Privacy Policy

Content Flow AI ("CFAI", "we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered content generation service. By using Content Flow AI, you agree to this policy.

2.1 Information You Provide

• Account Information: Email address, name, and authentication account data
• Profile Information: Optional profile details you choose to provide
• Content Data: Keywords, articles, outlines, and other content you create
• Integration Settings: Google Drive folder IDs and WordPress credentials if integrations are enabled
• Payment Information: Subscription transaction details, bank-transfer proof, payment codes, and administrative approval records used by the SePay-supported payment flow

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, time spent, and content generation statistics
• Device Information: Browser type, operating system, and device identifiers
• Log Data: IP address, timestamps, and error logs
• Cookies: Essential cookies for authentication and session management

2.3 Third-Party Data Collected for Content Generation

To provide AI-powered content generation, we collect publicly available data from the internet such as search engine results and competitor content. This data is used solely to generate SEO recommendations and is not stored long-term or shared except as required for AI content generation.

This section addresses our use of Google user data in compliance with Google API Services User Data Policy.

3.1 Google OAuth and Sign-In

When you sign in with Google, we request basic profile information: email address, name, and optional profile picture. We use this information solely to authenticate your account and personalize your experience. Your Google profile data is stored securely in our database.

3.2 Google Custom Search API

When you create a content job, we send your keyword to Google Custom Search API to retrieve public search result titles, URLs, and snippets. This does not access your personal Google Search history.

3.3 Google Drive Integration (Optional)

If enabled, we request the drive.file scope to access only files created by our app or the folder you designate for exports. You can revoke Drive access at any time through Google Account permissions.

3.4 Google Search Console Integration (Optional)

If connected, we request webmasters.readonly access to display search performance metrics for URLs you track, including clicks, impressions, CTR, position, top queries, device breakdown, and historical trends. You can disconnect GSC in project settings or through Google Account permissions.

3.5 Google Analytics 4 Integration (Optional)

If connected, we request https://www.googleapis.com/auth/analytics.readonly to access aggregated page/content metrics such as pageviews, sessions, bounce rate, average session duration, traffic source, device type, country/region, and configured conversion metrics. We do not collect user IDs, IP addresses, or individual visitor behavior.

3.6 Limited Use Disclosure

3.7 No Sale or Transfer of Google User Data

We do not sell, rent, or transfer Google user data to third parties. Google data is used exclusively to provide authentication, optional Drive export, optional Search Console integration, and optional Google Analytics integration.

• Service Delivery: Provide content generation, manage your account, and enable requested features
• Authentication: Verify identity and maintain secure sessions through Better Auth
• Content Generation: Process keywords and generate SEO-optimized articles using AI models
• Integrations: Export content to Google Drive or WordPress if enabled
• Payment Processing: Process subscription transactions and manage billing through the SePay-supported payment flow
• Service Improvement: Analyze usage, fix bugs, and develop features
• Communication: Send service updates, security alerts, and support responses
• Legal Compliance: Comply with laws and enforce our Terms

• AI Service Providers: Content and prompts are sent to Google Gemini or OpenAI through an administrator-configured provider
• Authentication Provider: Better Auth manages session and OAuth account linkage
• Payment Flow: Transaction data is used for SePay matching, bank transfer verification, and admin approval workflows
• Google Drive: If enabled, exported content is saved to your own Google Drive
• WordPress: If enabled, published articles are sent to your WordPress site
• Legal Requirements: When required by law, court order, or government request
• Business Transfers: In a merger, acquisition, or sale of assets with notice to users

We never sell your personal information to third parties for marketing purposes.

Your data is stored on secure cloud infrastructure with data centers in the United States.

• Account data is retained while your account is active
• Content data is retained until you delete it or close your account
• Usage logs are retained for 90 days for security and analytics
• Backup data is retained for 30 days for disaster recovery

When you close your account, we delete your data within 30 days except for data we are legally required to retain.

• Encryption: Data encrypted in transit and at rest
• Authentication: Secure OAuth/session management
• AI Credentials: Administrator-managed provider credentials are encrypted before storage and are not exposed to end users
• Access Controls: Role-based access and least privilege
• Monitoring: Security monitoring and logging
• Regular Audits: Periodic security assessments and updates

No internet transmission method is 100% secure. We strive to protect your data but cannot guarantee absolute security.

• Access: Request a copy of your personal data
• Correction: Update inaccurate information
• Deletion: Request deletion of your data
• Data Portability: Export data in a machine-readable format
• Opt-Out: Unsubscribe from marketing emails
• Revoke Consent: Withdraw OAuth permissions for Google integrations
• Object to Processing: Object to certain data uses

8.1 How to Request Data Deletion

1. Use account settings to delete your account when self-service deletion is available.
2. Email cfai@seoon.top with subject "Data Deletion Request" and include your account email.
3. Revoke Google OAuth permissions through Google Account permissions.

We acknowledge deletion requests within 48 hours and complete them within 30 days, except data legally required to be retained, anonymized aggregate analytics, or backup data scheduled for deletion.

• Essential Cookies: Required for authentication and session management
• Functional Cookies: Remember preferences and settings

We do not use advertising cookies or third-party tracking scripts. We do not track you across other websites.

Content Flow AI is not intended for users under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected data from a child, contact us immediately and we will delete it.

If you access our service from outside the United States, your data may be transferred to and processed in the United States. By using our service, you consent to such transfers.

We may update this Privacy Policy from time to time. Material changes may be notified by email, prominent website notice, or an updated Effective Date. Continued use after changes take effect constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or our data practices, please contact us:

If you sign in with Google or use Google integrations, this summary highlights the most important data practices.

• Google Sign-In only accesses email, name, and optional profile picture for authentication
• Google Custom Search retrieves public search results for keywords you provide
• Google Drive access is limited to app-created files or designated export folders
• Google Search Console access is read-only for tracked URL performance metrics
• Google Analytics 4 access is read-only and aggregated; no PII is collected
• Aggregated GA4 metrics may be cached for quota optimization and historical comparison
• Google data is never sold or used for advertising
• You can revoke permissions through Google Account settings
• We comply with Google API Services User Data Policy and Limited Use requirements
• You can request data deletion by email or account settings