Privacy Policy

Last updated: 2026-09-16

Controller and contact

Contentify is operated by Xpedition Technologies Oy (Finnish Business ID 3642614-2), c/o Ville Ekman, Ahteentaantie 327, 21140 Rymättylä, Finland. For privacy questions or to exercise your rights, email privacy@contentify.ai.

This notice covers the Contentify website, newsletter, invited application users and the limited professional contact data used to evaluate a small Finnish business-to-business marketing campaign. Public self-service remains closed during the controlled beta.

Data we process

• Aggregate, anonymised analytics (page views, referrer, country) via Cloudflare Web Analytics — no cookies, no cross-site tracking.
• Email address if you submit it to the newsletter form (separate consent, double opt-in).
• For invited application users: account identifiers, workspace and client content, usage records, quality evidence and operational logs needed to provide and secure the service.
• Connection credentials supplied for publishing or analytics. Contentify encrypts stored credentials and does not include credential material in workspace exports.
• For business prospecting: employer, Business ID, company domain, public professional email address, public name and job title where relevant, role-fit reason, source URL and observation time, address and domain verification results, company-level financial filtering data, and campaign or suppression history.

We do not buy private email addresses, infer personal addresses from naming patterns, process special-category data for prospecting, or probe individual mailboxes by SMTP.

Purposes and legal bases

• We use website analytics to understand which content is useful and to operate and secure the service on the basis of our legitimate interests.
• We use newsletter addresses only for the subscription requested, on the basis of consent. You can withdraw consent at any time.
• We process invited-user and workspace data to provide the requested service and take steps connected with a contract, and where necessary for security, fraud prevention and legal obligations.
• We process a limited set of professional contact data to identify Finnish companies for which Contentify may be relevant and, after human review, to send one role-relevant business marketing message. For personal data, the basis is our legitimate interest under GDPR Article 6(1)(f) in proportionate B2B direct marketing. We balance that interest against the recipient's expectations, prefer generic company routes, restrict named contacts to relevant published roles, and do not use automated follow-up.

Professional contact sources

We obtain professional contact details from the person's employer's public website. We use Finnish Patent and Registration Office open data for company identity and financial filtering. The specific source URL is included in the first marketing message or is available on request. The recipient is not required by law or contract to provide this data, and there are no consequences for refusing or objecting.

Recipients, processors and international transfers

Access is limited to the controller and service providers that need the data to perform their contracted function. Hetzner hosts the private prospecting application and database in the EU. Cloudflare provides network protection, edge delivery and private backup storage. Other parts of the controlled-beta service may use Railway, Sentry, Mailjet, Stripe, DataForSEO and the AI provider selected for a task. We do not currently use an outbound email provider for the prospecting database, and no marketing campaign has been sent from it.

When a provider processes personal data outside the European Economic Area, we use an applicable adequacy decision or contractual safeguards such as the European Commission's Standard Contractual Clauses, together with supplementary measures where required. Contact us for information about safeguards relevant to your data. We will update this notice before adding an outbound provider or materially changing the processing.

Retention, export and deletion

Newsletter data is retained until consent is withdrawn or the subscription is otherwise ended. Invited workspace owners can export a portable archive of their workspace data. An organization-deletion request enters a 30-day recovery period before permanent deletion of workspace database records and private content assets held by Contentify. Security credentials and password hashes are excluded from exports. Copies already published to a configured destination follow that destination's separate unpublishing and retention process.

For the first professional-contact campaign, an unresponsive prospect's contact data is deleted or anonymised six months after the single message. A later campaign requires a newly reviewed public source. If a person or company objects, we retain only a keyed, irreversible suppression identifier while Contentify conducts direct marketing so that a later import cannot cause re-contact. We review the need for that suppression record annually.

Your rights

Subject to the conditions in GDPR, you can request access to, correction, deletion, restriction or portability of personal data, and object to processing based on legitimate interests. You can object to direct marketing at any time, free of charge; we apply that objection immediately and stop using the data for marketing. Where processing is based on consent, you can withdraw it at any time without affecting earlier lawful processing.

Contact privacy@contentify.ai. We verify a requester before disclosing or changing account or client data. You may also complain to Finland's Office of the Data Protection Ombudsman or another competent supervisory authority.

Automated decision-making

Prospect scoring only orders candidates for human review. It does not make decisions that produce legal or similarly significant effects. Contentify does not make solely automated decisions of that kind about website visitors, subscribers, invited users or prospects.

Changes to this notice

We update this page when the processing or providers materially change and show the revision date above. Material changes affecting an active customer or campaign will be communicated through an appropriate direct channel where required.