Privacy POLICY

Last updated 14.9.2026

We at ContentCrew Oy care about your privacy. This Privacy Policy describes how ContentCrew Oy (“we”, “our”, “us”) collects, uses, and protects personal data in accordance with the General Data Protection Regulation (GDPR).

1. Who We Are

ContentCrew Oy (Business ID: 33561106-3) is a Finnish company developing a SaaS platform for collaborative content creation. Contact: info@contentcrew.com, Address: Mikonkatu 25, 00100 Helsinki, Finland.

For the purposes of the GDPR and the Finnish Data Protection Act (1050/2018), ContentCrew Oy is the controller of the personal data described in this Privacy Policy, except where we process personal data on behalf of a Crew Lead as a processor, as described in Section 7.

This Privacy Policy applies when you visit our website, create or use an account in the ContentCrew web or mobile application, connect third-party accounts to ContentCrew, communicate with us, or otherwise interact with us in connection with our services (together, the “Service”). It applies to all users of the Service, including Crew Leads, Crew Members, guests invited to review content, website visitors, and prospective customers who contact us or book a demo.

This Privacy Policy should be read together with our Terms of Service.

The Service is not directed at children under the age of 13, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data without the required consent, please contact us and we will take appropriate steps to delete it.

2. What Data We Collect

We collect personal data directly from you, automatically when you use the Service, and from third parties, such as connected social media platforms and the Crew Lead who invites you to a Crew. We only collect the data we need to provide and improve the Service. The categories of personal data we process are:

Account Data: Name, email address, password, profile picture, organization details, and the Crews you belong to, together with your role and permissions within each Crew.
Usage Data: Information collected automatically when you use the Service, such as your IP address, browser type, operating system, device information, the features you use and actions you take, the date and time of your activity, and error and diagnostic logs.
Content Data: Text, images, videos, and drafts you upload or share within your community, as well as comments, ratings, approvals, tasks, briefs, and other information created within a Crew. Content Data may include personal data about other people, such as individuals appearing in images or videos. You are responsible for having the right to upload such content.
Connected Account Data: Data we receive from social media accounts you connect to ContentCrew. See Section 5.
Feedback & Support: Messages you send us by email or within the Service, feedback and feature requests, information you provide when booking a demo or setup call, and records of our correspondence with you.
Billing information: When a customer purchases our services, the customer’s name, billing address, VAT number where applicable, the plan purchased, invoices, and payment history. Payment card details are processed by our payment service provider, and we do not store full card numbers.

We do not sell your data to third parties.

3. Why We Process Your Data

We process personal data only for specified and legitimate purposes, and only where we have a legal basis under Article 6 of the GDPR. The purposes and their legal bases are:

Providing the Service: Creating and administering your account, enabling collaboration within Crews, storing and displaying your content, publishing and scheduling content to connected platforms, and providing the analytics and AI features you choose to use. Legal basis: performance of a contract (Article 6(1)(b)).
Customer relationships and support: Responding to your questions, providing onboarding and setup calls, and handling support requests. Legal basis: performance of a contract and our legitimate interest in serving our customers (Article 6(1)(b) and (f)).
Billing and accounting: Processing payments, issuing invoices, and keeping accounting records. Legal basis: performance of a contract and compliance with legal obligations under Finnish accounting and tax law (Article 6(1)(b) and (c)).
Service communications: Sending important information about the Service, such as security notices, changes to our terms, and service updates. Legal basis: performance of a contract and legitimate interest.
Security and fraud prevention: Protecting the Service, our users, and our systems against unauthorized access, abuse, and fraud, and enforcing our Terms of Service. Legal basis: legitimate interest (Article 6(1)(f)).
Improving the Service: Analyzing how the Service is used, diagnosing technical problems, and developing new features. Where possible, we use aggregated or pseudonymized data for this purpose. Legal basis: legitimate interest.
With your consent: Marketing emails, beta features, or AI-enhanced suggestions. Legal basis: consent (Article 6(1)(a)).
Legal compliance and claims: Complying with legal obligations, responding to lawful requests from authorities, and establishing, exercising, or defending legal claims. Legal basis: legal obligation and legitimate interest.

Where we rely on legitimate interest, we have balanced our interests against your rights and freedoms and concluded that our interests are not overridden by them. You can request more information about this assessment, and you have the right to object as described in Section 9. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal.

4. Sharing Your Data

We treat personal data as confidential and share it only to the extent necessary for the purposes described in this Privacy Policy, and only in the following cases:

Service providers: Companies that help us run ContentCrew, such as hosting, payment processing, email delivery, social media integrations (such as Zernio, see Section 5), demo scheduling, customer support, analytics, and AI features. They act on our instructions under written data processing agreements and may not use your data for their own purposes.
Other members of your Crew: Content and information you share within a Crew is visible to other members of that Crew according to their role and permissions, as set by the Crew Lead.
Social media platforms: When you publish or schedule content, we send it to the platforms you choose. See Section 5.
Connected apps you authorize: When you connect a third-party application, such as Claude, we share data with it at your direction. See Section 6.
Legal reasons: If required by law, court order, or a request from a competent authority, or where disclosure is necessary to establish, exercise, or defend legal claims or to protect the rights, property, or safety of ContentCrew, our users, or others.
Business transfers: In case of a merger, acquisition, financing, or sale of all or part of our business, personal data may be transferred to the other party under confidentiality obligations, with prior notice.

We store your data primarily within the EU/EEA. If a service provider processes data outside the EU/EEA, we make sure the transfer is protected by an EU adequacy decision (such as the EU–US Data Privacy Framework) or by Standard Contractual Clauses. You may request more information about the safeguards we use by contacting us at info@contentcrew.com.

‍

5. Connected Social Media Accounts

ContentCrew lets you connect social media accounts, including Facebook, Instagram, LinkedIn, Threads, TikTok, X, and YouTube, so you can publish content and see how it performs. You connect an account by signing in on the platform itself and approving the permissions ContentCrew asks for. We never see or store your social media passwords.

What we access

We only request the permissions needed for the features you use. Permissions vary by platform, but may include:

Basic profile information, such as your name, username, account ID, and profile picture.
The pages, channels, or business accounts you manage and choose to connect.
Permission to publish and schedule posts, videos, and other content on your behalf.
Content you have published and its metadata, such as captions, titles, descriptions, and publish times.
Performance statistics, such as reach, impressions, views, watch time, engagement, and followers.

How we use it

We use connected account data only to provide the features you request: publishing and scheduling content, showing analytics and reports, and AI features such as AI Reports and AI Scoring when you use them. We do not sell this data, use it for advertising, or share it with anyone except the service providers described in Section 4.

The access tokens that let us act on your behalf are stored encrypted, by us or by Zernio as described below, and are only used to perform the actions you request.

Connections through Zernio

Depending on the platform, ContentCrew may connect your social media accounts through Zernio, a social media integration service operated by Zernio Software SL, Carrer Mallorca 2A, 17230 Palamós, Girona, Spain. In that case, the platform’s consent screen may show Zernio as the application requesting access. When you approve the connection, Zernio holds the resulting access tokens and, on our instructions, publishes and schedules content and retrieves profile information and performance statistics from the platform.

Zernio acts as our service provider (sub-processor). It processes the data only to provide the integration to us, under a written data processing agreement and in accordance with the Zernio Privacy Policy. According to that policy, Zernio stores access tokens encrypted, does not sell personal data or use it to train machine learning models, and adheres to the Google API Services User Data Policy, including the Limited Use requirements. Zernio is established in the EU.

When you disconnect an account in ContentCrew, we instruct Zernio to remove the connection, and the access tokens and data held by Zernio for that account are deleted within the timelines described below.

Google and YouTube

ContentCrew uses YouTube API Services to connect YouTube channels. By connecting a YouTube channel, you agree to the YouTube Terms of Service, and Google’s processing of your data is governed by the Google Privacy Policy.

ContentCrew’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use data received from Google APIs to develop, improve, or train generalized AI or machine learning models.

Meta (Facebook, Instagram, and Threads)

ContentCrew connects to Facebook Pages, Instagram professional accounts, and Threads profiles through Meta’s official APIs. Depending on the features you use, we access the Pages and accounts you select, publish and schedule content on your behalf, and retrieve insights such as reach, impressions, and engagement for your content. We use this data in accordance with Meta’s Platform Terms, and Meta’s own processing of your data is governed by the Meta Privacy Policy. You can remove ContentCrew’s access in the Business Integrations settings of your Facebook account, or in the website permissions settings of Instagram and Threads.

TikTok

ContentCrew connects to TikTok through TikTok’s official developer APIs. With your permission, we access your basic profile information, upload and publish videos to your account, and retrieve information about videos you have published, such as views, likes, comments, and shares. TikTok’s own processing of your data is governed by the TikTok Privacy Policy. You can remove ContentCrew’s access in the security and permissions settings of the TikTok app.

ContentCrew connects to LinkedIn member profiles and the LinkedIn Pages you administer through LinkedIn’s official APIs. With your permission, we access your basic profile information, publish posts on your behalf, and, where LinkedIn makes them available, retrieve statistics about your posts. LinkedIn’s own processing of your data is governed by the LinkedIn Privacy Policy. You can remove ContentCrew’s access in your LinkedIn settings under Data privacy → Permitted services.

Disconnecting an account and deleting its data

You can remove ContentCrew’s access to a connected account at any time:

In ContentCrew: Disconnect the account in your settings. We stop accessing the account and delete its access tokens immediately, and we delete the data we received from that account within 7 days.
On the platform: Revoke ContentCrew’s access in the platform’s own settings. For Google and YouTube, use the Google security settings page. We delete the data we received from that account within 30 days.
By request: Follow the steps on our data deletion request page, or email info@contentcrew.com.

Content you have already published stays on the social media platform. To remove it, delete it on the platform itself.

‍

6. Connected AI Assistants (Claude)

You can connect ContentCrew to Claude, an AI assistant made by Anthropic, as a “connected app”. You start the connection from Claude and confirm it on a ContentCrew page that shows the app’s name and where it will return you.

What Claude can access: Claude signs in as you, with the same access you have, only in workspaces where you are an Admin, Manager or Contributor (never as a Guest). When you ask it to, Claude can read ideas, comments, tasks, goals, reports, brand guidelines and social and ad performance, and create or edit ideas, comments and tasks. It cannot publish, delete or approve content, and it cannot read social comments, direct messages or ad leads. Whatever Claude creates is saved under your name and labelled “via Claude”.
What goes to Anthropic: Information Claude reads from ContentCrew to answer you is sent to Anthropic as part of your conversation. It is handled under your own agreement with Anthropic and Anthropic’s privacy policy, not this Privacy Policy.
What we record: For each action Claude takes, we record the user, the connected app, the workspace, which tool was used, whether it succeeded, how long it took and the size of the response. We never record what you asked Claude, the content Claude sent us, or what we sent back. We use these records to keep the service reliable, to enforce usage limits and to understand which features are used. They are deleted automatically after 90 days, and only ContentCrew staff can access them.
Feedback sent through Claude: If you ask Claude to send feedback or a feature request, we receive exactly that message, together with the connected app’s name and the workspace and role it concerns. It is handled like feedback you send from the app: it goes into our issue tracker (Linear), linked to your account, and you can follow it under Settings → My reports. Claude sends feedback only when you ask it to.
Disconnecting: You can disconnect Claude at any time in ContentCrew under Settings → MCP. Its access ends immediately.

‍

7. Agency and Client Data

ContentCrew is used by businesses and agencies (“Crew Leads”) to manage content with their own team, clients, and creators. Our role depends on whose data it is:

We are the controller for your account data, billing data, usage data, and the data we use for security and our own customer communication.
We are the processor for the personal data a Crew Lead and its members add to a Crew or bring in through connected client accounts, such as client contact details, content, comments, approvals, and analytics. In this case the Crew Lead is the controller and decides how the data is used.

Our commitments as a processor

When we process data on behalf of a Crew Lead, we:

Process the data only to provide the service and on the Crew Lead’s documented instructions.
Make sure everyone who handles the data is bound by confidentiality.
Protect the data with the security measures described in Section 11.
Use other service providers (sub-processors) only under written contracts with the same data protection obligations, and remain responsible for them.
Help the Crew Lead respond to requests from individuals and with data protection impact assessments where needed.
Notify the Crew Lead without undue delay, and no later than 72 hours after becoming aware of it, if a personal data breach affects their data.
Delete or return the data when the service ends, unless the law requires us to keep it.
Provide the information needed to show we meet these obligations and allow reasonable audits.

The Crew Lead’s responsibilities

The Crew Lead is responsible for having a legal basis to process the data they add, informing their clients and creators about it, and having permission to connect any client social media accounts. If we receive a request from someone whose data a Crew Lead controls, we pass it on to the Crew Lead.

A signed Data Processing Agreement is available on request at info@contentcrew.com.

‍

8. How Long We Keep Data

We retain personal data only for as long as necessary for the following purposes or as required by law.

Account data: As long as your account is active.
Content data: Until you delete it or your account is closed.
Connected account data: Until you disconnect the account. See Section 5.
Analytics & logs: Typically 12–24 months.
Billing and accounting records: As required by Finnish accounting law, up to 10 years.

You can request deletion at any time by sending us an email to info@contentcrew.com and we'll delete your data within 30 days, except data we must keep by law.

‍

9. Your Rights

Under the GDPR, you have the following rights regarding your personal data. Some of these rights apply only in certain circumstances and may be limited by applicable law.

Right of access: You may obtain confirmation of whether we process your personal data and, if so, receive a copy of it together with information about how it is processed.
Right to rectification: You may have inaccurate personal data corrected and incomplete data completed. You can update most Account Data yourself in your account settings.
Right to erasure (“right to be forgotten”): You may have your personal data deleted, for example when it is no longer necessary for the purposes for which it was collected. This right does not apply where we must keep the data to comply with a legal obligation or to establish, exercise, or defend legal claims.
Right to restriction of processing: You may ask us to restrict the processing of your personal data, for example while we verify the accuracy of data you have contested.
Right to object: You may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest. You may always object to direct marketing, in which case we will stop using your data for that purpose.
Right to data portability: You may receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and have it transmitted to another controller where technically feasible.
Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time.

To exercise your rights send us an email to info@contentcrew.com. To protect your data, we may ask you to verify your identity before responding, for example by sending the request from the email address associated with your account. We will respond without undue delay and in any event within one month of receiving your request. Where necessary, taking into account the complexity and number of requests, this period may be extended by two further months, in which case we will inform you of the extension and the reasons for it.

If your personal data is processed within a Crew for which we act as a processor (see Section 7), we will forward your request to the relevant Crew Lead and assist them in responding to it.

You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman, or with the supervisory authority of the EU/EEA member state where you live or work, or where you believe an infringement has taken place.

‍

10. Cookies & Tracking

Cookies are small text files stored on your device when you visit a website. We also use similar technologies, such as local storage and pixels, which are referred to together as “cookies” in this section. We use the following categories of cookies:

Strictly necessary cookies: Required for the Service to function, for example to keep you logged in, remember your cookie choices, and protect the Service against abuse. These cookies do not require your consent.
Preference cookies: Remember your settings and preferences, so you do not have to set them again each time you visit.
Analytics cookies: Help us understand how visitors use our website and the Service, so we can analyze usage and improve the Service. On our website, we use Google Analytics for this purpose.
Marketing cookies: Used on our website to measure the effectiveness of our advertising and to show relevant ads on other platforms, for example through the Meta pixel.

On our website, we use Cookiebot to manage your consent. Analytics and marketing cookies are only set after you accept them in our cookie banner. You can change or withdraw your choice at any time from the cookie settings, which also describe the individual cookies we use, their purpose, and their duration.

Some cookies are set by third parties, such as Google and Meta, who process the information collected in accordance with their own privacy policies and may transfer it outside the EU/EEA, as described in Section 4. You can also block or delete cookies in your browser settings, but blocking strictly necessary cookies may prevent parts of the Service from working.

‍

11. Data Security

We take the security of personal data seriously. In accordance with Article 32 of the GDPR, and taking into account the state of the art, the costs of implementation, the nature, scope, context, and purposes of processing, and the risks to individuals, we implement technical and organizational measures to ensure a level of security appropriate to the risk. These include:

Encryption: Data is encrypted in transit (TLS) and at rest. Social media access tokens are stored encrypted.
Passwords: Account passwords are stored as secure hashes and are never stored in plain text.
Access control: Role-based permissions decide what each user can see inside a Crew. Our staff can access personal data only when their work requires it, and access to our systems is protected with strong authentication.
Secure hosting: Our service runs on established cloud infrastructure providers with their own security certifications.
Backups and recovery: We take regular backups so data can be restored after an incident.
Monitoring and maintenance: We log and monitor our systems for suspicious activity and keep software and dependencies up to date with security fixes.
Confidentiality: Everyone who works with personal data at ContentCrew is bound by confidentiality obligations.
Service provider review: We assess the security practices of our service providers before engaging them and require them by contract to protect personal data with appropriate measures.

If, despite these measures, a personal data breach occurs, we act promptly to contain it, assess its likely consequences, and take steps to mitigate any adverse effects. Where a breach is likely to result in a risk to the rights and freedoms of individuals, we notify the Finnish Data Protection Ombudsman without undue delay and, where feasible, within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk, we also inform affected users without undue delay, describing the nature of the breach, its likely consequences, and the measures taken. Crew Leads are notified as described in Section 7.

How you can help

Use a strong, unique password, keep your login details private, and tell us right away at info@contentcrew.com if you notice any suspicious activity on your account. No system is completely secure, but we work continuously to keep your data safe.

‍

12. Changes

We may update this notice. The date at the top shows when it was last updated.

‍