1. Who we are
My Content Lab (the “Service”, “we”, “us”) is operated by AMW Media LTD, a company registered in England & Wales (company number 15747911), whose registered office is at 4 Newmans Row, Lincoln Road, Cressex Business Park, High Wycombe, HP12 3RE, United Kingdom. We act as the data controller for personal data processed through mycontentlab.ai, the My Content Lab web app and the MYCONTENTLAB mobile apps for iOS and Android.
For any privacy or data-protection enquiries: legal@mycontentlab.co.uk.
2. What data we collect
- Account data — name, email address, hashed password, organisation name, role and preferences.
- OAuth tokens & scopes — when you connect a marketing platform (Meta / Facebook / Instagram, Google / Google Analytics 4 / Google Search Console / Google Ads / Google Business Profile / YouTube, LinkedIn organic and Ads, Pinterest, TikTok organic and Ads, Threads), we store the access and refresh tokens and the scopes you granted, encrypted at rest.
- Marketing analytics — aggregated metrics returned by those APIs (impressions, reach, clicks, posts, video views, ads spend, conversions, etc.). We do not collect message content, direct messages, or personally identifiable information about your followers.
- Sign-in data — if you use Sign in with Apple or Google, we receive your name, email address and an account identifier from that provider. If you choose Apple’s Hide My Email, we receive a private relay address instead of your real email.
- Billing data — website subscriptions are handled by Stripe: we store your subscription tier and Stripe customer ID. In-app subscriptions are handled by Apple or Google: we receive the product, transaction or purchase-token identifiers, subscription status and billing period so we can verify the purchase and unlock access. We never see or store full card numbers.
- Usage & cookies — page views, feature usage and device data via Google Tag Manager (GTM) for product analytics on the website and web app. See section 15 (Cookies).
- Mobile app data — see section 7 for what the iOS and Android apps collect, what stays on your device and the permissions they ask for.
3. How we use your data
We use the data above strictly to:
- Provide the reporting dashboards, AI insights and PDF reports you request;
- Sync platform data on the schedule you configure;
- Authenticate you, secure your account and prevent abuse;
- Process subscriptions, verify App Store and Google Play purchases, and send transactional service emails;
- Send the push notifications you choose to receive;
- Respond to support, legal and billing enquiries.
We do not sell your data, use it to train machine-learning models, or use it for advertising.
4. Google API Services: Limited Use disclosure
My Content Lab’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, data obtained from Google APIs (Google Analytics, Search Console, Google Ads, Google Business Profile, YouTube) is:
- Used only to provide and improve user-facing features inside the My Content Lab dashboard and exported reports;
- Not transferred to third parties except as necessary to provide those features, comply with applicable law, or as part of a merger / acquisition with appropriate notice;
- Not used to serve advertisements;
- Not used to train generalised or third-party AI / ML models;
- Not read by humans, except (a) with your explicit consent, (b) where necessary for security, (c) to comply with applicable law, or (d) where the data has been aggregated and anonymised for internal operations.
5. Meta Platform Terms compliance (Facebook, Instagram, Threads)
Where we process Platform Data received from Meta (via the Facebook Graph, Instagram Graph, Marketing API, or Threads API), we comply with the Meta Platform Terms and Developer Policies. We:
- Use Platform Data only to provide the requested reporting features to the user who connected the account;
- Do not sell, license or sublicense Platform Data;
- Do not merge Platform Data across users for ad targeting or model training;
- Delete Platform Data within 30 days when you disconnect the platform, delete your account, or when Meta instructs us to do so;
- Maintain administrative, physical and technical safeguards to protect Platform Data.
6. LinkedIn, Pinterest and TikTok data
For data accessed through the LinkedIn Marketing Developer Platform, Pinterest API v5 and TikTok Login Kit / Business API, we:
- Process only the page-level / account-level analytics required to render your reports;
- Honour the platform’s retention and deletion requirements, deleting tokens and cached data within 30 days of disconnection;
- Never share this data with third parties for advertising or resale.
7. Mobile apps (iOS and Android)
The MYCONTENTLAB apps use the same account and the same Supabase backend as the web app, so the rest of this policy applies to them too. This section explains what is specific to the apps.
What the apps collect and why
- Account and workspace data — your name, email address, user ID, organisation and role, plus the workspace content and connected-platform data you work with, stored with our Supabase backend.
- Data assistant (optional) — when you ask the assistant a question, we send the question, a short part of the previous conversation and the client and month you selected to our backend and our AI processing provider to answer it. The conversation history is stored on your device, encrypted.
- Photos and videos you choose — uploaded only when you choose to, for client logos and Creative Analysis. Recorded videos include their audio. They are stored in Supabase Storage and processed by our analysis providers.
- CSV imports — the file is read on your device; only the rows you map are uploaded, and the temporary copy on the device is deleted after reading.
- In-app purchases — Apple or Google processes the payment. We receive the product, transaction or purchase-token identifiers, status and billing period to verify the subscription and unlock access.
- Push notifications (optional) — if you turn them on, we store your device’s push token, an installation ID and the platform (iOS or Android). Notifications are delivered through Expo’s push service and Apple Push Notification service or Firebase Cloud Messaging.
What stays on your device
- Personal task reminders are scheduled on your device only.
- Saved drafts and assistant history are encrypted on your device (AES-GCM with a key held in the iOS Keychain or Android Keystore).
- Drafts, assistant history and reminders are removed when you sign out. Uninstalling the app also removes them.
- App lock with Face ID, a fingerprint or your device passcode is handled by your phone’s operating system. We only learn whether unlocking succeeded; we never receive biometric data.
What the apps do not do
The apps show no advertising, do not use an advertising ID and do not track you across other companies’ apps or websites. They do not access your location or contacts.
Permissions
| Permission | When the app asks | What it is used for |
|---|---|---|
| Notifications | When you turn on push notifications or set a reminder | Workspace alerts and your personal reminders |
| Camera and microphone | Only when you record a video | Recording a video for Creative Analysis |
| Photos and files | When you pick a photo, video or file | Only the item you choose is shared with the app, for logos, Creative Analysis or CSV imports |
| Face ID or fingerprint | When you turn on Lock this app | Unlocking the app; handled by the operating system |
| Location, contacts, advertising ID | Never | Not used |
Deleting your data from the app
Open Account → Help and privacy → Delete account (workspace owners see Delete workspace and account). Deleting your account does not cancel an App Store or Google Play subscription, so cancel that in your store settings first. See Data Deletion for every option.
8. Legal bases for processing (UK GDPR)
- Contract — to deliver the Service you have subscribed to.
- Legitimate interest — to secure the Service, prevent fraud and improve the product.
- Consent — for non-essential cookies and optional marketing emails. You can withdraw consent at any time.
- Legal obligation — to retain billing records required by HMRC.
9. Sub-processors we share data with
- Supabase / Lovable Cloud — database, authentication and storage hosting (EU region).
- Google Cloud (Vertex AI) and Anthropic — AI model inference for generative features, as listed on our Security page. Prompts and outputs are not used to train their models.
- Stripe, Inc. — payment processing (US, UK SCCs in place).
- Resend, Inc. — transactional email delivery (US, UK SCCs in place).
- Google LLC — when you connect a Google product, your data is fetched from Google’s servers under their terms.
- Meta Platforms, Inc., LinkedIn, Pinterest, TikTok — same as above for their respective APIs.
- Apple Inc. — App Store purchases and subscription verification, Sign in with Apple and Apple Push Notification service, when you use the iOS app.
- Google LLC — Google Play Billing, Google sign-in and Firebase Cloud Messaging, when you use the Android app or sign in with Google.
- Expo (650 Industries, Inc.) — push notification delivery for the mobile apps, if you turn notifications on.
10. International transfers
Some sub-processors are located outside the UK / EEA. Where this is the case, transfers are protected by the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an equivalent adequacy mechanism.
11. How long we keep your data
- Account data — for as long as your account is active, then up to 12 months after closure.
- OAuth tokens — until you disconnect the platform, delete your account, or revoke the token at the source platform.
- Synced platform analytics — for the historical window allowed by your subscription tier (12 months standard, 24 months Agency), then rolling-deleted.
- Billing records — 7 years (UK statutory retention).
- Encrypted off-site backups — 30 days.
12. Security
We protect your data with industry-standard controls: TLS 1.2+ in transit, AES-256 at rest, encrypted OAuth tokens, Postgres Row-Level Security for multi-tenant isolation, hashed passwords (bcrypt / Argon2), least-privilege access, and audit logging on all admin actions.
13. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you;
- Have inaccurate data corrected;
- Have your data erased, on the web or in the mobile apps (see our Data Deletion page);
- Receive your data in a portable format;
- Object to or restrict processing;
- Withdraw consent;
- Lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk).
To exercise any of these rights, email legal@mycontentlab.co.uk.
14. Children
The Service is not directed at people under 16, and we do not knowingly collect data from children.
15. Cookies
We use a minimal set of essential cookies for authentication and session management, plus first-party analytics cookies via Google Tag Manager. You can clear or block cookies in your browser settings; doing so may impact some Service features.
16. Changes to this policy
We will update the “Last updated” date at the top of this page when this policy changes. Material changes will be communicated by email to your account address.
17. Contact
- Privacy & data requests: legal@mycontentlab.co.uk
- Product support: support@mycontentlab.co.uk
- Billing: billing@mycontentlab.co.uk
- General enquiries: hello@mycontentlab.co.uk