Legal
Privacy Policy
Last updated: October 14, 2026
This policy explains what personal data [SELLER LEGAL NAME], [ADDRESS] ("we", "us") collects when you visit this site, buy Content Machine or apply for the Done for you service, and what you can do about it. We are the data controller. For any privacy question or request, write to [CONTACT EMAIL].
1. What we collect
| Data | When | Why |
|---|---|---|
| Name, email address, billing country and postal code | At checkout | To deliver your purchase, send receipts, calculate tax and contact you about your access |
| GitHub username | At checkout (custom field) or by email | To invite you to the private repository |
| Payment details | At checkout, collected directly by Stripe | To charge you. We never receive your full card number |
| Application answers (name, email, brand, handle, niche, volume, budget, notes) | When you send the Done for you application by email | To decide whether we're a fit and to reply |
| Emails you send us | When you write to us | To answer you |
| Technical data (IP address, browser, pages requested) | When you visit the site | To serve the pages and keep them secure |
We do not ask for and do not want sensitive data such as health information. Please don't include it in an application.
2. Who processes data for us
We share data only with the services we need to run the product:
- Stripe (payments, tax calculation and fraud prevention). Stripe processes your payment data under its own privacy policy at stripe.com/privacy and may act as an independent controller for fraud prevention and legal compliance.
- GitHub (repository access). Your GitHub username is used to send the invitation. GitHub's own privacy statement applies to your GitHub account.
- Cloudflare (hosting this site). Cloudflare processes technical data such as IP addresses to deliver and protect the pages.
- Google Fonts (typefaces on this site). Your browser requests fonts from Google's servers, which receive your IP address.
- [EMAIL PROVIDER] (sending the welcome and onboarding emails).
We don't sell your personal data and we don't share it for advertising.
3. Cookies
This site does not set analytics or advertising cookies. The pages work without any cookie from us. When you open a Stripe checkout page, Stripe sets cookies that are needed to process the payment and prevent fraud. Those cookies are covered by Stripe's cookie policy. If we ever add analytics or advertising tools, we'll update this policy and ask for consent where the law requires it.
4. Legal bases (GDPR)
If you are in the European Economic Area, the UK or Switzerland, we rely on these legal bases:
- Contract: to process your order, deliver access and provide support.
- Legal obligation: to keep invoices and tax records.
- Legitimate interest: to keep the site secure, prevent fraud and answer applications you sent us.
- Consent: for marketing emails, which you can withdraw at any time with the unsubscribe link.
5. Legal bases (LGPD, Brazil)
If you are in Brazil, we process your data under the Lei Geral de Proteção de Dados (Law 13,709/2018) on the bases of contract performance, compliance with legal obligations, legitimate interest and consent, matching the purposes in section 4.
6. How long we keep data
- Purchase and tax records: as long as tax law requires, usually 5 to 10 years.
- Account and access data: while you have access, and up to 12 months after it ends.
- Applications that didn't turn into a contract: up to 12 months.
- Marketing list: until you unsubscribe.
7. International transfers
Our providers may process data in the United States and other countries. Where the GDPR or LGPD requires it, those transfers rely on safeguards such as the European Commission's Standard Contractual Clauses or the providers' certifications.
8. Your rights
Depending on where you live, you can ask us to:
- confirm whether we process your data and give you a copy
- correct data that is wrong or incomplete
- delete your data, unless we must keep it by law
- restrict or object to some processing
- send your data to you or another service in a portable format
- withdraw consent you gave earlier
- tell you who we share data with
Send requests to [CONTACT EMAIL]. We answer within 30 days, and within 15 days for requests under the LGPD. You can also complain to your local data protection authority, for example your EU supervisory authority or the ANPD in Brazil.
9. Security
We use services with strong security practices, keep access to personal data limited to the people who need it and never store card data. No system is perfectly secure, and we'll tell you without undue delay if a breach affects your data.
10. Children
Content Machine is for adults. We don't knowingly collect data from anyone under 18.
11. Changes
We'll post any change to this policy on this page with a new date. If a change is significant, we'll email buyers.
12. Contact
[SELLER LEGAL NAME] [ADDRESS] [CONTACT EMAIL]