1. Who we are

CompanyScribe is operated by [Company legal name], [registered address] ("CompanyScribe", "we", "us"). This policy explains how we handle personal data when you visit our website, create an account, or use the CompanyScribe app, including workspaces shown on an agency's own domain.

Questions or requests: [privacy@email].

2. Agencies and their clients

CompanyScribe is a tool for agencies and consultants (our customers). They create a workspace for each of their clients and invite the client's team.

• Content in workspaces (uploaded files, recordings, website imports, guides, comments, chats with the assistant) is controlled by the agency. For this content the agency is the controller and we are its processor: we only use it to provide the service, on the agency's instructions.
• Your account, our website, and billing: here we are the controller, and this policy applies directly.

If you were invited to a workspace by an agency (for example as part of a client's team), the agency added your email and decides how the workspace is used. For questions about that content, contact the agency first. If you contact us, we'll pass your request on to them.

Agencies that need a data processing agreement can request one at [privacy@email].

3. What we collect

You give us

• Account details: name, email address and a password (stored only as a secure hash).
• Workspace setup: workspace and agency names, logo, colours, custom domain, and team and role settings.
• Content: files you upload (PDF, Word, text, Markdown), audio and video recordings, websites you import, notes, guides you write or generate, version history, comments, reviews and approvals, and conversations with the assistant.
• AI provider keys that a workspace admin adds. These are stored encrypted.
• Billing details: if you subscribe, Stripe keeps your billing contact and payment details. We only keep your plan and payment status (and, if you bought through AppSumo, your license key).

Others give us

• Invitations: when someone invites you to a workspace, they give us your email address and the role you'll have.
• Content about you: recordings, documents or comments other people add may mention you. This is part of the agency's content (see section 2).

Collected automatically

• Session data: a sign-in session, with the IP address and browser (user agent) it was created from.
• Server logs: IP address, time, page or API address requested, response status, referrer and browser, for security and troubleshooting.
• Progress in starting lists: which guides a team member marked as done, and when. Workspace admins can see this.
• Visitors to public workspaces who use the assistant get a random visitor ID stored in their browser, so their conversations can be kept apart. It isn't linked to their name.
• Connected AI tools: if you connect an AI tool (like Claude or ChatGPT) to your account, we store the tool's registration and the access you approved.

We don't use advertising trackers, analytics tools or third-party cookies.

4. How we use it

We don't make automated decisions about people that have legal or similarly significant effects. The AI drafts documents; people review and publish them.

5. AI providers

Each workspace connects its own AI provider account by adding an API key. We support OpenAI, Anthropic, Google and OpenRouter. We don't provide AI keys or run AI models ourselves.

• What we send: only when someone uses an AI feature, we send what that feature needs to the provider the workspace picked. That can be chat messages and recent chat history, text from the workspace's guides and imported sources, the agency's writing templates, and, for transcription, the whole audio or video file.
• Whose agreement applies: the content is processed under the workspace's own account with that provider, and the provider's terms apply. Providers handle data differently. For example, some free tiers may use data to improve their models while paid API plans usually don't. Check your provider's terms and plan.
• Short-term copies: for video, we upload the file to Google's file service only for processing and delete it right after. OpenAI may keep a short-lived prompt cache (up to 24 hours) to speed up repeated requests.
• No training: we don't use your content to train AI models, and we don't let anyone else do so on our behalf. The AI provider processes it under the terms of your own account with them.
• Keys: AI keys are encrypted at rest, never shown again after saving, and used only for that workspace's requests.

AI-generated drafts can be wrong or incomplete. They're meant to be reviewed by people before they're published.

6. Who we share it with

We don't sell personal data or share it for advertising. We share it only with:

• The people in your workspace, according to the roles and access the workspace sets. Agency admins can see all of their clients' workspaces.
• Anyone with a share link, if someone in the workspace shares a published guide or makes a workspace public.
• Service providers who run parts of CompanyScribe for us, under contracts that limit their use of the data:

• AI providers picked by the workspace (see section 5). They act under the workspace's own agreement with them.
• Authorities or others when the law requires it, or to protect people, our users or the service.
• A buyer or successor if CompanyScribe is merged or sold, under the same protections.

We'll keep this list current and update this page before adding a new provider that handles personal data.

7. Cookies

We only use cookies and browser storage that the app needs to work, so there's no cookie banner. We don't use advertising or analytics cookies.

On an agency's custom domain the same cookies are set on that domain. The agency is responsible for any other tools it adds to its own website.

8. How long we keep it

• Content stays until someone in the workspace deletes it, or the workspace or agency is deleted. Deleting a workspace or agency deletes its guides, sources, files and chats. Published guides keep their version history until the guide is deleted.
• Resolved comments are deleted when the thread is resolved.
• Accounts stay until you ask us to delete yours. Email [privacy@email] and we'll delete it within [30] days.
• Invitations expire after 48 hours.
• Exported Word and PDF files are deleted after 7 days.
• Server logs are kept for [X days].
• Backups roll off within [X days].
• Billing records are kept as long as tax law requires.

Deleting a workspace or agency is immediate and can't be undone. Export the guides you need to Word or PDF first.

9. Security

We protect data with:

• encryption in transit (HTTPS);
• hashed passwords and encrypted AI keys;
• role-based access checks on every request;
• each client's workspace kept separate;
• protections against cross-site requests.

Uploaded source documents and recordings are private: no link opens them, and only our servers read them.

Images, videos and screenshots inside guides, guide covers and exports are served through hard-to-guess links. Anyone who has a link can open that file, so share links with care. Agency logos and favicons are public, because they appear on sign-in pages.

No system is perfectly secure. If a breach affects your personal data, we'll notify you, and the agency where relevant, as the law requires.

10. Your rights

Depending on where you live, you can ask us to:

• see the personal data we hold about you and get a copy;
• correct it;
• delete it;
• move it to another service;
• limit how we use it.

You can also object to uses based on our legitimate interests, and withdraw consent at any time where we rely on it.

You can change your name, email and password in your account settings. For anything else, email [privacy@email]. We'll reply within one month, and may ask you to confirm your identity first. For content inside an agency's workspace, we'll work with the agency to answer your request.

US residents: depending on your state, you can ask to know, access, correct, delete or port your data, and appeal if we say no. We don't sell personal data, share it for targeted advertising, or use it for profiling. You can use an authorized agent, and we won't treat you differently for using your rights.

Complaints: please tell us first and we'll try to fix it. We acknowledge complaints within 30 days. You can also complain to your local data protection authority (in the UK, the ICO).

11. International transfers

Our service providers may process data outside your country. When personal data from the EU or UK goes to a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses (and the UK addendum) or another lawful safeguard. Main hosting region: [region].

12. Children

CompanyScribe is a business tool for people aged 16 and over. We don't knowingly collect data from children. If you think a child has given us data, contact us and we'll delete it.

13. Changes to this policy

If we change this policy in a way that matters, we'll tell account owners by email or in the app at least 30 days before the change takes effect, and update the date at the top. We won't use content already in CompanyScribe in new ways (for example for AI training) without your permission.

14. Contact

[Company legal name], [registered address]. Email: [privacy@email].

[If the company is outside the EU/UK: EU and UK representative details.]