Privacy Notice
Operator: EWORX S.A., trading as ContentCloud
Last updated: October 18, 2026
Short Summary (Layered Privacy)
- Who: Operated by EWORX S.A. (trading as ContentCloud), Agias Varvaras 40, Chalandri, Greece.
- What we process: Prompts, answers, security records and applicable account/analytics data. Saved anonymous history stays in your browser. ContentCloud retains anonymous prompt/response logs for 30 days and security logs for up to 90 days. After account closure, user-identifiable security records are deleted or irreversibly anonymised within 30 days, subject to specific legal-retention obligations. These records are separate from the conversation history saved in your browser. Registered users can delete their saved conversations.
- No training by default: Your interactions are NOT used to train our general AI models unless you explicitly choose to opt in.
- EU Data Residency: All data is stored and processed within the EU (no transfers to third countries outside the EEA).
- Your choices: Control analytics, reset sessions, delete history, or exercise your GDPR rights by emailing dpo@contentcloud.com.
#1Controller identity
EWORX S.A., trading as ContentCloud, is the controller for the personal data described in this notice, unless a separate controller is clearly identified for a specific embedded deployment. Our registered office is at Agias Varvaras 40, 15231 Chalandri, Greece.
#2Services covered
This notice covers public consumer-facing use of CCBot and CCBot Mobile, including anonymous sessions, registered end-user features, mobile permissions, and customer support interactions.
#3Data we process in anonymous sessions
We may process the text of your prompts, the answers returned to you, session identifiers, device/browser/app metadata, language and accessibility preferences, security logs and abuse-prevention data. Saved conversation history for anonymous website use stays in your browser's local storage. ContentCloud retains anonymous prompt/response logs for 30 days and security logs for up to 90 days. After account closure, user-identifiable security records are deleted or irreversibly anonymised within 30 days, subject to specific legal-retention obligations. These records are separate from the conversation history saved in your browser. System failures are recorded at the backend without association with user-side identification. We aim to avoid collecting directly identifying account data where anonymous use is possible.
#4Data we process for authenticated features
For registered end users — members of an organisation running a CCBot installation — we may process your name, username, email, password hash or SSO token, subscription status, saved history, preferences, exports, device associations, account security events, support records, and communication preferences.
#5Data we process in mobile use
CCBot Mobile uses device-local storage for app functionality. You can manage local app data using the app-storage controls available on your device. Registered conversations and account deletion are handled through the service. System failures are recorded at the backend without association with user-side identification.
#6Reasoning, uploaded files and web search
Reasoning is available to registered end users belonging to an organisation. If you upload a file for a reasoning request, it is stored solely on EU-based infrastructure for the duration of the session, is accessible only to you, and is deleted by you or automatically when the session ends. Reasoning requests to our model providers carry retrieved passages from organisational sources and modified queries; providers process them in EU regions under Zero Data Retention contracts. Web search issues a rewritten query without conversation context through a privacy-conscious search provider, and includes nothing that could identify you. Account cancellation triggers automatic deletion of your content.
#7Conversation history and who can access it
For anonymous website use, saved history stays in your browser's local storage. ContentCloud retains anonymous prompt/response logs for 30 days and security logs for up to 90 days. After account closure, user-identifiable security records are deleted or irreversibly anonymised within 30 days, subject to specific legal-retention obligations. These records are separate from the conversation history saved in your browser. For registered end users, conversations are kept until you delete them, and your organisation's administrators cannot read them. Conversations are subject to guardrail screening operated by ContentCloud for safety and abuse prevention. Operational logs used for analytics and billing are managed only by ContentCloud, with no sub-processors on that path.
#8Data we do not use for training by default
We do not use your prompts, conversation history, uploads, or outputs to train our general AI models by default. If we later offer an optional improvement programme, it will be clearly separated and rely on an explicit opt-in choice.
#9Purposes and legal bases
We process personal data: (a) to provide the Service and return answers you request; (b) to maintain security, prevent abuse, investigate incidents, and protect users; (c) to maintain your account, if you create one; (d) to comply with legal obligations; (e) to send service notices; (f) to support you if you contact us; and (g) only with consent where we use non-essential analytics, push notifications, persistent memory, marketing communications, or other optional features requiring consent. We rely primarily on performance of a contract where you ask us to provide the digital service, legitimate interests for proportionate security and anti-abuse processing, legal obligation for mandatory compliance records, and consent where law requires it or where we make a feature optional.
#10Legitimate interests balancing statement
Where we rely on legitimate interests, those interests are limited to securing the Service, preventing fraud and misuse, maintaining service integrity, investigating incidents, handling complaints, and producing de-identified service statistics. We consider those interests necessary and proportionate because they are expected in a secure AI service, are supported by user controls, and are balanced by data-minimization, short retention, access restriction, and reset/delete tools.
#11Cookies, local storage, SDKs, and other device access
We use strictly necessary device-side storage or access only where needed for core functions such as session continuity, user-requested saved settings, accessibility settings, load balancing, and abuse prevention. Optional analytics, marketing technologies, non-essential persistent identifiers, or non-essential local storage are used only if legally permitted and, where required, after consent.
#12Recipients
We may share data with carefully selected processors and service providers that help us host, secure, analyze, support, notify, or maintain the Service. We do not sell your personal data.
#13International transfers
If processing is deemed necessary, it will be kept within the EU/EEA.
#14Retention defaults
ContentCloud retains anonymous prompt/response logs for 30 days and security logs for up to 90 days. After account closure, user-identifiable security records are deleted or irreversibly anonymised within 30 days, subject to specific legal-retention obligations. These records are separate from the conversation history saved in your browser. End-user uploaded files for reasoning are session-only, deleted by you or at session end. Registered conversation history is kept until you delete it or close the account. After an end-user or business account is closed, its profile, saved conversations and account-owned content are deleted from live systems and backups within 30 days in total. Consent records are kept for up to 6 months. Device-local app data can be managed through your device's app-storage controls.
#15Deletion and anonymization
We delete or irreversibly anonymise data when its retention period ends. Account closure applies the 30-day deadline to account data and user-identifiable security records, including live systems and backups. Any legally required retention is limited to the necessary records and required period. The legal basis, purpose, retention period and access restrictions are documented, and these records are kept separate from ordinary product use.
#16Profiling and automated decision-making
We do not use the standard public consumer version of CCBot to make solely automated decisions producing legal or similarly significant effects about you. We may use limited session-based personalization, safety filtering, spam scoring, or abuse signals to protect and tune the service. You may object to legitimate-interest processing and reset personalization settings where available.
#17Children
The Service is not designed to solicit sensitive personal data from children. In Greece, where consent is the basis for an information-society-service feature, the age threshold is 15 unless parental authorization is provided as required by law. In other EEA states, a different local age threshold may apply.
#18Your rights
Depending on the circumstances, you may have rights of access, rectification, erasure, restriction, portability, objection, complaint to a supervisory authority, and withdrawal of consent at any time where consent is the basis. If you are anonymous and we cannot identify you, we may ask for additional information to locate your data; we will not collect extra identifying data solely for that purpose unless necessary to act on your request.
#19How to exercise rights
Contact dpo@contentcloud.com. To help us locate anonymous session data, provide the date/time of use, copy of the prompt or answer, error/reference ID if shown, device type, and approximate location or language settings if available.
#20Supervisory authority and complaints
You may complain to the Hellenic Data Protection Authority or the supervisory authority in your habitual residence in the EEA. We encourage you to contact us first so we can try to resolve the issue directly.
#21Security summary
We use proportionate technical and organizational measures such as encryption in transit, access controls, monitoring, logging, patching, backup procedures, and incident-response plans.
#22Mobile stores and third parties
If you download the app through Apple App Store or Google Play, those platforms may separately process app-install, purchase, and device data under their own roles and privacy terms. Their app privacy labels and data-safety disclosures must be kept consistent with our actual practices.
#23Changes to this notice
We may update this notice when the Service or the law changes. Material changes will be highlighted in-app, on the website, or by email where appropriate.