Privacy Policy - XCentium Contentstack Marketplace Applications

This Privacy Policy ("Policy") describes how the Contentstack Marketplace applications published by XCentium handle data. Part A sets out provisions common to every XCentium app. Part B describes what each individual app processes, as data handling differs from app to app. At present, Part B covers one application: Synthetic Persona.

This Policy is specific to those apps. XCentium's general Privacy Policy governs the xcentium.com website, marketing communications, and recruitment; it does not cover these apps, and this Policy does not cover those. Where the two differ on an app's handling of data, this Policy governs.

2. Roles and Responsibilities

2.1. Our Marketplace apps run inside Contentstack and operate on content and configuration in your own stack. They are installed by you, configured by you, and act only when someone in your organization initiates an action.

2.2. For the purposes of applicable data protection law:

(a) You are the controller of the content in your stack.

(b) We act as a processor on your behalf, handling that content only as needed to provide the app and only on your instructions, which in practice means the actions your editors take inside it.

We do not determine the purposes of processing and we do not use your content for our own purposes.

2.3. Three core principles apply across all our apps:

(i) Your content stays in your stack. Where an app generates something, it is written back into your own Contentstack account and is not retained on our infrastructure other than as described in Section 6.

(ii) Where an app uses a third-party service on your behalf, you supply the credentials and contract with that provider directly.

(iii) Nothing is published automatically. Our apps write drafts; publishing remains a deliberate action taken by a person in Contentstack.

2.4. The specific data each app reads and sends is set out in Part B. Where an app processes anything beyond your stack's content and configuration, that is stated there.

3. Data Processing Agreement

A data processing agreement incorporating the terms required by Article 28 of the UK and EU General Data Protection Regulation is available on request from info@xcentium.com. Where personal data is transferred out of the UK or EEA to US-based infrastructure (see Sections 8 and 9), we rely on the Standard Contractual Clauses, which form part of that agreement.

4. Credentials and Configuration

4.1. Apps that require third-party access store the credentials you provide -- for example, an API key for a service you have chosen, or a Contentstack Management Token for your stack.

4.2. All such secrets are encrypted at rest with AES-256-GCM before storage and are never returned to any browser. A configuration screen reports only whether a credential is set, never its value. Credentials are held in a managed Redis database (Upstash), keyed by your installation identifier, and decrypted in memory only for the duration of a request that needs them.

4.3. Non-secret configuration -- project identifiers and similar -- is held in the app's ordinary Contentstack configuration.

4.4. When an app is uninstalled, the stored credentials for that installation are deleted. You may also request deletion at any time under Section 12.2.

5. Identity and Session Tokens

5.1. When an app loads, Contentstack provides a short-lived signed token identifying the installation. That token also carries identifiers for the Contentstack user and organization. We do not read, store, log, or transmit those two identifiers; they are discarded when the request that verified the token ends.

5.2. The app exchanges that token for a session token of its own, valid for approximately one hour. Our session token contains only:

your installation identifier;

your stack's API key; and

the Contentstack region hostname for your stack.

It is signed, is not stored by us, and expires on its own.

6. Diagnostic Logs

6.1. Server errors from our applications are written to our hosting provider's log system so that faults can be diagnosed. Credentials are redacted before anything is written, and logs are structured to record identifiers rather than content. Logs may still incidentally contain fragments of content present in an error message. They are retained for 1 day.

6.2. Separately, our hosting provider (Vercel) maintains its own platform request logs, which record network information including IP addresses. These are generated and retained by Vercel under its own retention policy, not by us.

7. Exclusions

Our apps do not:

(a) process website visitor data, cookies, device identifiers, or behavioral profiles;

(b) collect product analytics or usage telemetry -- we do not operate any analytics or tracking service inside these apps;

(d) use your content to train any AI model -- where an app uses an AI provider you have configured, that provider's own terms govern their processing (both Anthropic and OpenAI state that API content is not used to train their models by default under their commercial terms, but that is their commitment to you under your agreement with them, not ours; see Section 8);

(e) publish content.

8. Sub-processors and Hosting

8.1. Sub-processors.

Sub-processor	Purpose
Vercel	Application hosting, serverless execution, platform request logs
Upstash	Encrypted credential storage and rate-limit counters

8.2. Our applications and the encrypted credential store are configured to run in iad1 (Washington, D.C., USA). Our hosting and database providers may operate infrastructure in other regions for resilience; where that occurs it is governed by their own terms.

8.3. Changes to sub-processors. We will keep the table above current and will give notice of any addition or replacement of a sub-processor through the Marketplace listing and to the contact on affected installations, before the new sub-processor begins processing.

8.4. Customer-configured services. Individual apps may use additional services that you select and configure -- an AI provider, for example. Those are named in the relevant Part B section. Because you supply the key and hold the account, your agreement with that provider governs their processing directly, including any data retention and training commitments. We recommend reviewing those terms before configuring an app.

9. Location of Processing

9.1. Content generated by our apps remains in your own Contentstack stack, in whichever Contentstack region your stack occupies. Our apps support all Contentstack regions and direct every Contentstack API call to the region your stack is in.

9.2. Credential storage and application execution occur in the region named in Section 8, which may differ from your Contentstack region.

9.3. If your stack is in a UK or EU Contentstack region, content processed by an app will therefore be transferred to the United States. The transfer mechanism for that is set out in Section 3.

10. Retention

Data	Retained
Encrypted credentials	Until the app is uninstalled, or on request under Section 12.2
Content generated into your stack	Until you delete it, in your stack
Session tokens	Approximately 1 hour; not stored
Rate-limit counters (keyed by installation)	Expire automatically with their rate-limit window -- at most 24 hours
Diagnostic logs (ours)	1 day
Platform request logs (Vercel)	Vercel's own retention policy (see Section 6)

Deletion on request is covered in Section 12.2.

11. Security

11.1. Technical measures. We implement the following security controls:

(a) Requests are authenticated using Contentstack's signed app tokens, verified against Contentstack's published public key and pinned to the specific app.

(b) Credentials are encrypted at rest (AES-256-GCM) and never exposed to a browser.

(d) Per-installation rate limits apply to expensive operations.

(e) All traffic is transmitted over HTTPS.

11.2. Vulnerability reporting. Please report suspected vulnerabilities to info@xcentium.com. We ask that you do not test against another customer's stack.

11.3. Breach notification. If we become aware of a personal data breach affecting your data, we will notify you without undue delay, with the information you need to meet your own notification obligations as controller.

11.4. Disclaimer. No system is perfectly secure, and we make no guarantee of absolute security.

12. Your Rights

12.1. Requests from Individuals

Our apps process the content you place in your Contentstack stack. Where that content contains personal data, you are the controller and we process it only on your instructions.

If you are an individual whose personal data may appear in a customer's content, your request should be directed to that customer, who is responsible for responding. We will assist them in doing so; they can reach us at info@xcentium.com.

12.2. Deletion on Request

Most of what our apps produce is already under your direct control -- as assets or entries in your own stack -- and you can delete it there at any time without involving us. Uninstalling an app deletes the encrypted credentials we hold for that installation.

Where you ask us to delete data that we do hold, we will do so within 30 days of a verified request to info@xcentium.com. In practice the only such data is the encrypted credential record for your installation, plus any diagnostic log entries that have not already aged out under Section 6.

13. Discontinuation of an App

If we withdraw an app from the Marketplace or cease operating it, we will give notice through the Marketplace listing and to the contact on affected installations, and will delete all stored credentials for that app's installations within 30 days of the service ending. Content the app generated into your own stack is unaffected and remains yours.

14. Changes to This Policy

We may update this Policy. Where a change materially affects how we handle your data, we will:

(a) update the "Effective Date" at the top of this document;

(b) record the change in Appendix A (Version History); and

(c) give notice through the Marketplace listing and to the contact on affected installations at least 30 days before the change takes effect, unless a shorter period is required by law.

15. Contact Information


Entity	XCentium
Address	2 Venture, Suite 450, Irvine, California 92618, USA
Email	info@xcentium.com
Governing Law	State of California, USA

PART B -- APPLICATION-SPECIFIC PROVISIONS

B-1. Synthetic Persona

Synthetic Persona reviews the copy on a Contentstack entry from the point of view of a marketing audience and suggests rewrites an editor can accept one at a time.

The personas it generates are fictional constructs derived from an audience's name and the entry's own copy. They are not real people, are not built from visitor profiles, and no visitor-level data reaches the app.

B-1.1. Entry Content Sent to Your AI Provider

(a) When an editor runs a personalization, the app reads the narrative text fields of the entry being edited and sends them to the AI provider configured for your installation -- Anthropic or OpenAI, whichever you select -- in order to generate a persona, produce suggestions, and rewrite individual fields.

(b) The provider is used under your own API key and your own agreement with that provider, as described in Section 8.

(c) Only text is sent. The app does not send assets, images, references, entry identifiers, or field paths to the AI provider. For each field, the model receives exactly three things:

an opaque identifier generated fresh for that request (F1, F2, etc. -- never the real field path or UID);

the field's label as it appears in your content type; and

the text value.

The model can only cite an opaque identifier back, which we then resolve on our side.

(d) If your entries contain personal data in their copy, that text will be included in what is sent. You control what is in your entries.

B-1.2. Content Saved into Your Asset Library

The app writes three kinds of artifact into your own Contentstack asset library. Because these files contain your content, this section sets out exactly what goes into each one.

Artifact	Format	Contains	Lifecycle
Persona record	JSON	The generated persona, and the name and description of the audience it was built from. No entry copy.	One per audience; replaced on regeneration
Review session	JSON	The persona, every suggestion, and the accept/decline state of each. Suggestions carry the original copy of each affected field and the rewritten copy that was applied, together with any answers you typed in response to a clarifying question.	One per entry + locale + write target; replaced on each save
Report	HTML	Entry title, content type and entry identifiers, audience name and description, the persona, and each suggestion including its proposed replacement copy. Does not include the original field values.	One per entry + locale + write target; replaced on each run

The review session is the most content-bearing of the three: it is what lets a review survive a page refresh, and to do that it holds both the before and after text of every field the app touched.

Report filenames are derived from the entry title and the variant name, so the filename itself discloses which entry a report belongs to.

These files live in your stack, under your control, and are subject to your own Contentstack retention and access policies. You can delete them at any time in Contentstack; deleting them is done there, not through us.

IMPORTANT -- ASSET URLs ARE NOT AUTHENTICATED. Contentstack serves asset URLs to anyone who has the link, without requiring a login. That is a property of Contentstack rather than of this app, and it applies to every asset in your stack. Because the artifacts above contain your entry copy (original and rewritten), treat their URLs as sensitive: do not paste them into public tickets, shared documents, or chat channels you would not put the underlying content into.

If you would rather these artifacts did not persist at all, delete them after each review. The app re-creates what it needs on the next run; the only thing lost is the ability to reopen a previous review without re-running it.

B-1.3. Writes Back to Your Entries

Accepted suggestions are written back to the entry or entry variant you selected, and are saved as drafts. Each write requires an editor to explicitly accept an individual suggestion first. The app does not publish.

B-1.4. Credentials Required

This app requires the following credentials, both handled as described in Section 4:

(a) An API key for your chosen AI provider (Anthropic or OpenAI).

(b) A Contentstack Management Token for your stack -- required because Contentstack's embedded-app permissions cannot write entry variants.

APPENDICES

Appendix A -- Version History

Version	Effective Date	Description of Change
1.0	14 September 2026	Initial publication. Covers XCentium's Contentstack Marketplace applications; Part B covers Synthetic Persona.