Privacy Policy
Last updated: 28 July 2026 · Digitallwork.hu Kft. (company reg. no. 01-09-426906, VAT no. 32489819-2-43)
This Privacy Policy is provided in English only. A tájékoztató kizárólag angol nyelven érhető el – kérdés esetén írj a support@getcontentninja.com címre.
1. Data Controller
Content Ninja (the "Service") is an AI-powered content marketing tool for e-commerce businesses that creates social media content (text, images, video) and publishes it on the user's behalf to the user's own Facebook Pages and Instagram business accounts. The Service is operated by:
- Company name
- Digitallwork.hu Kft.
- Registered seat
- 1118 Budapest, Pálinkás Antal u. 3/A FSZ/8, Hungary
- Company reg. number
- 01-09-426906
- VAT number
- 32489819-2-43
- Privacy contact
- support@getcontentninja.com
- Phone
- +36 20 283 8831
This policy covers both this marketing website (getcontentninja.com) and the Content Ninja application (app.getcontentninja.com). It is drawn up in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR"), the Hungarian Act CXII of 2011 on informational self-determination, and Act C of 2000 on accounting.
The contractual conditions of using the Service are set out in the Terms of Service; this Privacy Policy forms an integral part of them.
2. What data we process
2.1. Account and registration data
2.2. Payment data
2.3. Content data
2.4. Facebook / Instagram (Meta) data
When you connect your Facebook account via Facebook Login, we access and store the following data through the Meta Graph API:
- your long-lived user access token (stored encrypted);
- the list and identifiers of the Facebook Pages you manage and the Instagram business accounts linked to them;
- Page access tokens (stored encrypted);
- the identifiers and links of the posts published through the Service;
- performance statistics (insights) of your Pages, Instagram account and published posts (e.g. reach, impressions, engagement);
- comments on your published posts, so that you can view and manage them in the Service.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR). These tokens and identifiers are used exclusively to publish and manage the content you create in the Service and to show you the performance statistics and comments of that content — see Sections 3 and 4.
2.5. Newsletter integration (MailerLite)
2.6. Usage logs
2.7. Content Ninja newsletter
2.8. Website visitors – Meta Pixel
3. How we use your data — purposes and legal bases
We use the data described above for the following purposes:
- Providing the Service — generating content, publishing / scheduling it on your behalf to the social media accounts you connected, and displaying the performance statistics (insights) and comments of your published posts (performance of a contract);
- Invoicing and accounting (legal obligation);
- Product improvement and reliability — usage logs and aggregated statistics (legitimate interest);
- Marketing on this website — Meta Pixel remarketing (consent).
Meta access tokens and Meta platform data are used exclusively to publish and manage the content you create in the Service. We do not sell them, do not share them with any third party beyond the processors listed in Section 5, and do not use them for advertising, profiling, or any purpose unrelated to the Service.
4. Meta permissions we request and why
When you connect your account with Facebook Login, we request the following permissions:
- pages_show_list — to list the Facebook Pages you manage so you can choose which one to connect;
- pages_manage_posts — to create, schedule and publish posts on your connected Page on your behalf;
- pages_read_engagement — to read your Page's content and basic engagement data needed for publishing and for verifying that posts went live;
- instagram_basic — to identify the Instagram business account linked to your Facebook Page;
- instagram_content_publish — to publish content to your connected Instagram business account;
- read_insights — to read the performance statistics (insights) of your Page and its posts and display them to you in the Service;
- instagram_manage_insights — to read the performance statistics (insights) of your Instagram business account and its posts and display them to you in the Service;
- pages_manage_engagement — to read and reply to comments on your Page's posts from within the Service;
- instagram_manage_comments — to read and reply to comments on your Instagram posts from within the Service.
You can revoke these permissions at any time in your Facebook settings (Settings & privacy → Settings → Business integrations) or by disconnecting the account inside the Content Ninja application.
5. Who we share data with (processors and sub-processors)
We use the following processors to provide the Service. We never sell your personal data to third parties.
| Processor | Location | Activity |
|---|---|---|
| Supabase, Inc. | EU region | Database, authentication, file storage |
| Vercel, Inc. | EU (Frankfurt) | Application hosting |
| Stripe, Inc. | USA | Payment processing |
| Meta Platforms, Inc. | USA / Ireland | Publishing to Facebook / Instagram; website marketing (Pixel) |
| OpenAI, Inc. | USA | AI text and image generation |
| Anthropic, Inc. | USA | AI text generation |
| Google LLC | USA | AI text, image and video generation |
| MailerLite (UAB MailerLite) | Lithuania, EU | Newsletter delivery |
| Mailjet (Sinch Email) | France, EU | Transactional e-mail delivery (account, billing and system notifications) |
| Sentry (Functional Software, Inc.) | EU region | Error logging |
| GitHub, Inc. | USA | Hosting of this marketing website |
| KBOSS.hu Kft. (Szamlazz.hu) | Hungary | Invoicing |
When generating content, only the inputs required for generation (e.g. product data, prompts, brand settings) are sent to the AI providers — never your access tokens or account credentials.
Note on Sentry: when an error occurs in the application, the technical details of that error (error message, page address, browser type, timestamp) are sent to Sentry's European servers so that we can fix it. We do not send IP addresses, cookies, form contents, or the part of the web address after the question mark. Purpose: bug fixing and operational reliability; legal basis: our legitimate interest; retention: 90 days at most.
Note on Meta Platforms: when the Service publishes content to your Facebook Page or Instagram account, or reads insights and comments on your behalf, Meta Platforms processes that data as an independent data controller under its own privacy policy — not as our processor. Meta acts as our processor only in respect of the Meta Pixel used on this marketing website (see Section 10).
6. Where we store your data, and how we protect it
- Storage in the EU: your data is stored within the European Union (Supabase EU region, Vercel Frankfurt).
- Third-country transfers: some processors operate in the USA (Stripe, Meta, OpenAI, Anthropic, Google, GitHub). Transfers to them rely on the EU–US Data Privacy Framework, covered by the European Commission's adequacy decision, and/or Standard Contractual Clauses.
- Isolation: data is separated per user / workspace at the database level (row-level security, RLS).
- Encryption: all platform access tokens (Meta user and Page tokens, API keys) are stored encrypted using AES-256-GCM; data in transit is protected by TLS.
7. Retention and deletion
- Account and content data: retained while your account exists, then deleted within 30 days after account deletion.
- Meta access tokens and connected-account data: deleted immediately when you disconnect the account in the app, revoke the app's access in your Facebook settings, or delete your account.
- Invoicing data: retained for 8 years, as required by the Hungarian Accounting Act.
- Usage logs: retained for up to 12 months.
- Error logs (Sentry): retained for up to 90 days.
- Newsletter data: retained until you unsubscribe.
You can request deletion of your data at any time, in any of the following ways:
- delete your account inside the Content Ninja application;
- send a deletion request to support@getcontentninja.com;
- remove the app's access in your Facebook settings (Settings & privacy → Settings → Business integrations) — this immediately invalidates the stored tokens.
Deletion requests are completed within 30 days at the latest, except for data we are legally required to retain (e.g. invoices). Step-by-step instructions are available on our Data Deletion Instructions page.
8. Your rights under the GDPR
Right of access — you may request information about the data we process about you.
Right to rectification — you may request the correction of inaccurate data.
Right to erasure — you may request deletion of your data where there is no longer a legal basis for processing.
Right to restriction of processing — you may request that processing be restricted in certain cases.
Right to data portability — you may request your data in a machine-readable format.
Right to object — you may object to processing based on legitimate interest.
Right to withdraw consent — for consent-based processing (newsletter, Meta Pixel), you may withdraw consent at any time without giving reasons; withdrawal does not affect the lawfulness of processing before the withdrawal.
You can exercise these rights by e-mailing support@getcontentninja.com. We respond to requests within 30 days at the latest.
9. Complaints
If you believe we have infringed the rules on data processing, you may lodge a complaint with the Hungarian supervisory authority:
You may also bring the matter before a court, or complain to the supervisory authority of your own EU member state.
10. Cookies
10.1. Strictly necessary cookies
Cookies essential for the operation of the website and the application (session handling, login). These do not require consent.
10.2. Marketing cookies (Meta Pixel)
The Meta Pixel places cookies in the visitor's browser for remarketing and advertising purposes. These are activated only with your explicit consent given in the cookie banner.
10.3. Managing cookies
You may modify or withdraw your cookie consent at any time via the cookie banner, and cookies can also be deleted or blocked individually in your browser settings.
11. Facebook / Meta platform clause
The application accesses the user's Pages and accounts through the Meta Platform (Facebook Login, Facebook Graph API, Instagram Graph API) solely for the purpose of publishing and managing content created by the user and displaying the performance statistics (insights) and comments of that content to the user. This access can be revoked at any time in the user's Facebook settings and within the application. The use and transfer of information received from Meta APIs adheres to the Meta Platform Terms and the applicable Meta Developer Policies.
12. Changes to this policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes by e-mail and publish the updated policy on this page. This version is effective from 2 July 2026.