Privacy policy

1. What we collect

We collect only what the service needs to work:

• Account details: your name, email address and profile picture, received from the sign-in method you choose (a one-time link sent to your email, Google or Facebook). We never receive or store your Google or Facebook password.
• Your work: the topics, articles, comments, review decisions and media files you create or upload, and the history of changes to them.
• Your place in the newsroom: desks, roles and approval steps, and royalty statements where the newsroom uses that feature.
• Notification details: the browser or device you allow push notifications on and, only if you connect them yourself, the identifier Messenger or Telegram gives us for your chat with our notification bot.
• Activity records: who did what and when on topics, articles, posts and settings (the audit trail a newsroom needs), and when you last signed in.
• Technical data: IP address and browser type, used to protect the service against abuse and to diagnose errors.

2. Data from the social channels a newsroom connects

An administrator of a newsroom can connect its Facebook Pages, Instagram professional accounts, Threads profiles, YouTube channels and TikTok accounts. For a connected channel we receive and store:

• the channel's name, picture and identifier;
• access tokens that let us publish and read statistics on the newsroom's behalf. They are stored encrypted, and only the background service that talks to the platform can decrypt them;
• the posts published on the channel and their statistics (such as views, reactions, comments and shares), to show the newsroom how its content performs.

We use this data only to provide the service to that newsroom. We do not sell it, do not use it for advertising, and do not combine it with the data of other newsrooms.

The YouTube features use YouTube API Services. When you use them, the Google Privacy Policy also applies: https://policies.google.com/privacy. You can withdraw our access to a Google account at any time at https://myaccount.google.com/permissions.

3. How we use personal data

• To sign you in and show you the desks and the work you are allowed to see.
• To run the editorial workflow: assign, review, schedule and publish, and keep a record of who approved what.
• To notify you about work that waits for you, through the channels you choose (in the app, push, email, Messenger or Telegram).
• To show statistics, leaderboards and, where used, royalty calculations to the people the newsroom allows to see them.
• To keep the service secure and working: limit abuse, investigate errors and make backups.

If a newsroom switches on the AI assistant, the text an editor asks it to work on (for example an article to review or a caption to shorten) is sent to our AI provider to produce the suggestion. Topic titles are also compared by a language model to find duplicates. We do not use your content to train AI models.

4. Who processes data for us

We do not sell personal data. We share it only with the providers that run parts of the service for us, and only as far as they need it:

• Supabase: database and sign-in, hosted in Singapore.
• Vercel: hosting of the web application.
• Cloudflare: background jobs, storage of media files, and the language model that compares topics.
• Resend: delivery of emails such as invitations and notifications.
• Anthropic: the AI assistant, only when a newsroom uses it. Requests may pass through the AI gateway of Vercel or Cloudflare.
• Meta, Google, TikTok and Telegram: when a newsroom connects a channel, or you connect a chat, we exchange with that platform what is needed to publish, read statistics or send you a notification.

We may also disclose data when the law requires it.

5. Where data is stored

The database is hosted in Singapore. Some of the providers above may process data in other countries; when they do, we rely on the safeguards in our contracts with them.

6. How long we keep it

• Account details: for as long as you are a member. When your account is erased they are removed (see Deleting your data).
• Your work (topics, articles, comments, reviews, media): kept as part of the newsroom's record, also after you leave. After erasure it is shown under "Deleted user" instead of your name.
• Notifications: by default removed 180 days after you read them, and after one year in any case.
• Activity records (audit trail): at least 24 months.
• Records of AI requests: about 13 months by default.
• Backups: they expire on a fixed schedule and are not edited one by one.

A newsroom's administrator can shorten or extend some of these periods within fixed limits.

7. Your choices and rights

You can ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. You can change your name, picture, language and notification channels yourself in your personal settings, and disconnect Messenger or Telegram there at any time.

To make a request, write to privacy@copywriter.vn from the email address of your account. We may ask a question to confirm it is you. We answer as soon as we can, and within the time the law requires. How deletion works is described in Deleting your data.

If you signed in with Facebook or Google, you can also remove copywriter.vn from the apps connected to that account. That stops new data from reaching us, but it does not by itself delete what we already hold.

8. Security

Access is by role and by desk, and it is enforced in the database itself, not only on the screen. Connections are encrypted. Channel access tokens are stored encrypted. No system is perfectly secure; if we learn of a breach that affects you, we will tell you and your newsroom.

9. Children

The service is a work tool and is not meant for children. We do not knowingly collect data from anyone under 16.

10. Changes to this policy

When we change this policy we update the date at the top. If a change matters to how your data is used, we tell members in the app or by email.

11. Contact

The copywriter.vn team: privacy@copywriter.vn.