1. Data controller
COWBOYS AND WITCHES OÜ
Tornimäe tn 5
10145 Tallinn
Estonia
Email: info@cowboysandwitches.org
2. Data we collect
We collect only the data needed to run the Service:
- Account data — your email address, which we use to sign you in with a one-time code. We do not use passwords.
- Site data — the domains you connect, the blog domain you request, your brand name, the icon you upload, and your image accent colour.
- Generation data — the content plans, articles, metadata and images the Service produces for you, and the content settings you choose.
- Access credentials — the API key generated for your account, and, if you connect Google Search Console, the OAuth tokens and the email address of the Google account you connect.
- Rate-limit counters — the public read API is rate limited per account, in a short-lived counter (one row per account, reset every minute) so the endpoint cannot be abused.
- Pitch-page views — the page we send to a prospective customer by email is not part of the Service, and it opens with or without a link to it. The link we send carries that person's email address so we can tell whether the page was read, which means an opening is recorded with the page, the time, the host the visit came from and whose link it was. It sets no cookie in the reader's browser.
We do not run advertising or third-party analytics trackers on the Service. The pitch-page count is our own tool on our own infrastructure.
3. How we use your data
- To operate your account, dashboard, blog and publishing schedule.
- To read the public pages and sitemap of the sites you connect, so the plan is grounded in what you already publish.
- To generate articles, metadata and images, and to publish the ones you approve.
- To send transactional email (sign-in codes, and account notices).
- To see whether a pitch page we emailed to a prospective customer was actually opened.
- To enforce rate limits and keep the Service secure.
- To comply with legal obligations.
We never sell, share or monetise your data.
4. Third-party processors
We rely on the following services to operate Xt4b. Each processes data on our instructions, except where noted:
- Supabase / PostgreSQL (data processor) — stores your account, site, plan and published-content data. Our database runs in the European Union.
- Coolify on our own server (data processor) — application hosting, and registration of your blog domain so it can serve your blog.
- Resend (data processor) — transactional email delivery for sign-in codes and account notices.
- Chatwoot (data processor) — the support chat, and only if you accept it. Anything you write there, and any name or contact detail you give it, is stored on Chatwoot's servers so that we can answer you. Nothing is sent before you accept, and one click in the footer turns it off again.
- MiniMax (data processor) — the AI model provider that generates your content. The text we read from your website and the related plan metadata are sent to generate articles. Nothing is published without your schedule.
- Google Search Console (independent controller) — only if you connect it. We request read-only access to search performance data for the sites you own.
5. Where your data is stored
Your account, site and content data are stored in our database provider’s European Union region. Content sent to the AI model provider is processed to generate your articles, and the resulting articles are stored in the European Union with the rest of your data.
The support chat is the exception: those conversations are held by Chatwoot on their infrastructure rather than in our own database, and only ever for visitors who accepted the chat. Declining, or withdrawing a previous acceptance, means nothing is stored there at all.
6. Cookies
We set a session cookie when you sign in, and a short-lived cookie while you complete a Google Search Console connection. If you connect your own domain, your blog is served on it and may set its own strictly necessary cookies. Those cookies are needed for the service to work, so they are set without asking.
The support chat is the one thing that is not necessary. It is provided by Chatwoot and sets its own cookies and local storage to keep a conversation open, so it is loaded only if you accept it. Your answer is stored in your own browser, declining leaves the site working exactly as it does without it, and we set no advertising or tracking cookies either way.
You can change that answer at any time, as often as you like: turning the chat off closes it, clears the conversation from your browser, drops the cookie it set and asks the question again . Messages you have already sent stay in our support inbox until we delete them — write to us and we will.
7. Data retention
We retain your account data for as long as your account is active. If you delete a post, the article is removed from your blog. Rate-limit counters are fixed-window rows that reset continuously and are not kept as history. You may request deletion of your account and associated data at any time by contacting us.
8. Your rights
Under the GDPR you have the right to access, rectify or erase your personal data; to restrict or object to its processing; and to data portability. You also have the right to lodge a complaint with a supervisory authority. To exercise any of these rights, contact us at info@cowboysandwitches.org.