Privacy Policy
Contento — micro-learning platform | Last updated: September 25, 2026 | Version 1.2
Welcome to Contento. We respect your privacy and are committed to protecting your personal information. This policy explains what data we collect, how we use it, and what your rights are.
1. Information We Collect
1.1 Information you provide
- First and last name
- Email address
- Organization name and role
- Content created and uploaded to the platform (content managers)
1.2 Information collected automatically
- Platform usage data: courses viewed, scores, time spent, progress
- IP address and general location data
- Browser type and operating system
- Cookies — see section 6
2. How We Use Information
We use the information we collect for the following purposes:
- Providing access to the platform, identity verification, and account management
- Displaying courses, tracking progress, and generating reports for the organization
- Improving the product and analyzing issues and bugs
- Sending essential service updates and communications (no marketing without consent)
- Complying with legal obligations
3. Sharing Information with Third Parties
We do not sell or share your information with third parties for marketing purposes. Information is shared only with the service providers required to operate the platform ("sub-processors"):
| Provider | Purpose | Data processing location |
|---|---|---|
| Supabase | Database, authentication and file storage | European Union — Frankfurt, Germany (eu-central-1) |
| Amazon Web Services (AWS) | Infrastructure underlying Supabase and email delivery | European Union — Frankfurt and Ireland |
| Vercel | Application hosting | European Union — Frankfurt, Germany |
| Cloudflare | DNS, CDN and inbound email routing | Global network — GDPR compliant |
| Anthropic (Claude) | AI content creation, chat and personalization | USA — under Anthropic's commercial terms, API data is not used to train models |
| Google (Gemini) | Text-to-speech, podcast and video narration | USA — see Google's policy |
| fal.ai | AI image generation | USA |
| HeyGen | Avatar video (lip sync) | USA |
| Resend | Operational email — login codes, assignments and reminders | Europe (eu-west-1) |
| Brevo | Email delivery from our team mailboxes | Europe — GDPR compliant |
| PostHog | Product usage analytics and error monitoring | European Union |
| HubSpot | Customer relationship management (CRM) and marketing | European Union — Germany |
| Google Analytics | Marketing site traffic analytics | USA — see Google's policy |
4. Data Retention
- Account data: for the entire term of the engagement, and afterward up to 30 days for full deletion
- Sign-in and administration log (email address, IP address, time and the action taken): 400 days, including after the account or organization is deleted — for security and audit purposes. It is then deleted automatically
- Usage data (AI usage logs, study assistant conversations, sync logs): 12 months from creation, then deleted automatically
- Learning data (progress, quizzes, reflections, questionnaires): for as long as the learner has access, and 12 more months after that access ends — unless otherwise agreed with the organization. Ratings and insights the learner posted in a program remain, no longer attributed to them
- Backups: up to 7 additional days after active deletion — this is our daily backup window
- Google Analytics cookies: 26 months (per Google's default setting, can be shortened)
5. User Rights
Under Israel's Protection of Privacy Law, 5741-1981, you have the following rights:
- Right of access: to request to see the personal information we hold about you
- Right to rectification: to request correction of inaccurate information
- Right to erasure: to request deletion of your information (subject to legal obligations)
- Right to object: to object to the use of your information for marketing
For inquiries on these matters, contact: info@contento.team
6. Cookies
We use three types of cookies:
- Essential cookies: For login, security and preferences — cannot be disabled and collect no marketing data
- Analytics cookies: Google Analytics and PostHog, for traffic and product usage analysis and error monitoring — can be disabled through your browser settings
- Marketing cookies: HubSpot, to identify enquiries and track contact with customers and prospects — can be disabled through your browser settings
7. Information Security
We take security measures in line with the Protection of Privacy Regulations (Information Security), 5777-2017:
- Encryption of data in transit (TLS 1.2+) and at rest
- Role-based access control (RBAC)
- Daily backups
- Security event monitoring
8. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated to you via your registered email at least 30 days in advance. Continued use of the platform after the change takes effect constitutes acceptance of the updated policy.
9. Contact
For questions, inquiries, or to exercise your rights: info@contento.team