Privacy Policy

1. Data Controller

ArticleAI is the data controller for personal data processed through this service. You can contact us via our contact form.

2. Data We Collect

• Account data: email address and authentication credentials.
• Article inputs you submit: target keyword, location, business name, target audience, tone, optional competitor URL, optional additional instructions, and (if you connect WordPress) your site URL, username, and application password.
• Generated articles and revision history.
• Payment metadata from Stripe (transaction IDs, package purchased). We never see or store full card details — Stripe processes payments directly.
• Basic usage data via Google Tag Manager and standard server logs (page views, IP address, user agent).
• Messages you send us via the contact form.

3. How We Use Your Data

• To deliver the service: generate articles, store them in your dashboard, and email them to you.
• To process payments and grant package credits.
• To respond to support requests.
• To detect abuse and protect the service.
• To improve the product through aggregated usage analysis.

4. Lawful Basis

We rely on contract (to provide the service you've signed up for) and legitimate interests (to keep the service secure, prevent fraud, and improve the product). Where you submit a contact form message, we rely on your consent.

5. Sub-Processors

We use the following third-party providers to run the service. The inputs you submit are shared with these providers only as needed:

• Supabase — database, authentication, and backend hosting.
• Stripe — payment processing.
• OpenAI — AI article generation. Your article inputs are sent to OpenAI to produce each article.
• Firecrawl — used to scrape your website or competitor URL when you submit one.
• Resend — transactional email delivery.
• Google Tag Manager — analytics and conversion tracking.
• Lovable — application hosting.

6. International Transfers

Some of our sub-processors are based outside the UK (for example, in the United States). Where data is transferred outside the UK, we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or equivalent safeguards.

7. Data Retention

We keep your account data, articles, and inputs for as long as your account is active. If you delete your account using the in-app delete option in Settings, your data is removed within 30 days, except where we are required to retain limited records for legal or accounting reasons (for example, Stripe transaction records).

8. Your Rights (UK GDPR)

You have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased ("right to be forgotten").
• Restrict or object to processing.
• Receive a copy of your data in a portable format.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, contact us via our contact form.

9. Cookies

We use essential cookies for authentication and session management, and analytics cookies via Google Tag Manager to understand how the service is used. We do not use advertising cookies.

10. Security

We protect your data with HTTPS in transit, Row Level Security on our database, Stripe-hosted checkout (so we never handle card numbers), and standard access controls. No system is completely secure, so we cannot guarantee absolute security.

11. Children

The service is intended for businesses and is not directed at children under 16. We do not knowingly collect data from children.

12. Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top of this page will reflect any changes.

13. Contact

For any questions about this Privacy Policy or your data, please get in touch via our contact form.