GDPR policy
Last updated: October 1, 2026
This policy explains how EasyContent LLC ("EasyContent," "we," "us") handles personal data under the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, and the Swiss Federal Act on Data Protection. It applies to people in the European Economic Area, the United Kingdom, and Switzerland who visit easycontent.io or use the EasyContent service. It sits alongside our Privacy Policy, which covers everyone.
Who we are, and our two roles
EasyContent LLC is a limited liability company registered in Florida, United States, at 11505 Fountainhead Dr, Tampa, Florida 33626. You can reach us about anything in this policy at support@easycontent.io.
We handle personal data in two different roles, and the difference matters for who you should contact.
We are the controller for personal data we collect to run our own business: information about visitors to our website, people who contact us or book a demo, account holders and Users (their names, email addresses, and login details), billing contacts, and data about how the service is used.
We are a processor for personal data that our customers put into the service as part of their content, such as names in a draft, comments, or uploaded files. Our customer decides what goes in and why, and our Data Processing Agreement (DPA) with that customer governs how we handle it. If your personal data appears in content that an EasyContent customer manages, please contact that customer first. We will help them respond to your request.
The rest of this policy describes our processing as a controller.
What personal data we collect
- Account and profile data: name, email address, password (stored only as a hash), role, and account settings.
- Billing data: billing contact name, email, company details, and transaction records. Card details go directly to Stripe and never reach our servers.
- Communications: messages you send us through our contact form, email, or support, and the details you give when booking a demo.
- Business contact information: the name, job title, employer, and business email of people at organizations we think may benefit from EasyContent, collected from public sources such as company websites and professional profiles.
- Usage and device data: IP address, browser and device type, pages and features used, and error diagnostics, collected through our servers and through analytics and error-monitoring tools.
- Cookies: see "Cookies" below.
We need your account and billing data to provide the service, and we cannot open or run an account without it. Everything else you give us is optional.
Why we process it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Creating and running your account and providing the service | Performance of our contract with you (Art. 6(1)(b)) |
| Billing and payment | Performance of our contract (Art. 6(1)(b)) and our legal obligations (Art. 6(1)(c)) |
| Service emails, such as notifications, security alerts, and billing notices | Performance of our contract (Art. 6(1)(b)) |
| Answering your questions, providing support, and running demos | Our legitimate interest in responding to people who contact us (Art. 6(1)(f)) |
| Contacting business professionals about EasyContent | Our legitimate interest in promoting our service to organizations it is relevant to, with an opt-out in every message (Art. 6(1)(f)) |
| Keeping the service secure, preventing abuse, and fixing errors | Our legitimate interest in running a secure and reliable service (Art. 6(1)(f)) |
| Understanding how the website and service are used so we can improve them, and crediting affiliate referrals | Our legitimate interest in improving our product and running our affiliate program (Art. 6(1)(f)) |
| Sending product news and marketing emails | Your consent, or our legitimate interest in telling existing customers about similar services, with an opt-out in every email (Art. 6(1)(a) or (f)) |
| Complying with law and enforcing our terms | Our legal obligations (Art. 6(1)(c)) and our legitimate interest in protecting our rights (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time. Where we rely on consent, you can withdraw it at any time without affecting processing that happened before.
We do not sell personal data, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
Who we share it with
We share personal data only with service providers who process it on our behalf under contract, at your direction (for example when you connect an integration such as WordPress, Figma, or Zapier), in a business transaction as described below, when the law requires it, or to protect our rights. Our current service providers are:
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services, Inc. | Hosting, database, file storage, backups, transactional email (Amazon SES) | United States |
| Stripe, Inc. | Payment processing | United States |
| Anthropic, PBC | AI model processing and web search for EasyAI | United States |
| LangChain, Inc. (LangSmith) | Monitoring of AI requests | United States |
| Functional Software, Inc. (Sentry) | Application error monitoring | United States |
| Google LLC | Business email and demo video calls (Google Workspace, including Gmail and Google Meet), and usage analytics (Google Analytics) | United States |
| Calendly LLC | Demo scheduling | United States |
| Rewardful Inc. | Affiliate referral tracking | Canada |
If EasyContent is involved in a merger, acquisition, or sale of assets, personal data may be transferred to the acquiring party, which will remain bound by the commitments in this policy for the data it receives.
International transfers
EasyContent is based in the United States. Personal data we collect directly from you as a controller, such as your account details, is processed in the United States, where we and most of our service providers operate (see the table above for each provider's location), and is protected by the security measures described on our Security and backups page. Where we engage service providers to process that data, we require contractual data protection commitments from them.
Personal data in customer content that we process as a processor is transferred under our Data Processing Agreement, which incorporates the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and the corresponding Swiss adaptations. You can request a copy of these safeguards by writing to support@easycontent.io.
How long we keep it
| While an account is active | Retention |
|---|---|
| Content items, projects, Users, templates, files, workflow and calendar data, roles and permissions, comments, messages, approvals, integrations, and API keys | Kept for as long as the subscription is active, unless deleted sooner by the customer |
| Revision history | The 30 most recent versions of each content item, or the 5 most recent once the item reaches the Completed workflow stage |
| Project activity logs | Deleted after 1 year |
| Copies of email notifications | Deleted 7 days after sending |
| After a trial or subscription ends | Retention |
|---|---|
| Trial not converted to a paid plan | Kept for 1 year after the 14-day trial ends, then the account and all its data are permanently deleted |
| Paid subscription ended or cancelled | Kept for 1 year after the last billing period, then the account and all its content, Users, projects, templates, and files are permanently deleted |
| Revision history | From 2 months after the trial or subscription ends, only the latest version of each item is kept |
Billing and transaction records are kept for as long as tax and accounting law requires. Business contact information collected for outreach is deleted when you ask us to stop contacting you, except for the minimum needed to keep you on our do-not-contact list, or 2 years after our last contact with you, whichever comes first. Google Analytics data is retained for no longer than 14 months. Error diagnostics in Sentry and our server logs are kept for no longer than 90 days, and records of AI requests in LangSmith for no longer than 14 days. Communications with us are kept for as long as needed to handle your request and any follow-up, and no longer than the account data they relate to.
You can delete your account at any time with the Delete account button in Account Settings. This permanently deletes the account and all of its data from the EasyContent service immediately, and cannot be undone, so export anything you want to keep first. Copies in our encrypted disaster-recovery backups are removed as those backups are overwritten, billing records are kept as tax and accounting law requires, and logs and diagnostic data held by us and our service providers expire on our and their retention periods, including those set out above. You can also ask us to delete your data by emailing support@easycontent.io, and we will complete the request within 30 days.
Your rights
You have the right to:
- access the personal data we hold about you and get a copy of it;
- rectify inaccurate or incomplete data;
- erase your data;
- restrict how we process it;
- receive your data in a portable, machine-readable format;
- object to processing based on our legitimate interests, and to direct marketing at any time; and
- withdraw consent at any time where processing is based on consent.
To exercise any of these rights, email support@easycontent.io. We will respond within one month, and may extend that by two further months for complex requests, in which case we will tell you why. Emailed requests to delete an account are always completed within 30 days. We may need to verify your identity before acting on a request.
You also have the right to lodge a complaint with a data protection authority, in particular in the country where you live or work or where you believe an infringement occurred. In the UK, that is the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to address your concern first, so please contact us.
Cookies
We use cookies and similar technologies that are strictly necessary to run the website and service, such as keeping you signed in. We also use Google Analytics cookies to understand how the website and service are used, and a Rewardful cookie that lasts 180 days to credit referrals to members of our affiliate program. You can block or delete cookies at any time in your browser settings, and you can opt out of Google Analytics across all websites with Google's opt-out browser add-on (tools.google.com/dlpage/gaoptout). Blocking analytics or affiliate cookies does not affect your use of the service; blocking strictly necessary cookies will prevent you from signing in.
Security
We protect personal data with technical and organizational measures including encryption in transit and at rest, access controls, hashed passwords, and daily encrypted backups. The details are on our Security and backups page. If a personal data breach occurs that is likely to put your rights at risk, we will notify the competent supervisory authority within 72 hours of becoming aware of it where the law requires, and we will notify you without undue delay where the breach is likely to result in a high risk to you.
Children
The service is intended for business use and is not directed at children under 16. We do not knowingly collect personal data from children.
Changes to this policy
We may update this policy. If we make material changes, we will notify account holders by email or in the service before the changes take effect, and we will always show the date of the latest version at the top of this page.
Contact
EasyContent LLC
11505 Fountainhead Dr, Tampa, Florida 33626, United States
support@easycontent.io