Privacy Policy

Last updated: August 18, 2026

This is an English translation for convenience. The German version is legally binding.

This privacy policy explains how we process personal data when you use Content Brainy (the “App”) at contentbrainy.app.

1. Controller

The controller responsible for data processing under the GDPR is:
HALE Technologies
Owner: Dwayne Henneberg
Bergaustraße 60
12437 Berlin, Germany
Email: Team@contentbrainy.app

2. What data we process

a) Account data (sign-in)

You sign in through our service provider Clerk using Google or Apple. We process your name, your email address and a unique user ID. We do not store a password. Google sign-in through Clerk is separate from an optional YouTube platform connection (see c).

b) Content you provide

Content you create in the App: content ideas, notes, captions, production stages, due dates, optional file attachments (images and PDFs) and your onboarding answers (niche, platforms, approximate reach, goal and timeframe, approximate social media income, how you heard about Content Brainy). Attachments are stored in private object storage (Vercel Blob); the database only holds metadata (e.g. file name, type, size). Access to attachments is limited to you as the owner.

c) Platform connections (only while connected)

You can optionally connect your own social accounts. Through the respective official APIs we only retrieve your own data — within the permissions you granted. We do not publish content on your behalf and do not read private direct messages. We only read and process comment texts if you turn on the optional Comments feature for Instagram or YouTube. To access the data we store the required access and refresh tokens to keep the connection and background sync running.

TikTok

Scopes: user.info.basic, user.info.stats, video.list.

• Basic profile details: display name and avatar.
• Account statistics: followers, following, profile likes and video count.
• Your videos including metadata and metrics: video ID, title/caption, thumbnail, link, publish time, duration, and view, like, comment and share counts.

Instagram (Meta)

Through Instagram Login / Meta’s Instagram API. When you connect, we request: instagram_business_basic, instagram_business_manage_insights, and instagram_business_manage_comments. You can decline the comment permissions; the account then stays connected for metrics and Comments imports nothing. An Instagram business or creator account is required.

• Profile details: username, name, avatar, account type, follower, following and media counts.
• Your feed/Reels posts including metadata and metrics: media ID, caption, thumbnail/media URL, permalink, publish time, and like and comment counts; views and shares where available via Insights.
• If you grant comment access (and do not turn Comments off later): comment texts, author names, replies, and hide and delete actions on your feed/Reels posts.

YouTube (Google)

Through a separate OAuth connection (independent of the Clerk Google sign-in). When you connect, we request: youtube.readonly, yt-analytics.readonly, and youtube.force-ssl (replying to, hiding and deleting comments on your own videos). You can decline the comment scope; the channel then stays connected for metrics.

• Channel details: channel ID, title/custom URL, thumbnail, subscriber and video counts.
• Your uploads including metadata and metrics: video ID, title, description, thumbnail, link, publish time, duration, and view, like and comment counts; share counts via the YouTube Analytics API where available.
• If you grant comment access (and do not turn Comments off later): comment texts, author names, replies, and hide and delete actions on your videos. Liking YouTube comments is not possible through the API.

We use Google user data solely to provide the YouTube connection you requested and its visible features: channel overview, your own uploads, metrics, performance comparisons, content signals derived from them and — if you turn on Comments — the comment inbox (read, reply, hide, delete). We do not sell this data, do not use it for advertising and do not share it with third parties, except with the processors listed in section 5 where this is necessary to operate and provide the App. This use complies with the Google API Services User Data Policy, including the Limited Use requirements.

d) Technical data & notifications

Server log data (e.g. IP address, timestamp), your language setting and time zone and — if you turn on push notifications — device-related push subscription data. We only send email reminders if you turn that option on.

e) Reach and performance measurement

We use Cloudflare Web Analytics to understand and improve aggregated page views and the App’s technical performance. The service does not use cookies or local storage for this and does not build cross-user advertising profiles. Loading the measurement script technically opens a connection to Cloudflare; we only receive aggregated reports and no individual user profiles.

3. Purposes and legal bases

4. AI processing (“Brainy”)

For recommendations, chat features and — if you turn on Comments — the classification of comment texts, we send relevant content (e.g. captions, comment texts, onboarding answers, aggregated metrics) to AI service providers that we connect through a provider gateway. Depending on load and model choice, providers such as Anthropic, OpenAI or Google may act as processors. Your content is not used to train third-party models.

5. Recipients / processors

• Clerk — authentication and user management.
• Neon — database hosting.
• Vercel — hosting and delivery of the App and private object storage (Blob) for content piece attachments.
• Cloudflare — aggregated reach and performance measurement via Cloudflare Web Analytics.
• Resend — sending email notifications.
• AI providers (through a gateway, see section 4).
• TikTok — source of the TikTok data you shared.
• Meta Platforms (Instagram) — source of the Instagram data you shared.
• Google (YouTube) — source of the YouTube data you shared.

Protection of platform and Google user data

Data is protected in transit with TLS. OAuth tokens are stored on the server only, never handed to the browser or other users, and technical access controls limit them to the processes needed for operation. We do not log OAuth tokens and limit our service providers’ access to providing the features described.

6. Transfers to third countries

Some of the providers listed process data in the USA. Transfers are based on the EU Standard Contractual Clauses or a valid adequacy mechanism.

7. Retention

We store your data for as long as your account exists. When you disconnect a TikTok or Instagram connection, no new data is synced and existing data is no longer included in views or comparisons. It is kept as an excluded backup for a later reconnection. When you disconnect TikTok, we also send a revocation to the TikTok API.

When you disconnect a YouTube connection, ContentBrainy immediately deletes the imported channel and video data, metric histories and the affected derived analysis caches, and sends Google a request to revoke the authorization. If the external revocation fails, the local deletion still stands; you can additionally revoke access in the Google settings linked below. The regular sync also confirms that the authorization is still valid. If Google explicitly confirms when refreshing access that the authorization is invalid or revoked, we delete the related YouTube data as well. You can also manage authorizations in your Google account security settings.

With “Delete all data” under Connected Socials you can permanently remove any connection and the posts and statistics snapshots stored for it. Deleting in ContentBrainy does not delete any content on the connected platform. When you delete your ContentBrainy account, your data is deleted unless statutory retention obligations apply.

8. Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection, and the right to withdraw any consent you gave at any time with effect for the future. You can disconnect platform connections at any time in the App settings (Connected Socials). For TikTok and YouTube we also send a revocation request to the respective API; for YouTube the imported data is deleted as well. Independently of this, you can revoke authorizations in the settings of TikTok, Instagram/Meta or Google. You also have the right to lodge a complaint with a supervisory authority. For any request, contact team@contentbrainy.app.

9. Cookies and local storage

We use technically necessary cookies or local storage for sign-in (session) and for App settings. There is no tracking for advertising purposes. Cloudflare Web Analytics sets no cookies for this and uses no local storage.

10. Changes to this policy

We update this privacy policy when features or the legal situation change. The version published here applies.