Privacy Policy

1. Who We Are

Contentglitch404 is a content automation build service provided by Sophfree, the trading name of Sophie Sherwin, a sole trader.

Address: 4th Floor, Silverstream House, 45 Fitzroy Street, Fitzrovia, London W1T 6EB

Contact: studio@contentglitch404.com

Sophie Sherwin, trading as Sophfree, is the data controller for personal data collected through this website and its services. In this policy, "we", "I" and "Sophfree" all refer to Sophie Sherwin trading as Sophfree.

2. Who This Policy Applies To

This policy applies to:

• Visitors to contentglitch404.com
• Individuals who submit an application form
• Visitors who request a Red Bucket content pack, including at events such as Web Summit
• People who leave their contact details for us at events, for example by scanning a QR code at our Web Summit stand
• Clients who purchase and use Sophfree's services

Sophfree's services are intended for individuals aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected data from a minor, please contact us immediately at studio@contentglitch404.com.

3. What Data We Collect

3.1 Application Forms

• First name and email address
• Business description and content goals
• Any other information voluntarily submitted in free text fields
• If you choose the Say it option on the application form, your voice recording, made through SpeakPipe, and the written transcript of it

3.2 Red Bucket Content Packs

• First name and email address
• Your website address, and the publicly available text on your homepage, which the system reads to understand your business
• An optional one-line description of what you do
• Your random thought, and an optional colour choice
• Whether you would like to receive follow-up emails from us
• The content pack generated for you

3.3 Event Contact Details

• Your name, if you choose to give it
• Your email address or WhatsApp number
• Where you found us, for example the QR code on our stand

3.4 Messages and Voice Notes

• Messages and voice notes you send us by email, WhatsApp or Telegram, including support requests
• Where we transcribe a voice note to act on it, the transcript

3.5 Client Briefs and Onboarding

• Business information, brand details, audience descriptions
• Content briefs submitted through your brief form
• If you choose the Video Add-on: your face, likeness and voice where they are used to create an avatar or voice, the scripts generated, and any footage, images or audio you supply

Your system is built in your own accounts. Once it has been handed over, the content and data it processes are under your control, and we only access them when you make a support request.

3.6 Client Agreements

• When you sign your client agreement on our website: your full name as typed, your business name if given, your address and email address
• The version of the agreement you signed, the date and time you signed it, and confirmation that you ticked the declaration
• A copy of the signed agreement, which is emailed to you and to us

3.7 Payment Information

• Card payments are processed by Stripe. Sophfree does not store card numbers or full payment details.
• If you pay by bank transfer, we receive the name on the account, the payment reference and the amount from our bank, and we send you an invoice for that payment.
• We retain records of payment amounts, dates and invoices for accounting purposes.

3.8 System Access Credentials and API Keys

• With your consent, I may store login credentials, API keys, and access tokens for third party tools required to deliver and support the build.
• All credentials and keys belong to you. They are held solely for the purpose of building and supporting your system during the agreed service period.
• Credentials and keys are transferred exclusively via Bitwarden Send, a self-destructing encrypted link that expires after a single use. They are never shared by email or any unencrypted method.
• Once received, credentials and keys are stored exclusively in an encrypted Bitwarden vault. They are never stored in email, spreadsheets, or unencrypted documents.
• You choose at onboarding whether to provide stored credentials or to supply temporary access on a per-request basis.
• I will not access your system unless a support request has been made.
• All stored credentials and API keys are permanently deleted at the end of the 6-month support window. You will be reminded to rotate your credentials and regenerate API keys at offboarding.

4. Why We Collect It and Our Legal Basis

Contractual necessity

To deliver the services agreed, including recording your signed client agreement, and building, configuring, and handing over your content automation system.

Legitimate interests

To respond to applications, to create and email the Red Bucket content pack you asked for, to get back to you when you leave your details for us at an event, to respond to messages and support requests, to assess suitability for our services, and to improve how we deliver those services.

Legal obligation

To maintain financial records as required by law.

Consent

Where I contact applicants or Red Bucket visitors with follow-up information about Sophfree's services, I do so on the basis of consent. Asking for a Red Bucket pack does not sign you up to anything; follow-ups are only sent if you tick the separate box on the form. You can withdraw consent at any time by emailing studio@contentglitch404.com or replying "unsubscribe" to any email.

5. How Long We Keep Your Data

• Application data, including any voice recording and transcript, and data from our earlier free trial: up to 12 months from submission, unless you ask us to delete it sooner.
• Red Bucket submissions and packs: up to 12 months from submission, unless you ask us to delete them sooner.
• Client data and project files: for the duration of the contract plus 12 months after the support window closes.
• System access credentials and API keys: deleted at the end of the 6-month support window.
• Signed client agreements: 6 years after the agreement ends, in case either of us needs to refer back to it.
• Payment records and invoices: 6 years, as required by HMRC.
• Event contact details: up to 12 months from when you gave them, unless you ask us to delete them sooner.
• Support messages, voice notes and transcripts: kept for the support window and deleted when it closes.

6. Who We Share Your Data With

Sophfree does not sell your data. We share data only where necessary to deliver our services, with the following third party tools:

• Airtable, data storage and workflow management, including signed client agreements and support records
• Neon, database storage for event contact details and some website forms
• SpeakPipe, recording voice notes left through the Say it option on the application form
• n8n, workflow automation
• OpenAI, image generation, voice transcription and first drafts of video scripts
• Anthropic (Claude), content generation, brief extraction, Red Bucket packs and the support assistant on our support page
• Cloudinary, branded image creation
• HeyGen, ElevenLabs, Runway and Amazon Web Services, video creation for clients who choose the Video Add-on
• IONOS and Resend, email delivery
• Meta (WhatsApp), and Telegram, for messages and support voice notes you send us
• Meta, advertising measurement through the Meta Pixel on our homepage (only if you accept cookies)
• Vercel, website and form hosting, including the agreement signing page
• Buffer, social media scheduling
• Stripe, payment processing
• Bitwarden, encrypted credential and API key storage

All third party tools are subject to their own privacy policies. Several of these tools are based in the USA. Where tools are based outside the UK or EEA, we rely on adequacy decisions (including the UK and EU data bridges with the USA where the provider is certified) or standard contractual clauses.

Sophfree may also use employees or contractors to help deliver its services. They only access the personal data they need for their work and are bound by the same confidentiality and data protection obligations as Sophfree.

7. Your Rights

Under UK GDPR, and the EU GDPR if you are in the EU, you have the following rights regarding your personal data:

• Right of access: you can request a copy of the data we hold about you.
• Right to rectification: you can ask us to correct inaccurate data.
• Right to erasure: you can ask us to delete your data, subject to any legal obligations we have to retain it.
• Right to restriction: you can ask us to limit how we use your data.
• Right to data portability: you can ask for your data in a portable format.
• Right to object: you can object to processing based on legitimate interests.
• Right to withdraw consent: where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, contact us at studio@contentglitch404.com. We will respond within 30 days.

8. Complaints

If you have a concern about how we handle your data, please contact us first at studio@contentglitch404.com and we will do our best to resolve it.

If you remain unsatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. If you are in the EU, you can also complain to the data protection authority in the country where you live or work.

9. Cookies

Our homepage uses basic cookies for functionality and, if you accept them, the Meta Pixel to measure how our adverts perform. You can accept or decline through the banner on the homepage. The Red Bucket and event contact pages do not use tracking or advertising cookies.

10. Changes to This Policy

We may update this policy from time to time. The current version will always be available at contentglitch404.com/privacy. Where changes are material, existing clients will be notified by email.