Privacy Policy

This Privacy Policy explains how Copyloom ("we," "us," or "our") collects, uses, shares, and protects your personal data when you use our website, dashboard, and AI marketing assistant (collectively, the "Service"). We are committed to protecting your privacy and processing your data in accordance with the EU General Data Protection Regulation ("GDPR") and other applicable data protection laws, regardless of where in the world you use our Service.

We collect the following categories of personal data:

• Account data — your email address, full name, and encrypted password, managed through our authentication provider, Supabase.
• Product data — the titles, descriptions, prices, and files you upload when creating digital products to sell.
• AI chat history — the messages you send to and receive from the AI marketing assistant, which we store so you can return to a conversation later.
• Usage data — information such as how many AI assistant messages you have sent, used to enforce free-tier usage limits.

We use your personal data to:

• Create and manage your account;
• Operate the Service, including displaying your products on your public sales pages;
• Generate marketing copy through the AI marketing assistant, based on the messages and product details you provide;
• Enforce free-tier usage limits and prevent abuse;
• Communicate with you about your account or changes to the Service; and
• Maintain the security and integrity of the Service.

Where the GDPR applies, we process your personal data on the following legal bases: performance of our contract with you (to provide the Service you signed up for), our legitimate interests (such as securing the Service and preventing abuse of free-tier limits), and, where applicable, your consent.

We share personal data with the following third-party service providers, who process data on our behalf:

• Supabase — provides authentication, database, and file storage infrastructure. Your account credentials, product data, and chat history are stored in Supabase's infrastructure.
• Anthropic — when you use the AI marketing assistant, the messages you send (along with relevant product details) are transmitted to Anthropic's API for processing, so that it can generate a response. Please review Anthropic's privacy policy to understand how they handle this data.

We do not sell your personal data to third parties, and we only share it with processors as necessary to operate the Service.

As we serve customers globally and rely on international infrastructure providers, your data may be transferred to and processed in countries outside your own, including countries outside the European Economic Area. Where this occurs, we rely on appropriate safeguards, such as Standard Contractual Clauses, to ensure your data remains protected in accordance with this Privacy Policy and applicable law.

We retain your personal data for as long as your account remains active. If you delete your account, we will delete or anonymize your personal data, product data, and AI chat history within a reasonable period, except where we are required to retain certain data to comply with legal obligations or resolve disputes.

If you are located in the European Economic Area (or another jurisdiction with similar protections), you have the right to:

• Access the personal data we hold about you;
• Request correction of inaccurate or incomplete data;
• Request erasure of your personal data ("right to be forgotten");
• Request restriction of or object to our processing;
• Request a portable copy of your data; and
• Withdraw consent at any time, where processing is based on consent.

You can exercise most of these rights directly from your account dashboard, or by contacting us at privacy@copyloom.net. You also have the right to lodge a complaint with your local data protection supervisory authority.

We use essential cookies to keep you signed in and to maintain your session securely, managed through our authentication provider, Supabase. We do not use advertising or third-party tracking cookies.

We implement technical and organizational measures — including encryption in transit, access controls, and row-level data isolation — designed to protect your personal data from unauthorized access, alteration, or disclosure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

The Service is not directed at, and should not be used by, individuals under the age of 16. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will post any changes on this page and update the "Last updated" date above.

If you have questions about this Privacy Policy or how we handle your personal data, please contact us at privacy@copyloom.net.