Privacy Policy

Last updated: July 7, 2026

Silma ("we", "us", "our") is operated by Joonas Soininen, based in the United States. This policy describes how we collect, use, and protect your personal data when you use contentsnipe.com and related services. It applies to all users regardless of location. We are committed to complying with applicable privacy laws including the EU General Data Protection Regulation (GDPR) for users in the EU/EEA.

1. Information We Collect

Account information: Email address, name, and profile image when you sign up via Google OAuth or email/password.

Content you submit: Instagram Reel and TikTok URLs you submit, video frames extracted from videos you upload for Pre-Check analysis, AI-generated analysis results, and content suggestions. Pre-Check normally extracts these frames in your browser and uploads only the frames. If your browser cannot decode a video's format (for example, HEVC/H.265 from some phones), we upload the full video so our servers can extract the frames, then delete that video immediately after processing.

Brand profile: Niche, target audience, content pillars, tone, differentiator, and any brand document (PDF or text) you upload voluntarily.

Chat messages: Conversations with our AI assistant (Silma) are stored to provide context across sessions.

Watchlist data: Competitor account handles you add to your watchlist and the associated content analysis results.

Connected Instagram account (optional): If you connect your Instagram professional account, we access, through Meta's Instagram Graph API, your profile, your list of posts, and per-post insights (reach, views, saves, shares, watch time, and total interactions). We store these insights to compute which of your content techniques perform best ("what works for you"). We never receive your Instagram password; access is granted by an Instagram authorization token that you can revoke at any time by disconnecting in the app.

Content history: Ideas you save, mark as posted, and outcome ratings you log.

Payment information: Processed securely by Stripe. We never store your card details.

Device identifier: A non-persistent device identifier generated in your browser to prevent multi-account abuse on the free tier. This identifier is not shared with third parties.

Usage data: Feature usage counts, submission timestamps, and error logs for service reliability.

2. Legal Basis for Processing (GDPR)

We process your personal data under the following legal bases:

• Performance of contract: Account creation, delivering analysis results, powering the AI assistant, processing brand profile data, and managing your subscription.
• Legitimate interest: Sending lifecycle and onboarding emails, measuring product usage via analytics, and enforcing fair use limits and abuse prevention. These interests are balanced against your rights and do not override them.
• Legal obligation: Retaining records required by applicable law (e.g. billing records).

Where we rely on legitimate interest, you have the right to object. See Section 7 for how to exercise your rights.

3. How We Use Your Information

• To provide and improve the Silma service
• To analyze content you submit using AI and return results to you
• To generate personalized content suggestions based on your brand profile
• To power the Silma AI assistant and maintain conversation context
• To process payments and manage your subscription
• To send transactional and lifecycle emails (onboarding, usage milestones). You can unsubscribe at any time via the link in any email.
• To measure product usage via anonymized analytics
• To enforce fair use limits and prevent abuse

We do not use your data to train AI models. Your content is sent to our AI provider solely to generate results for you.

4. Third-Party Service Providers

We share data with the following categories of service providers only as necessary to operate the Service. All providers are contractually required to protect your data and process it only for the purposes we specify.

• AI processing (Anthropic): Content you submit and video frames are sent to Anthropic's Claude API to generate analysis and chat responses. Anthropic processes this data under their own privacy policy and API terms.
• Payment processing (Stripe): Handles all billing and subscription management. We share only what is necessary for payment processing.
• Public content data provider: Reel URLs are sent to a third-party service to retrieve publicly available metadata from social platforms.
• Meta / Instagram: If you connect your Instagram account, we access your profile and post insights through Meta's Instagram Graph API under Meta's Platform Terms. Meta processes the API request under its own privacy policy; we store the returned insights to power your "what works for you" analysis.
• Authentication provider: Manages sign-in, sign-up, and session tokens on our behalf.
• Cloud infrastructure and storage provider: Hosts the application and stores files (videos, thumbnails, uploaded frames) on encrypted cloud storage.
• Database hosting provider: Hosts our database in a secure, encrypted environment.
• Email delivery provider: Delivers transactional and lifecycle emails on our behalf.
• Product analytics provider: Receives anonymized usage events to help us understand how the product is used. No personally identifiable content is included in these events.

We do not sell your data to third parties.

5. International Data Transfers

We are based in the United States. If you are located in the EU/EEA or another jurisdiction with data transfer restrictions, your personal data will be transferred to and processed in the United States and potentially other countries. For EU/EEA users, we rely on appropriate transfer mechanisms such as the European Commission's Standard Contractual Clauses (SCCs) where required. By using the Service you acknowledge that your data may be processed in countries outside your own, including countries that may not provide the same level of data protection as your home country.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service:

• Video frames (Pre-Check uploads): Deleted automatically within 48 hours of upload. When a full video is uploaded for server-side processing (because your browser could not decode its format), that video file is deleted immediately after frames are extracted.
• Analysis results, chat history, brand profile: Retained for the duration of your account.
• Reel videos and thumbnails: Retained for the duration of your account. You can delete individual reels at any time from your dashboard.
• Instagram insights and access token: Retained while your Instagram account stays connected. Disconnecting it in the app immediately deletes the stored insights and the access token. You can also request deletion through Meta, which we honor via Meta's data deletion callback.
• Billing records: Retained for up to 7 years as required by Finnish accounting law.
• Account deletion: Upon request, all personal data is deleted within 30 days, except where retention is required by law.

7. Your Rights (GDPR)

If you are in the EU/EEA, you have the following rights regarding your personal data. To exercise any of these rights, contact us at support@contentsnipe.com. We will respond within 30 days.

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your account and all associated personal data.
• Right to data portability: Request your data in a structured, machine-readable format.
• Right to restrict processing: Request that we pause processing of your data in certain circumstances.
• Right to object: Object to processing based on legitimate interest, including direct marketing.
• Right to unsubscribe: Opt out of lifecycle emails at any time via the unsubscribe link in any email we send.

You also have the right to lodge a complaint with the data protection authority in your country of residence. EU/EEA residents can find their national authority at edpb.europa.eu.

8. Data Security

We use industry-standard security measures including encrypted connections (HTTPS/TLS), hashed API keys, signed access tokens, and encrypted session management. Stored data is encrypted at rest by our infrastructure providers. Access to personal data is restricted to systems and processes that require it to provide the Service.

9. Data Breaches

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours as required by GDPR Article 33, and notify affected users without undue delay where required by Article 34.

10. Cookies

We use essential cookies only — specifically an httpOnly session cookie for authentication. We do not use tracking or advertising cookies.

11. Children

The Service is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email. Continued use of the Service after changes constitutes acceptance.

13. Contact

For privacy-related inquiries or to exercise your rights: support@contentsnipe.com