ContentStudio

GDPR overview

Implementation is concrete rather than merely asserted. A dedicated GDPR page commits the company to the whole regulation, in force since 25 May 2018, and sets out the roles: ContentStudio acts as processor, the customer as controller. A Data Processing Addendum is available on request by emailing privacy@contentstudio.io with an organisation name and plan details. That same address reaches a named Data Protection Officer, backed by a postal address in Delaware. Documented rights cover access — a subject access request answered within thirty days — plus rectification, erasure, objection, restriction, withdrawal of consent and portability, with immediate deletion actioned within seventy-two hours. Transfers outside the EEA rely on Standard Contractual Clauses or Binding Corporate Rules, and staff take privacy training every year. One gap stands out: no Article 27 EU representative is named anywhere in the legal pages.

Who owns the data?

The terms draw the line firmly in the vendor's favour. Clause 10.1 assigns ContentStudio Inc. every intellectual property right in or arising out of the Services, and the website terms add that uploading or posting content grants the company a non-exclusive, worldwide, royalty-free right to use that content. Customers keep practical control rather than contractual ownership: account settings allow them to access, correct, delete or modify their personal data, and the privacy policy undertakes never to sell or trade personally identifiable information. Backing up your own content remains explicitly your responsibility. Deleting an account wipes everything permanently, including material belonging to team members and clients.

Reuse rights

ContentStudio declares three purposes for the personal data it holds: delivering the Services, taking payment, and telling users about similar products, with unsubscribe available at any time. Account data covers name, address, email, password, phone, card details and photograph; log data adds IP address, browser, operating system, referring page, location, device identifiers and cookies, and usage may be recorded through screencasting tools to improve the product. Personal data is never sold, although trusted processors bound by confidentiality and by GDPR and CCPA may handle it, and a limited slice — email plus pre-conversion browsing behaviour — may reach corporate affiliates, with notice. One AI clause deserves careful reading because it is narrower than it first looks: the company undertakes not to use, transfer or sell Google user data, raw or derived, to develop or train generalised or foundational AI models, whether its own or a third party's. No equivalent commitment covers customer content in general. Users may object to data sharing for advertising through account settings or support, and payments run via Paddle, which retains neither the full card number nor the CVV.

Data retention & training

Hosting summary

The site describes its hosting in three ways that do not reconcile, and the discrepancy is worth naming rather than smoothing over. The privacy policy states that all information provided is stored on secure servers located in the United States. The pricing FAQ says the platform is hosted on top-tier European data centres with SSL encryption. The security page names Google Cloud and Hetzner as the primary data centres, describing facilities compliant with ISO 27017 and ISO 27018 and certified for SOC 1, SOC 2, SOC 3 and PCI DSS Level 1, with customer content stored redundantly across multiple locations. Transfers outside the EEA are covered by Standard Contractual Clauses or Binding Corporate Rules. The publisher is a Delaware corporation and governing law is that of the United States. One technical note: the domain resolves to an anycast CDN node on Amazon infrastructure, so the resolved IP says nothing about where data actually rests. Anyone with data residency obligations should get a written answer before signing.