1. Data controller
COWBOYS AND WITCHES OÜ
Tornimäe tn 5
10145 Tallinn
Estonia
Email: info@cowboysandwitches.org
2. Data we collect
We collect only the data needed to run the Service:
- Account data — your email address, which we use to sign you in with a one-time code. We do not use passwords.
- Site data — the domains you connect, the blog domain you request, your brand name, the icon you upload, and your image accent colour.
- Generation data — the content plans, articles, metadata and images the Service produces for you, and the content settings you choose.
- Access credentials — the API key generated for your account, and, if you connect Google Search Console, the OAuth tokens and the email address of the Google account you connect.
- Rate-limit data — for the free site scan on our homepage, we store the IP address you request from in a short-lived counter (one row per address, reset every minute) so the endpoint cannot be abused.
We do not run advertising or third-party analytics trackers on the Service.
3. How we use your data
- To operate your account, dashboard, blog and publishing schedule.
- To read the public pages and sitemap of the sites you connect, so the plan is grounded in what you already publish.
- To generate articles, metadata and images, and to publish the ones you approve.
- To send transactional email (sign-in codes, and account notices).
- To enforce rate limits and keep the Service secure.
- To comply with legal obligations.
We never sell, share or monetise your data.
4. Third-party processors
We rely on the following services to operate Xt4b. Each processes data on our instructions, except where noted:
- Supabase / PostgreSQL (data processor) — stores your account, site, plan and published-content data. Our database runs in the European Union.
- Coolify on our own server (data processor) — application hosting, and registration of your blog domain so it can serve your blog.
- Resend (data processor) — transactional email delivery for sign-in codes and account notices.
- MiniMax (data processor) — the AI model provider that generates your content. The text we read from your website and the related plan metadata are sent to generate articles. Nothing is published without your schedule.
- Google Search Console (independent controller) — only if you connect it. We request read-only access to search performance data for the sites you own.
5. Where your data is stored
Your account, site and content data are stored in our database provider’s European Union region. Content sent to the AI model provider is processed to generate your articles, and the resulting articles are stored in the European Union with the rest of your data.
6. Cookies
We set a session cookie when you sign in, and a short-lived cookie while you complete a Google Search Console connection. If you connect your own domain, your blog is served on it and may set its own strictly necessary cookies. We do not set advertising or tracking cookies.
7. Data retention
We retain your account data for as long as your account is active. If you delete a post, the article is removed from your blog. Rate-limit counters are fixed-window rows that reset continuously and are not kept as history. You may request deletion of your account and associated data at any time by contacting us.
8. Your rights
Under the GDPR you have the right to access, rectify or erase your personal data; to restrict or object to its processing; and to data portability. You also have the right to lodge a complaint with a supervisory authority. To exercise any of these rights, contact us at info@cowboysandwitches.org.
9. The free site scan
The scan on our homepage reads the public homepage and sitemap.xml of the domain you enter, in order to show you the topic gaps we can see. Nothing from that scan is added to an account, and the result is not stored — apart from the rate-limit counter described above. See the Terms of Service for the rules that apply to the Service.