Privacy policy

Content Uploader (“we”, “us”) is an online service at contentuploader.com for preparing structured content from spreadsheets and publishing it, through connectors, to websites and online stores (“sites”).

The data controller responsible for processing your personal data is:

This doesn’t cover content we process on your behalf, explained in Content you upload and publish, or the invitations an owner sends, explained in Owners, team members and invitations. You can reach us about privacy at privacy@contentuploader.com.

We collect only what we need to run the service.

• Account details. Your name, email address and password, when you verified your email, and which versions of our Terms of Service you accepted and when. We store only a one-way hash of your password, never the password itself.
• Connected sign-in accounts. If you sign in with Google, GitHub, Microsoft or GitLab, we store which provider it is, the ID the provider gives your account there and the email address it reported, with when you connected it and last used it. The provider tells us your name and email address and whether it verified the address. We ask for nothing else: no repositories, contacts, calendars or files, and we never see your password there.
• Sign-in security. If you turn on two-factor authentication, we store its secret and recovery codes in encrypted form. If you add a passkey, we store its public key, the name you give it and when it was last used. Your fingerprint, face scan or device PIN never leaves your device.
• Security activity. When you create your account, sign in or out, and when you change how you sign in (your password, email address, two-factor authentication, passkeys or connected accounts), we record what happened and when, with the IP address and browser of the request. You see the latest of these in your security settings. The record doesn’t include failed sign-in attempts.
• Billing details. If you subscribe to a paid plan, you enter your payment details directly with Stripe, our payment processor, and we never receive or store your full card number. We keep whether you buy as a business or as a consumer, your billing name, email and postal address, your VAT number if you give one (businesses only), the type and last four digits of your payment method, your plan, and your invoices and payment history.
• Your withdrawal, if you make one. If you withdraw from a subscription as a consumer, we keep the name and email address you gave, when you did it, the subscription, the reference we gave you, and, once we have refunded you, who did that and what they noted.
• Workspace data. Workspace names, its people and their roles, which sites each team member may use, publishing configurations and their version history, and a record of important actions, such as who invited or removed someone, who changed which sites a person may use, who changed or deleted a configuration, approved a change, or connected or disconnected a site.
• Invitations. If an owner invites you, we receive your email address from them. We keep the address, who invited you, the sites the invitation covers, when it was sent, whether it was accepted or withdrawn, and a one-way hash of its link, never the link itself. We use the address only for the invitation, as Owners, team members and invitations describes.
• Content you upload. Your CSV and Excel files and their file names, ZIP files of images, the rows we read from them, validation results, the changes prepared for each site and the result of publishing each item. When your rows link to images on the web, we download them to check them and pass them to your site. Images are kept only as long as the upload they belong to; after that we keep only each image’s address or file name, a fingerprint of its content and the site’s reference to it, so later uploads can reuse it.
• Connected site details. Details a site shares when you connect it, described in Connected sites and stores.
• Technical data. When you use the service, our servers receive your IP address, browser type and the pages you request. We use this to deliver pages, protect the service, for example by limiting repeated sign-in attempts, and diagnose problems.
• Bot protection. When you start using the sign-up form, the password-reset form or the feedback form in the app, Google reCAPTCHA checks in the background that you’re a person and not a bot. Google receives your IP address, details of your browser and device, and how you interact with the page, and sets a cookie. We receive a score and whether the check passed. We keep it only in our server logs, and only when a request is turned away, with no IP address or email.
• Usage data, only with your consent. If you allow analytics cookies, Matomo and Google Analytics record the pages you visit, how you found us, your device and browser type, and your approximate location, derived from your IP address, which isn’t stored in full.
• Messages. If you contact us, we keep the conversation so we can help you. If you send a bug report or an idea from the app, we receive it as an email with your name and email address, the page and workspace you had open, your browser details and window size, and any files you attach, such as screenshots. Those can show your own content, so leave out anything you don’t want us to see. We don’t store reports in the app. A support request from the app is the same: an email to us, with your name and email address, your workspace and plan, and any files you attach.

We use personal data for the purposes below. Where the GDPR or similar laws apply, each purpose relies on one of these legal bases: contract, when we need the data to provide the service you signed up for; consent, which you can withdraw at any time; legitimate interests, when we have a good reason that isn’t outweighed by your rights; or legal obligation, when the law requires it.

Provide the service

Create your account and workspaces, and read, validate, compare, preview and publish your content.

Legal basis: Contract

Send service emails

Email verification, password resets, and messages when an upload needs your review, was published or failed.

Legal basis: Contract

Invite people to a workspace

When an owner invites you, we email you the invitation, check that the account that accepts it has the address it was sent to, and give that account the access the owner chose.

Legal basis: Contract or legitimate interests

Let you sign in with another account

If you choose to sign in with Google, GitHub, Microsoft or GitLab, we ask that provider who you are and for your email address.

Legal basis: Contract

Handle billing

Charge your subscription through Stripe, issue invoices and receipts, and handle renewals, refunds and failed payments.

Legal basis: Contract

Deal with a withdrawal

If you withdraw from a subscription as a consumer, we keep your declaration and what we did about it, so that we can refund you, answer you and show it if it is questioned.

Legal basis: Legal obligation or legitimate interests

Keep accounts and sites secure

Sign-in and two-factor checks, limits on repeated attempts, abuse prevention (including Google reCAPTCHA on the sign-up, password-reset and feedback forms), a record of sign-ins and changes to how you sign in, and each workspace’s activity history.

Legal basis: Legitimate interests

Fix problems

Diagnose errors and keep imports and publishing reliable.

Legal basis: Legitimate interests

Understand how people use Content Uploader

Measure visits and usage with Matomo and Google Analytics, so we can improve our website and service.

Legal basis: Consent

Answer your messages

Support requests and questions about this policy.

Legal basis: Contract or legitimate interests

Handle bug reports and ideas

Read what you send from the app, with the page and browser details and any files you attach, to fix problems and improve the service. We don’t promise a reply.

Legal basis: Legitimate interests

Meet legal obligations

Keep tax and accounting records, comply with the law, and establish, exercise or defend legal claims.

Legal basis: Legal obligation or legitimate interests

We don’t sell personal data or share it for advertising, and we don’t use Google Analytics’ advertising features, such as Google signals or ads personalization. Upload emails can be turned off in each configuration’s settings.

Your spreadsheets and the content made from them belong to you. They may include personal data about other people, such as staff names, author email addresses or contact details on listings.

For that content, you or your organization decide what is processed and why. We process it on your behalf, only to read, validate, compare, preview and publish it to the sites you choose, and to keep the history you see in your workspace. You’re responsible for having a lawful basis to use that data and for informing the people it concerns. The data processing terms in our Terms of Service apply to this processing. If your organization needs a signed agreement, contact us.

A workspace has one or more owners and can have team members. An owner invites people by email address and chooses which of the workspace’s sites each of them may use. This is what that means for personal data.

• Who decides what. We are the controller of your account details, including when you joined a workspace by invitation. The owner decides whom to invite, which sites each person may use and when someone is removed, and is responsible for those choices. The email address an owner gives us for an invitation we process on the owner’s behalf, only to send it and to check who accepts it. The data processing terms in our Terms of Service apply to that.
• If someone invites you. You get one email with a link. It names the workspace, the person who invited you and the sites you would be able to use. Nothing happens unless you accept, so you can simply ignore it, and the link stops working after seven days. The owner can send it again, which sends you another email and ends the earlier link. We use your address for nothing else: no marketing and no mailing list. The legal basis is legitimate interests: the owner asked us to deliver the invitation, we take nothing but the address, and you can object at any time, as Your rights and choices describes.
• What owners see. The owners of a workspace you belong to can see your name and email address, your role, the sites you may use and when you joined. They can see everything in the workspace, including what belongs to every site, and they receive exports of its data, which list its people and name the people who made changes.
• What team members see. As a team member you see the sites you were given and what belongs to them: their configurations, uploads and publishing results. You see the names and email addresses of the workspace’s owners, so you know whom to ask for more. You don’t see a list of the other team members, but if someone saves a configuration you are editing, you are told their name.
• Leaving and removal. You can leave a workspace yourself, and an owner can remove you or change the sites you may use. Access ends at once. Your account and your other workspaces stay as they are. What you did in the workspace stays in its history, which names you while your account exists (see How long we keep it).

Our Terms of Service ask owners to use what they learn about the people in their workspace only to run it.

Connectors link your workspace to the websites and online stores you publish to, such as content management systems and e-commerce platforms. A connector exchanges data with us only after you choose to connect a site to a workspace.

• When you connect or refresh a site, it shares its address, a connection identifier, its platform and connector versions, and the content it can receive, such as content and product types, fields, categories and tags. This can include the names of users who can author content and, where the connecting account may see them, their email addresses and usernames, so imported rows can choose an author.
• Before you publish, we may read what already exists on the site, such as categories or existing items, so the preview can show what will be created or changed.
• When you publish, we send the content you approved with its identifiers, and the site returns the IDs and outcome of each item.
• We never ask for your admin password. Each connection uses a dedicated credential, such as an access token, that we store encrypted and that can be revoked at any time.

Connectors collect no visitor analytics or advertising data. You can revoke access by disconnecting the site in Content Uploader or on the site itself, or by removing the connector. Platform-specific details, such as what a connector stores on your site, are in its description.

We use essential cookies that the service needs to work and to remember your settings. Analytics cookies are set, and analytics scripts loaded, only if you allow them in the cookie banner. Rejecting them doesn’t change how the service works, and you can change your choice at any time through Cookie settings at the bottom of every page and in your account settings. We don’t use advertising cookies.

Google reCAPTCHA protects the sign-up form, the password-reset form and the feedback form in the app from bots. Its script is loaded only on those pages, and only once you start using the form: for feedback, when you open it. Its cookie is essential to those forms and is set by Google, not by us, so it isn’t part of the analytics choice.

Google Analytics runs only on our public pages and the sign-in and sign-up pages. Matomo also counts which pages of the app are used, without the names or numbers of your workspaces, sites and records, and never on password reset, email verification, connection, team invitation and provider sign-in pages. Neither runs on error pages. If your browser sends a Global Privacy Control signal, we treat it as a “no” until you choose otherwise.

Open cookie settings

Your browser also keeps your theme choice in local storage, and unsaved configuration edits in session storage until you close the tab.

We share personal data only in these cases:

• Service providers that host and run parts of the service for us in the EU, such as our hosting provider, Host Europe, our file storage and backup provider, Amazon Web Services (AWS), and email delivery. They may use the data only on our instructions and must protect it under contract. Contact us for the current list.
• Stripe, our payment processor, which takes payments and manages subscriptions for us. Stripe also uses some payment data as an independent controller, for example to prevent fraud and meet financial regulations, under the Stripe privacy policy.
• Sign-in providers you choose, only if you sign in with Google, GitHub, Microsoft or GitLab. That provider learns that you use Content Uploader and when you sign in, and handles your sign-in itself under its own privacy policy, as an independent controller. We aren’t sharing your data with it: you start the sign-in and we receive what it reports.
• Google reCAPTCHA, provided by Google Ireland Limited, only when you use the sign-up form, the password-reset form or the feedback form. Your browser loads Google’s script and Google receives your IP address, details of your browser and device and how you interact with the page, to tell people from bots. Google uses it to provide and secure reCAPTCHA under its own privacy policy.
• Analytics providers, only if you allow analytics: Matomo, hosted in the EU, and Google Analytics, provided by Google Ireland Limited.
• Sites and stores you connect. When you publish, we send the approved content to your chosen site. What happens to it there is up to that site.
• People in your workspace. Its owners can see everything in it, including the names and email addresses of its people. Team members see what belongs to the sites they were given, and the names and email addresses of the owners. See Owners, team members and invitations.
• Legal reasons. When the law requires it, or to protect the rights, property or safety of our users, the public or us.
• Business transfers. If Content Uploader is merged, acquired or sold, personal data may transfer to the new owner under this policy. We’ll tell you before that happens.

We store your account, workspace and content data in the European Union. Our servers and databases are hosted by Host Europe in the EU. Uploaded files and encrypted database backups are stored with Amazon Web Services (AWS) in Frankfurt, Germany (AWS region eu-central-1). Your workspace and content data never leaves the EU. Matomo analytics is also hosted in the EU.

AWS keeps the data in the region we chose and doesn’t move it out of it. Because AWS is part of a US group, its data processing terms also include the European Commission’s Standard Contractual Clauses.

Two of our service providers may process data outside the EU: Stripe, for payments and billing, and Google, for reCAPTCHA on the sign-up, password-reset and feedback forms and for Google Analytics, if you allow it. Both may process data in the United States. These transfers rely on the EU–US Data Privacy Framework, under which both companies are certified, and on the European Commission’s Standard Contractual Clauses.

Signing in with Google, GitHub, Microsoft or GitLab is optional. If you do, that provider processes your sign-in itself, possibly outside the EU, under its own privacy policy. What it tells us, your name, email address and account ID, is stored in the EU with the rest of your account.

When you publish to a site or store hosted outside the EU, the content you approved goes to that site, because you chose to send it there.

• Original upload files, including ZIP files of images and images prepared for publishing, are deleted automatically 30 days after upload.
• Run history: the rows read from an upload, the changes found in them, and the log of the run and of each attempt to publish, are kept for 12 months after the upload so you can review past runs, then deleted. A short record of each run, with its counts and results, stays. So does what was last published to each item, which later uploads are compared with.
• Account details are kept while your account exists. When you delete your account, we delete your profile, password, two-factor settings, passkeys, connected sign-in accounts and security activity, and remove you from your workspaces. A workspace that only you belonged to is deleted with your account, as described below. Activity records in workspaces you shared stay, but no longer name you. You can’t delete your account while you own a workspace that other people still belong to.
• Invitations, with the address they were sent to, are deleted 30 days after they were accepted, withdrawn or expired. So is an invitation email that couldn’t be delivered. The workspace’s history keeps that someone was invited, by whom and for which sites, but not the address.
• Security activity is kept while your account exists. The IP address and browser of each event are erased after 12 months; the event itself stays until you delete your account.
• Billing records, such as invoices and payment history, are kept as long as tax and accounting laws require, even after you delete your account.
• A withdrawal is kept while the workspace exists, so that we can show what was declared and refunded. If you close the account that made it, your name stays in it as you gave it, and it is deleted with the workspace.
• Workspaces and their configurations, uploads and results are kept while the workspace has members, because they may rely on them. Deleting a configuration hides it but keeps its history.
• Deleted workspaces. When the last member of a workspace leaves or deletes their account, the workspace is deleted. It is locked at once, its paid subscription, if it has one, is cancelled, and 30 days later all its content, files and data are erased. A Free workspace that nobody has used for 12 months is deleted the same way, after we email its owners twice, about a month and about a week before. A workspace is used when a member signs in or uploads a file, or when an owner tells us to keep it, and a workspace on a paid plan is not deleted for not being used. For the 30 days a deleted workspace can be restored: the owners of an unused Free workspace can do it themselves when they sign in, and if the last member deleted their account, write to us from the address of the account that should have it. After that it can’t be recovered. We keep a short record that it was deleted, with its number, the reason and the dates, and no name or content, so that we can show it was done.
• Analytics data is kept for up to 14 months, then deleted.
• Server logs are kept as long as needed for security and troubleshooting, and no longer than the law allows.
• Backups may hold deleted data until they’re replaced, and no longer than the law allows.

We may keep data longer when the law requires it or to resolve a dispute.

• All connections to the service use HTTPS.
• Passwords are stored as one-way hashes. Two-factor secrets and connection credentials are encrypted.
• Uploaded files are kept in private storage, separated by workspace, and are never publicly accessible.
• The sign-up, password-reset and feedback forms are protected against bots with Google reCAPTCHA and checks of our own.
• Card details are entered directly with Stripe, which is certified to PCI DSS Level 1, and never reach our servers.
• In the app, only the people in a workspace can open its data, a team member only what belongs to the sites an owner gave them, and important actions are recorded in its activity history.
• Invitation links are secrets: we keep only a one-way hash of each, a link works once, for seven days, and only for a signed-in account with the address it was sent to, confirmed. The pages that carry them are never cached, indexed or counted by analytics.

No system is perfectly secure. If a breach affects your personal data, we’ll tell you and the authorities as the law requires.

Depending on where you live, including under the GDPR and UK GDPR, you may have the right to:

• Access the personal data we hold about you and get a copy of it
• Correct data that’s inaccurate or incomplete
• Delete your data
• Restrict or object to how we use it, including uses based on legitimate interests
• Receive your data in a portable, machine-readable format
• Withdraw consent, where we rely on it

You can change your name and email address or delete your account yourself in your profile settings, and change your analytics choice at any time through Cookie settings at the bottom of every page. For anything else, email privacy@contentuploader.com. We’ll reply within one month and may first need to confirm your identity.

If your details are part of content a customer uploaded, for example as an author on their site, please contact that customer first. We’ll help them respond.

If an owner invited you and you don’t want to join, ignore the email, or write to us and we’ll delete the invitation. If you’re a team member, the owner decides what you may use, so ask them; you can leave a workspace yourself on its Team page.

You can also complain to your local data protection authority, or to our lead authority, Malta’s Information and Data Protection Commissioner.

Content Uploader isn’t meant for children under 16, and our terms ask you to be at least 18. We don’t knowingly collect their personal data. If you think a child has given us personal data, contact us and we’ll delete it.

When our practices change, we’ll update this page and its “Last updated” date. If a change is significant, we’ll tell you by email or in the app before it takes effect.

Questions about this policy or your personal data? We’re happy to help.

Or write to us at: