Security and data handling

Drafting and image generation send your input to external AI services for processing. We use business services that don't train their models on inputs.

We don't train AI on your content either, and AI output is meant to be reviewed and approved by a person before it's published.

Members, roles and permissions are set per workspace. Articles can't be published without human approval, and approvals are recorded.

Connected services such as WordPress and Google Search Console are used only within what you connect, and only for work you set up, such as publishing, scheduled publishing and regular Search Console data syncs.

Long-lived credentials, such as WordPress application passwords and Google refresh tokens, are stored encrypted with AES-256-GCM.

Payments are processed by Stripe. Card numbers never pass through or rest on our servers; we only receive the brand, last four digits, expiry and billing history.

We keep your data for 30 days after cancellation takes effect and help you export it on request, then delete it. Contract and billing records are kept as long as the law requires.

We maintain handling rules, a responsible officer, staff training and confidentiality, access-rights management, encrypted connections and protection against unauthorized access. See the privacy policy for details.

If a leak or similar incident is likely to seriously harm individuals, we promptly report it to the Personal Information Protection Commission and notify those affected, as APPI requires.