Privacy Policy

This policy is a first draft and has not been reviewed by a lawyer. Items marked [TBD] or [To confirm] will be completed before it is published.

Effective date: [TBD: effective date] Last updated: October 20, 2026

1. Who we are

Copywa is an online service that helps brands produce marketing content ("Copywa", "the Service", "we" or "us"). The Service is operated by [TBD: company legal name], registered at [TBD: registered address]. [TBD: name of the data controller / personal information handler] is responsible for the processing described in this policy.

This policy explains what information we collect when you use the Copywa website and product, why we collect it, who processes it for us, how long we keep it, and what rights you have. Copywa is in closed beta and its features will change; when a change affects how we handle personal information, we will update this policy.

If you have any questions, email us at hello@copywa.com.

2. Information we collect

2.1 Account information

• Sign-up and sign-in: if you sign up with email and password, we store your email address, the name you enter and a hash of your password. If you sign in with a third-party account (such as Google or GitHub), we receive your name, email address, profile picture link and the account identifier that provider assigns to you. The sign-in options available are those shown on the sign-in page.
• Recorded automatically at sign-up: your IP address, your interface language (taken from the language you chose or your browser's language preference), and the referral source you came from (only if the link you followed carried a source tag).
• Sign-in sessions: each session records its IP address and browser information (user agent) to keep you signed in and to protect your account.

2.2 Content you create or upload

• Brand information: brand name, description, target market, selling points, and the brand materials you upload (such as brand overviews or tone-of-voice guides), including their earlier versions.
• Assets: images, videos, PDFs and documents you upload, with the titles, descriptions and tags you add.
• Content tasks and drafts: your task briefs, revision feedback, the drafts and images produced, earlier draft versions, and proofreading rules.
• Video captions: the YouTube video captions you choose to read when creating a task, and your edits to them.
• Collected content: the collection sources you set up (such as keywords, accounts or RSS feeds) and the public content gathered from social platforms and websites according to those settings (post text, author names, links, engagement figures and so on). This content may include personal information that third parties have made public.
• Publishing channels: the settings of channels you connect (such as a WeChat Official Account, a WordPress site or a webhook) and the credentials you provide (such as an AppID / AppSecret or an application password). Credentials are stored encrypted and are not shown again in plain text after you save them.

Please do not put sensitive personal information unrelated to marketing (such as ID numbers, health information or information about minors) into brand materials, assets or briefs.

2.3 Credits and usage records

We record credit grants, holds, settlements and expiries, your plan, and the credits each task uses, for billing, reconciliation and abuse prevention.

2.4 Payment information

There is no public pricing during the beta. If online payment is introduced, payments will be handled by a third-party payment provider; we will keep order details such as order number, amount and status, but not your full card number. [To confirm: whether any online payment provider (such as Stripe, Creem or PayPal) is enabled during the beta]

2.5 Technical information and cookies

• Server logs: our hosting provider records basic request information (such as IP address, time, page requested and errors) for operations, troubleshooting and security.
• Cookies and browser storage: we use the following essential or functional cookies and local storage:
  • a session cookie that keeps you signed in;
  • a language cookie that remembers your interface language;
  • a sidebar cookie (app_sidebar) that remembers whether the sidebar is expanded or collapsed, kept for one year;
  • a referral cookie (utm_source) that, if you arrive through a tagged link, remembers the source for 30 days and saves it to your account when you sign up;
  • browser local storage that remembers your theme (light / dark), which task notifications you have already seen, and the cool-down for resending verification emails.
• Analytics: the Service can be connected to third-party website analytics tools. [To confirm: whether any analytics or session-recording tool (such as Google Analytics, Microsoft Clarity or Plausible) is enabled in production; if so, list it here with its cookies]

3. How we use information

We do not sell your personal information, and we do not use your brand materials, assets or drafts to train our own AI models. [To confirm: that this commitment holds]

For users in mainland China, we rely mainly on these legal bases: processing necessary to enter into and perform the service contract you are a party to; your consent; and processing necessary to fulfil statutory duties or obligations. For users in the European Economic Area, the UK and similar jurisdictions, we rely on performance of a contract, our legitimate interests (such as security, abuse prevention and product improvement), your consent, and compliance with legal obligations.

4. AI processing

Copywa's content generation, proofreading and selling-point extraction features send your brief and the relevant brand materials, assets and collected content to third-party AI model providers, which return the results. We send only what the task needs. After a task finishes, we make a best effort to delete any files temporarily uploaded to the model provider. How model providers retain and use this data is governed by their own API terms.

AI output can be inaccurate. Please review it before you publish (see our Terms of Service).

5. Who we share information with

We share information only as needed to provide the Service, with these categories of service providers (processors):

In addition:

• Channels you connect: when you publish, we send the draft to the WeChat Official Account, WordPress site or webhook you connected. How those platforms handle the content is governed by their own rules.
• Legal requirements: we may disclose information where the law requires it or to respond to lawful requests from law enforcement, courts or regulators.
• Business transfers: if we are involved in a merger, acquisition or asset transfer, your information may be transferred; we will require the recipient to keep to this policy or ask for your consent again.

Our administrators access your data only to provide support, investigate problems, handle abuse, or where the law requires.

6. International transfers

The hosting, AI model, data collection and email providers above mainly operate servers outside mainland China (for example in the United States and across Cloudflare's global network). If you use the Service from mainland China, your personal information will therefore be transferred abroad for processing.

The overseas recipients are the providers listed in section 5, whose contact details are on their websites; the purposes and methods of processing are set out in sections 3 and 4; and you can exercise your rights against those recipients by writing to hello@copywa.com. As required by the Personal Information Protection Law of the PRC, we obtain your separate consent for these transfers and complete any other formalities the law requires.

How we ask for consent: the first time you open the workspace, we show a separate notice about these transfers and ask you to tick a box to agree; until you do, the workspace stays closed. We record the time you agreed and the version of the notice. If the notice changes in a way that needs your agreement again, we will ask again. You can withdraw your consent at any time by writing to hello@copywa.com; after that, features that rely on these overseas providers will stop working for you. [To confirm: whether a standard contract or filing is needed]

For users in the EEA and the UK, transfers to other countries rely on appropriate safeguards such as the standard contractual clauses offered by our providers. [To confirm]

7. How long we keep information

• Account information and content you create: kept while your account exists; deleted or anonymised within [TBD: number] days after your account is closed, unless the law requires otherwise.
• Sign-in sessions: end when they expire or when you sign out.
• Credit and order records: kept for [TBD: retention period] for reconciliation and tax purposes.
• Server logs: kept for our hosting provider's default period. [To confirm: the period]
• Files temporarily uploaded to AI model providers: deleted on a best-effort basis after the task ends.
• Video captions: the video captions you read (the original and your edited version) are kept in your account as private material you paid for. Only you can see them; they are not shared with others or added to any shared collection library. They are kept until you delete them, or deleted with your account. The copy handed to a writing task is deleted after the task ends (a failed or cancelled task keeps it for 3 days so you can retry).

8. Security

We use reasonable technical and organisational measures to protect your information, including HTTPS across the site, hashed passwords, AES-GCM encryption of channel and collection credentials bound to the owning account, per-account separation of data and files, and role-based internal access. No system is perfectly secure. If a personal information security incident occurs, we will notify you and the authorities as the law requires.

9. Your rights

Wherever you are, you can:

• Access and copy: view your account, brands, assets, drafts and credit history in the product; email us if you need an exported copy.
• Correct: change your name and other details in settings, or ask us to correct them.
• Delete: delete the brands, assets, drafts, video captions and other content you created; to close your account, email us (self-service account deletion is not yet available in the product).
• Withdraw consent: withdraw consent you have given (this does not affect processing before the withdrawal).
• Ask for an explanation: ask us to explain this policy and how we process your information.

Depending on where you live, you may have further rights:

• Users in mainland China: under the Personal Information Protection Law you have the rights to know, decide, access, copy, correct, supplement and delete your personal information, request its transfer, withdraw consent and close your account, and you may complain to the relevant authorities.
• Users in the EEA and the UK: you also have the rights to restrict processing, to object to processing (including processing based on legitimate interests) and to data portability, and you may complain to your local data protection authority.
• Users in California and similar US states: you have the right to know what personal information we collect, to request its deletion and correction, and not to be discriminated against for exercising these rights. We do not sell personal information or "share" it for cross-context behavioural advertising.

To exercise any of these rights, email hello@copywa.com. To protect your account we may need to verify your identity first. We will reply within [To confirm: response time, e.g. 15 business days], or sooner where the law requires.

10. Children

The Service is meant for businesses and professionals, not for children. You must be at least [TBD: minimum age] years old to sign up. We do not knowingly collect personal information from children under 14 (or under the age set by your local law); if we learn we have, we will delete it promptly.

11. Changes to this policy

We may update this policy. For material changes (such as new purposes, new categories of processors or new transfer arrangements), we will post the new version on the website and tell you in the product or by email, and ask for your consent again where required.

12. Contact us

• Email: hello@copywa.com
• Company: [TBD: company legal name]
• Address: [TBD: registered address]
• Personal information protection officer / representative: [To confirm: whether one is required, and contact details]