policy as the service changes, and the date above always reflects the current version. Questions, requests or complaints: [email protected].