Privacy Policy

1. Controller

2. Personal data we collect

Depending on how you use Pollen, we may process:

• Account data: name, email address, and authentication details from Google sign-in.
• Project and workflow data: website URLs, project settings, research topics, keywords, briefs, outlines, drafts, audits, and publishing configuration.
• Connected-service data: data returned from Google Search Console and credentials/tokens needed to maintain an authorized connection. We use these only for the project and permissions you select.
• Technical data: IP address, request metadata, browser/device information, and error details needed for security and operation.
• Consent data: your cookie-consent choices stored in the necessary consent cookie.

3. Why we use your data

• To authenticate you and provide the Pollen service.
• To run research, content, audit, publishing, and monitoring workflows that you request.
• To connect to Google Search Console or another service when you explicitly authorize it.
• To secure, troubleshoot, maintain, and improve the service.
• To communicate about account, security, and material service changes.
• To comply with legal obligations and establish or defend legal claims.

4. Legal bases

For users in the EEA, the United Kingdom, or Switzerland, we rely on performance of a contract to provide requested features, legitimate interests for security and service improvement, consent for optional analytics, and legal obligation where applicable. You may withdraw analytics consent at any time.

5. Cookies and PostHog analytics

Pollen uses vanilla-cookieconsent to manage three categories:

• Necessary: authentication, security, and the consent choice. These cannot be disabled.
• Analytics: optional PostHog page-view and page-leave analytics. PostHog is not initialized until you opt in.
• Marketing: no marketing cookies are currently used and this category is disabled by default.

PostHog is configured without IP collection, automatic interaction capture, or session recording. Its browser persistence is enabled only after analytics consent and is removed when you withdraw that consent. Do Not Track is respected. You can change your choice withCookie preferences.

6. Service providers and international transfers

We use infrastructure and service providers to host the application, store data, provide authentication, process authorized Google integrations, and provide optional analytics. They process data only as needed to provide those services and under their applicable contractual and legal safeguards.

• Google: Google sign-in and Google Search Console. Google may process account and Search Console data under its Privacy Policy.
• OpenAI: when enabled, prompts and the project material needed for an AI workflow are sent to OpenAI through the configured backend provider. See OpenAI'sPrivacy Policy.
• SerpApi: when enabled, search queries and the selected market/locale are sent for SERP research. See SerpApi's Privacy Policy.
• Strapi: approved content and publishing metadata are sent only when you configure and invoke a Strapi publishing connection.
• PostHog: optional page-view analytics is sent to the configured hosthttps://eu.i.posthog.com only after consent. See PostHog'sPrivacy Policy.

OpenAI, SerpApi, Google, and PostHog may process data outside the EEA. The applicable provider terms, data-processing agreements, and transfer safeguards govern those transfers. We do not send project data to an optional provider until the corresponding provider is configured and the workflow requiring it is run.

7. Retention

Our retention periods are based on the data type and the reason it was collected:

• Account and authentication records: while the account is active and during the period needed to close it, resolve security issues, or meet legal duties.
• Project, workflow, and generated content: until you delete the project/account or the applicable retention period ends; backups may persist for a limited backup cycle.
• Google OAuth/Search Console tokens: while the connection is active, and removed when disconnected or when no longer required for security.
• Operational and security logs: for the period needed to investigate incidents, maintain service reliability, and satisfy legal obligations.
• PostHog analytics: according to the active PostHog project retention setting, and only for visitors who opted in.

We review stored data and delete or anonymize it when the purpose and any legal retention requirement have ended. Provider-side copies are subject to the provider's retention policy.

8. Your rights

Subject to applicable law, you may request:

• access to and a copy of your personal data;
• correction of inaccurate data;
• deletion or restriction of processing;
• portability of data you provided to us;
• an objection to processing based on legitimate interests; and
• withdrawal of consent for optional analytics.

Contact us using the details in Section 1. You may also lodge a complaint with the data protection authority responsible for your place of residence.

9. Security

We use reasonable technical and organizational safeguards, including encrypted transport, access controls, restricted service credentials, and database protections. No internet transmission or storage system can be guaranteed to be completely secure.

10. Children

Pollen is not directed to children. We do not knowingly collect personal data from children. Contact us if you believe a child has provided personal data.

11. Supervisory authority and changes

You may complain to the data protection supervisory authority responsible for your place of residence or work. In Germany, the competent authority can be identified through the Federal Commissioner's list of supervisory authorities.

We may update this policy when our processing changes or when required by law. The date above shows when it was last updated. Material changes will be communicated through the service where appropriate.

12. Contact

For privacy requests or questions, contact Andrei Khlivniuk atandrei.khlivniuk@gmail.com.