1. Who we are
Collabre is a content operations platform that helps teams plan, write, approve, publish and measure content. The controller of the personal data described here is {{LEGAL_ENTITY}}, registered at {{REGISTERED_ADDRESS}}.
This policy covers the marketing site, the Collabre application and the email we send you. Write to [email protected] with any question about it, or to ask us to act on one of the rights below.
2. Information we collect
- Account information. Your name, your email address, a hash of your password, your workspace name, your billing contact and a profile picture if you upload one.
- Authentication identifiers. Access tokens and refresh tokens for the platforms and tools you connect, and the account identifiers those services return. Tokens are encrypted before they reach the database.
- Content you create or upload. Campaigns, briefs, posts, drafts, media assets and the reports built from them.
- Usage and device data. Pages viewed, features used, IP address, browser string, timestamps and the approximate location derived from your IP address.
- Billing information. Billing contact, tax identifier, plan, invoices and the payment method token that Stripe issues. Card numbers never reach our systems.
- Messages you send us. Anything you write to us by email or through a form on the site. The contact, demo and newsletter forms send what you type, the page you sent it from, the time and your IP address to our team by email, so we can reply, arrange your demo or send the product news you asked for.
3. How we use your information
- To run the product and the site, and to keep both working.
- To sign you in, protect your account and investigate abuse or fraud.
- To publish, schedule and analyze content on the services you connect, at your direction.
- To take payment, manage your subscription and send billing notices.
- To send transactional email such as sign-in links, security notices and invoices, and product news when you have asked for it.
- To meet our legal obligations and to enforce the Terms of Service.
4. Legal bases for people in the EEA, the UK and Switzerland
We rely on four legal bases. Performance of a contract covers running the service you signed up for. Legitimate interests cover security, fraud prevention and understanding how the product is used. A legal obligation covers tax, accounting and lawful requests from authorities. Legitimate interests also cover the analytics and session recording on this marketing site, described in section 6. Consent covers optional product news, and you can withdraw it at any time.
5. Third-party processors
We use a small set of vendors to host the product, store files, take payments, send email and run AI models. Each one, what it is used for and the data it receives, is listed on the subprocessors page, with the date the list was last reviewed. What we commit to as a processor, and how we tell you about a change to that list, is set out in the data processing agreement.
You also choose the platforms and tools your workspace connects. Data reaches those services at your direction, and their own terms govern what they do with it.
6. Cookies and similar technologies
This marketing site runs two analytics tools for every visitor. Google Analytics 4 sets cookies that count visits and show which pages people use. Inspectlet records how visitors move through the site, including mouse movement, clicks, scrolling and the pages they open, so we can see where the site is hard to use. Both vendors are named on the subprocessors page. You can block or delete these cookies in your browser settings, and Google offers a browser add-on that opts you out of Google Analytics on every site. The site carries no advertising tags.
The Collabre application sets first-party cookies that sign you in, protect the session and remember the workspace you last opened. Those cookies are required to use the product. The application also records product usage through PostHog, which is named on the subprocessors page.
7. Data retention
We keep personal data for as long as we need it for the purposes in this policy.
- Workspace content stays while your workspace is active. When you delete a workspace, its content and personal data are deleted from production systems within 30 days and from encrypted backups within 90 days.
- Billing and tax records are retained for 7 years to comply with accounting law.
- Some records expire on a schedule set in the product. Agent memory entries and tool call analytics expire after 30 days, and Agent memory snapshots expire after 7 days.
- Data we have aggregated, and can no longer link to you, may be kept without a time limit.
8. Your rights under the GDPR
If you are in the European Economic Area, the United Kingdom or Switzerland you can ask us for a copy of your personal data, correct it, have it deleted, restrict what we do with it, object to processing we base on legitimate interests, and receive it in a portable format. You can also complain to your supervisory authority.
To exercise a right, write to [email protected]. We respond within 30 days.
9. Your rights under the CCPA and the CPRA
If you live in California you can ask what categories of personal data we collect, ask us to delete personal data, ask us to correct it, opt out of the sale or sharing of personal information, and you cannot be treated differently for asking. Collabre does not sell personal information and does not share it for cross-context behavioral advertising. To exercise a right, write to [email protected].
10. Children
Collabre is not directed to children under 16, and we do not knowingly collect personal data from anyone under that age. Tell us at [email protected] if you believe we have, and we will delete it.
11. Security
Platform access tokens, integration credentials and two-factor secrets are encrypted with AES-256-GCM before they are written to the database. Each record carries its own salt and initialization vector, and the key is derived from an environment variable that every deployed environment has to set. The API refuses to start in a deployed environment when that variable is missing.
Passwords are stored as bcrypt hashes. A magic link is stored only as a hash, works once and expires. The API sets the standard security headers, including strict transport security. Roles decide who can open and change what, and changes are written to an audit log whose detail is redacted before it is stored. We scan our dependencies regularly. The security page lists each control and how the product enforces it. No system is perfectly secure, so use a strong, unique password and turn on two-factor authentication.
12. International transfers
Your data may be processed in the countries where we and our subprocessors operate. The subprocessors page names each vendor and the region it processes in. Where the law requires it, we rely on the Standard Contractual Clauses approved by the European Commission and on the equivalent United Kingdom transfer mechanism.
13. Changes to this policy
We update this policy when the product or the law changes. The version and the date at the foot of this page describe the copy you are reading. When we make a material change, we will tell you by email or by a notice in the product at least 30 days before it takes effect.
14. Contact
- {{LEGAL_ENTITY}}
- {{REGISTERED_ADDRESS}}
- Privacy requests: [email protected]
- Anything else: [email protected]