Privacy Policy

Last updated: October 18, 2026

This Privacy Policy explains how ContentCloud processes personal data in compliance with GDPR and other applicable privacy laws. We are committed to protecting your privacy and being transparent about our data practices.

1. What Personal Data We Collect

2. Legal Basis for Processing

• Contract Performance: To provide ContentCloud services as agreed
• Legitimate Interests: To improve, secure, and optimize our services
• Consent: For marketing communications and non-essential cookies
• Legal Obligation: To comply with applicable laws and regulations

3. How We Use Your Data

• Provide AI-powered search and knowledge management services
• Generate cited responses based on your uploaded content
• Maintain and improve service performance and security
• Provide customer support and technical assistance
• Send service-related communications and updates
• Comply with legal obligations and prevent fraud

4. Data Sharing and Disclosure

We do not sell personal data. We may share data with:

• Model providers: retrieved content passages and modified queries sent for AI processing in EU regions under Zero Data Retention contracts; provider identities are not published on this website
• Web search: CCBot reasoning issues rewritten queries without conversation context to a privacy-conscious search provider, with no data that could identify the end user
• Service Providers: EU-based infrastructure providers for hosting
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In case of merger or acquisition (with notice)

All third-party processors are bound by strict data protection agreements and GDPR compliance requirements.

5. International Data Transfers

Your data is processed within the European Union. If any transfers outside the EU are necessary, we use Standard Contractual Clauses (SCCs 2021/914) and ensure adequate protection measures.

6. Data Retention

• Account closure: After an end-user or business account is closed, its profile, saved conversations and account-owned content are deleted from live systems and backups within 30 days in total.
• Ingested organisational content: Retention windows are configurable per deployment and agreed in your service terms
• Registered end-user conversations: Kept until the user deletes them; users can delete conversations at any time, and organisation administrators cannot read them
• Anonymous visitor history: Saved in the visitor's browser local storage
• Prompt/response and security logs: ContentCloud retains anonymous prompt/response logs for 30 days and security logs for up to 90 days. After account closure, user-identifiable security records are deleted or irreversibly anonymised within 30 days, subject to specific legal-retention obligations. These records are separate from the conversation history saved in your browser.
• End-user uploaded files: Session-only; deleted by the user or automatically when the session ends
• Technical and operational logs: Used for analytics and billing and managed only by ContentCloud; account-associated records follow the closure policy, subject to specific legal-retention obligations
• Consent records: Kept for up to 6 months

Any legally required retention is limited to the necessary records and required period. The legal basis, purpose, retention period and access restrictions are documented, and these records are kept separate from ordinary product use.

7. Your Rights Under GDPR

You have the right to:

• Access: Request copies of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Limit how we process your data
• Portability: Receive your data in a structured format
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: For processing based on consent

To exercise these rights, contact our DPO at dpo@contentcloud.com.

8. Data Security

We implement comprehensive security measures:

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Regular security audits and penetration testing
• Access controls and multi-factor authentication
• Incident response and breach notification procedures
• EU-based data centers selected for strong security and operational controls

9. Cookies and Tracking

This website uses essential cookies for functionality and, with your consent, hosted Matomo analytics to understand how visitors use the site. No other third-party tracking is employed. You can manage cookie preferences through our cookie banner or browser settings. See our Cookie Policy for detailed information.

10. Children's Privacy

Our services are not intended for children under 16. We do not knowingly collect personal data from children. If you believe we have collected such data, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of material changes via email or service notifications.

12. Contact and Complaints

For privacy-related questions or to exercise your rights, contact:

• Data Protection Officer: dpo@contentcloud.com
• Legal Team: legal@contentcloud.com
• General Contact: Contact Form

You have the right to lodge a complaint with your local supervisory authority if you believe we have not addressed your privacy concerns adequately.