§ 01 · PRIVACY

Privacy Policy.

This is a plain-language summary of how Content OS handles your data. It is not legal advice. Last updated June 19, 2026.

Content OS ("we", "us") is a content-intelligence dashboard for Instagram creators. This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, and the choices you have. It is written to be readable; where a legal term matters, we say so plainly.

Who this applies to and where we operate

Content OS is offered to creators in Latin America and the United States. Visitors detected as being in the European Union or the United Kingdom are not able to sign up today and are directed to a waitlist instead. Because of this, we do not auto-detect jurisdiction by IP address.

Our base legal framework is Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP). Where relevant, this policy also reflects the spirit of the California Consumer Privacy Act (CCPA) for U.S. residents and Brazil's Lei Geral de Proteção de Dados (LGPD) for Brazilian users. The governing law for this service is Mexico.

What data we collect

We collect only what the product needs to work. Data falls into these categories:

a. Identity and account

  • Your email address.
  • Your password — hashed and stored by our authentication provider (Supabase). We never see or store your plaintext password.
  • If you sign in with Google, basic Google profile information (name, email, profile image) returned by the OAuth flow.
  • Optional profile fields you choose to provide: name, username, content niche, content formats, and goals.
  • Your preferences, such as interface language and display settings.

b. Instagram connection

  • Your Instagram account id and username.
  • An access token for the Instagram Graph API, stored encrypted with AES-256-GCM. This token is never exposed in the interface or to other users.
  • Sync timestamps recording when we last fetched data from Instagram.

c. Content and metrics

  • Your reels: caption, thumbnail, permalink, and publication dates.
  • Per-post metrics: views, likes, comments, shares, saves, reach, and the engagement ratios we compute from them.
  • Your follower history over time.

d. AI-generated data

  • Transcriptions of your reels' audio.
  • Written analysis of your content.
  • Visual descriptions of your reels' frames.
  • Vector embeddings used for semantic search across your own content.

e. AI assistant chat history

  • Conversations you have with the in-app AI assistant. (This feature ships in a later release; we list it here so the category is covered.)

f. Billing

  • A customer id and your subscription status, handled through our payment processor, Stripe.
  • We do not store your card details. Card data is handled entirely by Stripe.

g. Analytics

  • Aggregate, anonymous usage statistics collected through Vercel Web Analytics, which is cookieless and does not track or profile you individually.

How we use your data

  • To provide the core service: connecting your Instagram account, fetching your metrics, and computing engagement ratios.
  • To generate AI analysis, transcriptions, visual descriptions, and semantic search over your own content.
  • To operate your account, authenticate you, and remember your preferences.
  • To process subscription payments and manage your plan.
  • To understand product usage in aggregate so we can improve Content OS.
  • To communicate with you about your account and the service.

We do not sell your personal data, and we do not use it for advertising.

Sub-processors

We rely on a small number of trusted service providers ("sub-processors") to run Content OS. Each processes data only as needed for its function:

  • Supabase — database and authentication (stores your account, content, and metrics). Privacy policy
  • Vercel — application hosting, CDN, edge network, and cookieless web analytics. Privacy policy
  • OpenAI — AI analysis, transcription, and embeddings. Inputs sent to the OpenAI API are not used to train OpenAI's models. Privacy policy
  • Stripe — subscription billing and payment processing. Privacy policy
  • Resend — transactional email (for example, account and verification messages). Privacy policy

Data retention

We keep your data while your account is active. When you delete your account, your data enters a 90-day grace period during which it can be recovered. After 90 days, your data is permanently and irreversibly deleted from our systems.

Your rights

You can:

  • Access the personal data we hold about you.
  • Delete your account and data.
  • Export a copy of your data (data portability).

You can exercise these rights from within the app or by contacting us. See the Data Deletion page for the deletion and export process.

Security

Your Instagram access token is encrypted at rest with AES-256-GCM. Passwords are hashed by our authentication provider. Access to your data is isolated per account at the database level.

Children

Content OS is not directed to anyone under the age of majority in their jurisdiction, and we do not knowingly collect data from minors.

Changes to this policy

If we make material changes to this policy, we will update the date above and, where appropriate, notify you.

Contact

For any privacy question or request, contact us at content.os.saas@gmail.com.

This document is a plain-language summary, not legal advice. Last updated June 19, 2026.