Privacy Policy

News Factory · Effective Date: January 1, 2026 · Last updated: October 12, 2026

This Privacy Policy describes how News Factory Inc ("Company," "we," "us," or "our") collects, uses, shares, and protects your personal information when you use our AI-powered news content platform (the "Service"). This policy applies to all users of our website, applications, and services.

We are committed to protecting your privacy and complying with applicable data protection laws, including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other relevant privacy regulations.

1. Information We Collect

1.1 Information You Provide

Account Information: When you create an account, we collect your name and email address. Account creation and authentication is processed through our third-party provider, Clerk.

Organization Information: If you create or join an organization, we collect the organization name, settings, and configuration preferences.

Payment Information: Payment processing is handled by Stripe. We do not directly store your credit card numbers or banking details. We receive transaction confirmations and subscription status from our payment processors.

Content: We store the content you create, upload, or generate through the Service, including stories, articles, images, translations, and other materials.

Communications: We collect information from your communications with us, including support inquiries and feedback.

1.2 Information Collected Automatically

Usage Data: We collect information about how you use the Service, including features accessed, actions taken, and time spent on the platform.

AI Usage Data: We track your usage of AI features, including the number of AI requests, token consumption, and associated costs for billing and service improvement purposes.

Device Information: We collect information about the devices you use to access the Service, including device type, operating system, browser type, and unique device identifiers.

Log Data: Our servers automatically record information including IP addresses, access times, pages viewed, and referring URLs.

Cookies and Similar Technologies: We use cookies, local storage, and similar technologies to maintain sessions, remember preferences, and analyze usage patterns. See Section 9 for more details.

Marketing and Attribution Data: When you visit our website or arrive from one of our ads, we record how you got here: the campaign, ad group and keyword or link that brought you (for example UTM tags), an advertising click identifier (such as Google's gclid), the page you landed on and the website that referred you. We also record the pages you view, the links and buttons you click, and the steps you take towards creating an account, starting a trial and subscribing, together with your approximate location (country, region and city, derived from your IP address, which we do not store) and your device type, browser, operating system and language.

Product Usage Events: When you use the app, we record the screens you open and the actions you take (for example following a feed, running a workflow, repurposing or publishing a story), linked to your account and organization, to learn which features help customers and to improve onboarding. We do not record the content you type in these events.

1.3 Information from Third Parties

Authentication Provider: We receive authentication and account information from Clerk when you sign in.

Payment Processor: We receive subscription status and transaction information from Stripe.

RSS Feeds: We access publicly available news content from third-party RSS feeds that you choose to follow.

2. How We Use Your Information

We use your information for the following purposes:

Providing the Service: To operate, maintain, and deliver the features of our platform, including AI content generation, translation, and publishing tools.

Account Management: To create and manage your account, process subscriptions, and provide customer support.

Billing and Payments: To process payments, track usage for billing purposes, and manage your subscription.

AI Processing: To provide AI-powered features by sending your content to third-party AI service providers for processing.

Communications: To send you service-related notices, updates, security alerts, and support messages.

Improvement: To analyze usage patterns, diagnose technical issues, and improve our Service.

Security: To detect, prevent, and respond to fraud, abuse, and security incidents.

Legal Compliance: To comply with applicable laws, regulations, and legal processes.

Marketing Measurement: To understand which of our marketing works, measure our advertising, and report conversions (such as starting a trial or making a first payment) to advertising platforms so that they can measure and improve the performance of our ads.

3. Legal Bases for Processing (GDPR)

For users in the European Economic Area (EEA) and United Kingdom, we process your personal data based on the following legal grounds:

Contract Performance: Processing necessary to fulfill our contract with you, including providing the Service and managing your account.

Legitimate Interests: Processing for our legitimate business interests, such as improving the Service, preventing fraud, and ensuring security, where these interests are not overridden by your rights.

Legal Obligations: Processing necessary to comply with legal obligations.

Consent: Where required by law, we obtain your consent for certain processing activities. You may withdraw consent at any time.

Specifically, for visitors from the EEA, the United Kingdom and Switzerland we rely on your consent for analytics and advertising cookies and similar technologies, for session recordings, and for reporting conversions to Google Ads. We rely on our legitimate interests for the first-party measurement described in Section 1.2 that does not store or read anything on your device: counting visits, recording how your account was acquired, and recording the actions you take in the app, so that we can understand and improve our marketing and product. You can object to this processing at any time (see Section 8).

4. How We Share Your Information

4.1 Service Providers

We share your information with third-party service providers who assist us in operating the Service:

All service providers are contractually obligated to protect your information and use it only for the purposes specified.

4.2 CMS Publishing

When you publish content to external content management systems (WordPress, Drupal, Joomla), your content is transmitted to those platforms according to your configuration. This sharing is initiated by you and subject to the privacy policies of those platforms.

4.3 Organization Members

If you are part of an organization, your name, email, and activity within the organization may be visible to other organization members and administrators.

4.4 Legal Requirements

We may disclose your information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of the Company, our users, or others.

4.5 Business Transfers

In connection with a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change in ownership.

5. Data Retention

We retain your information for as long as necessary to provide the Service and fulfill the purposes described in this Privacy Policy:

Account Data: Retained while your account is active and for a reasonable period thereafter to comply with legal obligations.

Content: Retained while your account is active. Upon account deletion, all content is permanently deleted.

Usage and AI Data: Retained for billing purposes and service improvement. AI usage records are retained for the duration of your account.

Log Data: Generally retained for up to 90 days for security and troubleshooting purposes.

Temporary Data: Feed articles and flagged content sources are automatically cleaned up after configurable retention periods (typically 3-10 days).

Marketing and Analytics Data: Events and attribution data in our own systems are kept for up to 13 months and then deleted; the record of how an account was acquired is kept for as long as the account exists. Google Analytics, Google Ads and PostHog keep data according to the retention we configure, at most 14 months.

6. Data Security

We implement appropriate technical and organizational measures to protect your information, including:

• Encryption of data in transit using TLS/SSL
• Encryption of data at rest for stored content
• Secure authentication through Clerk with support for multi-factor authentication
• Regular security assessments and monitoring
• Access controls limiting data access to authorized personnel
• Secure cloud infrastructure (AWS) with industry-standard protections

While we strive to protect your information, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

7. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States, where our service providers are located. These countries may have different data protection laws than your jurisdiction.

For transfers from the EEA or UK, we rely on appropriate safeguards, including Standard Contractual Clauses approved by the European Commission, and our service providers' participation in recognized data transfer frameworks (such as the EU-U.S. Data Privacy Framework where applicable).

8. Your Rights

8.1 Rights Under GDPR (EEA/UK Users)

If you are located in the European Economic Area or United Kingdom, you have the following rights:

Access: Request a copy of your personal data.

Rectification: Request correction of inaccurate personal data.

Erasure: Request deletion of your personal data ("right to be forgotten").

Restriction: Request restriction of processing of your personal data.

Portability: Request transfer of your personal data in a structured, machine-readable format.

Objection: Object to processing based on legitimate interests.

Withdraw Consent: Withdraw consent where processing is based on consent.

You also have the right to lodge a complaint with your local data protection authority.

8.2 Rights Under CCPA (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Know: Right to know what personal information we collect, use, disclose, and sell.

Delete: Right to request deletion of your personal information.

Correct: Right to request correction of inaccurate personal information.

Opt-Out: Right to opt out of the sale or sharing of personal information. Note: We do not sell your personal information.

Non-Discrimination: Right not to be discriminated against for exercising your privacy rights.

Categories of Personal Information Collected: Identifiers (name, email); Commercial information (subscription history); Internet activity (usage data); Professional information (organization role).

Advertising "Sharing": We do not sell personal information. We use Google Ads cookies to measure our advertising, which California law may treat as "sharing" for cross-context behavioral advertising. You can opt out at any time under Cookie settings, and we treat a Global Privacy Control (GPC) signal from your browser as an opt-out.

8.3 Exercising Your Rights

To exercise your privacy rights, you may: (a) use the account settings within the Service; (b) contact us at info@news-factory.app; or (c) delete your account, which will remove all associated data. We will respond to verified requests within the timeframes required by applicable law.

9. Cookies and Tracking Technologies

We use cookies and similar technologies (such as local and session storage) for the purposes below. Visitors from the EEA, the United Kingdom and Switzerland are asked first: nothing beyond what is strictly necessary is set until you choose in our cookie banner. Elsewhere, analytics and advertising measurement are on by default and you can switch them off at any time. You can change your choice whenever you like under Cookie settings (in the footer of our website and in the user menu of the app).

Open Cookie settings

Google Consent Mode: If you decline, Google's tags do not set or read cookies, but may send cookieless signals (such as the fact that a page was viewed) that Google uses for aggregate, modelled measurement.

Sign-up Attribution: Links from our website to the sign-up page carry the campaign information in the link itself, so we can record which campaign or page led to your account even if you declined cookies. Nothing is stored on your device for this; it is stored with your account. The ad click identifier is only included if you allowed advertising measurement (or are outside the EEA, the United Kingdom and Switzerland).

Conversions Reported to Google Ads: If you came to us from a Google ad and allowed advertising measurement (or are outside the EEA, the United Kingdom and Switzerland), we tell Google Ads when you start a trial or make your first payment. We send the ad click identifier, the time and the value, never your name or email address.

10. Children's Privacy

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete such information promptly.

11. Third-Party Links and Services

The Service may contain links to third-party websites or integrate with third-party services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you access through our Service.

12. Account Deletion and Data Removal

When you delete your account or organization, we permanently delete:

• All stories, articles, and content you created
• All images and files stored in our systems
• All content sources and feed configurations
• All AI usage records and analytics
• All CMS integrations and social media posts
• Your account and organization data from our authentication provider

This deletion is permanent and irreversible. We recommend exporting any data you wish to keep before deleting your account.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes your acceptance of the updated Privacy Policy.

14. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us at:

For GDPR-related inquiries, you may also contact our Data Protection representative at the email address above.

By using the Service, you acknowledge that you have read and understood this Privacy Policy.