Privacy Policy

1. Who we are

This Privacy Policy explains how Content Metric ("Content Metric", "we", "us") collects, uses, discloses, and protects personal data when you use the ContentMetric platform and websites (the "Service"). We handle personal data in accordance with the Singapore Personal Data Protection Act (PDPA) and, where applicable, the EU General Data Protection Regulation (GDPR).

For personal data contained in content that you store on the Service ("Customer Content"), you are the data controller and we act as a data processor on your behalf. For account and billing data, we act as the controller.

2. Data we collect

We collect the following categories of data:

• Account data: name, email address, organization details, and authentication identifiers.
• Billing data: plan, subscription status, and payment references processed by our payment provider (we do not store full card numbers).
• Customer Content: the content, media, and data you upload or create in your projects.
• Usage and metrics data: project activity, feature usage, and resource consumption used for metering and product improvement.
• Technical data: IP address, device and browser information, and server logs collected for security and reliability.
• Cookies and similar technologies used to keep you signed in and to operate the Service, and on our marketing website to measure visits and our advertising (see section 10).

3. How we use data

We use personal data to:

• Provide, operate, secure, and improve the Service.
• Authenticate users and manage accounts and permissions.
• Process subscriptions, meter usage, and handle billing.
• Communicate with you about your account, security, and service updates.
• Understand how visitors find and use our website, and measure how well our advertising works.
• Detect, prevent, and respond to fraud, abuse, and security incidents.
• Comply with legal obligations.

4. Legal bases

Where the GDPR applies, we process personal data on the bases of performance of a contract, our legitimate interests in operating and securing the Service, your consent (where required), and compliance with legal obligations. Where the PDPA applies, we collect, use, and disclose personal data with consent or as otherwise permitted by law.

5. Service providers and sub-processors

We share personal data with trusted service providers who help us operate the Service, under agreements that require them to protect it. These include our authentication provider, payment processor, cloud and network infrastructure providers, content delivery and security providers, and our website analytics and advertising providers (Google Analytics and Meta).

We do not sell personal data.

6. International transfers

Our infrastructure and providers may process data in locations outside your country. Where we transfer personal data across borders, we take steps to ensure a comparable standard of protection consistent with the PDPA and, where applicable, use appropriate safeguards under the GDPR.

7. Data retention

We retain personal data for as long as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. When data is no longer needed, we delete or anonymize it. Customer Content is retained according to your project settings and our standard deletion practices after account termination.

8. Security

We use tenant isolation, encryption, access controls, and audit logging to protect data. No system is perfectly secure, but we work to safeguard personal data using measures appropriate to the risk. You can read more on our Trust page.

9. Your rights

Subject to applicable law, you may request access to, correction of, or deletion of your personal data, and you may withdraw consent or object to certain processing. Where the GDPR applies, you may also request data portability and lodge a complaint with your supervisory authority.

To exercise your rights, contact us using the details below. We may need to verify your identity before acting on a request.

10. Cookies

We use cookies that are necessary to sign you in and operate the Service, and limited cookies to remember preferences.

On our marketing website we also use Google Analytics, to understand how visitors use the site, and the Meta pixel, to measure our advertising on Facebook and Instagram. They set their own cookies and receive details such as the pages you visit, your device and browser, and your IP address. When you create an account, they are told that a sign-up happened, without your name or email address. We do not use them for visitors in the European Economic Area, the United Kingdom or Switzerland.

You can control cookies through your browser settings, though disabling necessary cookies may affect functionality. Google offers an opt-out add-on at tools.google.com/dlpage/gaoptout, and you can manage your ad settings in your Facebook or Instagram account.

11. Children

The Service is not directed to children and is not intended for use by anyone under the age at which they can provide valid consent in their jurisdiction. We do not knowingly collect personal data from children.

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify you. The effective date at the top reflects the latest version.

13. Contact

For privacy questions or to exercise your rights, contact us at [email protected].