Privacy Policy

1. Who We Are and What We Do

ContentChunky provides an AI-visibility and local content service. We research, write, and publish SEO and AI-optimised articles for local service businesses (such as chiropractors, law firms, dentists, and plumbers) so that they get named in AI answers (for example, ChatGPT and Perplexity) and improve their Google visibility over time.

For the purposes of UK data protection law, ContentChunky is the data controller for the personal data described in this policy. Where we handle a client's own customer or website data on their behalf as part of delivering the service, we act as a processor for that client, and that processing is governed by our agreement with the client rather than by this consumer-facing policy.

2. Scope of This Policy

This policy applies to:

• Visitors to our website;
• Clients and prospective clients who contact us, book a call, or purchase the service; and
• Businesses and business contacts we reach out to as part of our cold business-to-business marketing.

It does not cover third-party websites we link to, which have their own privacy policies.

3. Personal Data We Collect

Depending on how you interact with us, we may collect:

• Identity and contact data - name, business name, role, email address, telephone number, and postal or business address.
• Account and client data - billing details, plan selected, project details, target questions and keywords, and content approvals.
• Website usage data - pages viewed, time on page, referral source, clicks, scrolls, device and browser type, approximate location, and IP address (see Section 5).
• Communications data - emails, messages, call recordings, voicemails, SMS content, and call transcripts (see Sections 5 and 7).
• Prospect and marketing data - publicly available business-contact information collected for outreach (see Section 6).

4. How We Use Your Data and Our Lawful Bases (UK GDPR)

Where we rely on legitimate interests, our interest is in promoting and operating our business; we balance that against your rights and interests, and you have the right to object (see Sections 6 and 10).

5. Cookies, Analytics, and Consent

We use cookies and similar technologies on our website, including analytics and advertising tools. These tools are not strictly necessary. We display a cookie notice on the site, and these tools run by default so we can measure and improve how the site performs. You can opt out of them at any time using the Cookie Settings control on the site, and we honour the Global Privacy Control (GPC) browser signal, which we treat as an opt-out. We are a UK company; most of our visitors are businesses outside the UK.

The non-essential technologies we use are:

5.1 Google Analytics 4 (gtag)

Google Analytics 4 measures website usage and events. It uses online and device identifiers and may collect approximate location and IP address. Under our configuration, IP addresses are not retained in identifiable form. Data is shared with Google as a recipient. We use GA4 to measure traffic and improve site performance. We do not currently enable Google Signals or Google Ads data-sharing in GA4; if we enable either, we will update this policy to disclose it.

5.2 Meta Pixel (Facebook and Instagram)

We use the Meta Pixel, provided by Meta Platforms, Inc. (operator of Facebook and Instagram). The pixel loads Meta's code, sets cookies, and sends Meta information about your visit (for example, the pages you view and the fact that you visited). Meta may use this to measure and target advertising, including showing you our ads on Facebook and Instagram and building advertising audiences. This is advertising and retargeting technology. You can opt out using the Cookie Settings control on our site, and we honour the Global Privacy Control (GPC) signal as an opt-out (see Section 11.3 for how this is treated under US state law).

5.3 Your control over these tools

You can change or withdraw your consent to non-essential cookies at any time using the cookie settings control on the site, as easily as you gave it. Withdrawing consent does not affect processing carried out before withdrawal.

5.4 International transfers

Google and Meta may process data outside the UK. Where data is transferred outside the UK, we rely on an appropriate safeguard, such as a UK adequacy regulation or the International Data Transfer Agreement / Standard Contractual Clauses.

5.5 Cookie details

Our cookie banner and cookie settings provide the names, categories, purposes, durations (session or persistent), and first- or third-party status of the cookies and similar technologies we use, together with the named third parties (Google and Meta) and what each receives.

6. Prospect and Marketing Outreach Data

ContentChunky runs business-to-business (B2B) marketing outreach to businesses that may benefit from our service.

6.1 What we collect and from where

We collect publicly available business-contact data from public sources, including company websites, public business directories, and Google Maps / Google Business Profiles. The categories we collect are: business name, public business email address, website, telephone number, city, industry, and whether the business ranks for certain local searches. The telephone numbers we use for the voice and SMS outreach described in Section 7 are collected from these same public sources.

Because this data is collected from sources other than the individual directly, we provide this notice (under Article 14 of the UK GDPR) so that you are informed about how we obtained and use it, across both our email and our telephone and SMS outreach channels.

6.2 Lawful basis

We process this data on the basis of legitimate interests - specifically, our legitimate interest in marketing our AI-visibility and content service to relevant businesses that are likely to be interested in it. We have assessed this against the rights and reasonable expectations of the business contacts concerned, and we limit our outreach to business (not consumer) contacts. Under the Privacy and Electronic Communications Regulations (PECR), we direct unsolicited B2B marketing email at corporate bodies (such as limited companies and LLPs) and treat sole traders and unincorporated partnerships as requiring consent.

6.3 How we contact you and how to opt out

We may contact businesses by cold email (sent through Instantly), AI voice calls and voicemails, and SMS (via Vapi - see Section 7). Every marketing email contains a clear unsubscribe / opt-out, a valid reply address, and our physical postal address. You can ask us to remove your details and stop contacting you at any time, and we will honour that request and add you to our suppression list. To opt out or request removal, use the unsubscribe link in any message or email support@contentchunky.com.

6.4 Retention of prospect data

We keep prospect data only as long as needed for the outreach purpose, and we retain a record of opt-outs on a suppression list to ensure we do not contact you again.

7. AI Voice Calls, Voicemails, and SMS (Vapi)

As part of our outreach (Section 6) and client communications, we may make AI-assisted voice calls, leave AI voicemails, and send SMS messages using Vapi. The phone numbers used for outreach are obtained from the public sources described in Section 6.1.

• AI disclosure: Where we use an automated or AI voice assistant, we disclose at the start of the call that you are speaking with an automated or AI assistant.
• Recording and consent: Calls may be recorded. Where a call is recorded, we disclose this at the start of the call and obtain the necessary consent before recording continues. We apply all-party consent as our default so that everyone on the call is informed.
• What we collect: call audio and recordings, transcripts, phone number, call metadata, and SMS content.
• How we use it: sales and marketing outreach, communication with clients, quality and record-keeping.
• Opt-out: You can opt out of calls and texts at any time - reply STOP to any SMS, ask to be removed during a call, or email support@contentchunky.com. Opt-out requests are honoured promptly and permanently.
• Processors: Vapi processes this data on our behalf as a sub-processor (see Section 8).

8. Third Parties and Sub-Processors

We share personal data with the following service providers, who process it on our behalf or as recipients in order to deliver our service and run our business:

Some of these providers process data outside the UK. Where they do, we rely on an appropriate transfer safeguard (UK adequacy regulations, the International Data Transfer Agreement, or Standard Contractual Clauses). We do not sell your personal data.

9. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, accounting, or reporting requirements:

• Client account and billing data: for the duration of the engagement and for the period required by law afterwards.
• CMS credentials: stored encrypted and deleted within 30 days of final delivery.
• Website analytics data: retained according to the retention settings of the relevant analytics tool, after which it is deleted or aggregated.
• Prospect and marketing data: for as long as needed for outreach, with opt-out records retained on our suppression list.
• Call recordings, transcripts, and SMS: retained for quality and record-keeping for a limited period, then deleted.

10. Your Rights Under UK GDPR

If you are in the UK, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your data (the "right to be forgotten");
• Restrict processing in certain circumstances;
• Data portability for data you provided to us;
• Object to processing based on legitimate interests, including an absolute right to object to direct marketing at any time;
• Withdraw consent at any time where we rely on consent (such as cookies and analytics), without affecting prior processing.

To exercise any of these rights, email support@contentchunky.com. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk if you are unhappy with how we have handled your data.

11. Your Rights Under US State Privacy Laws (CCPA/CPRA)

This section applies to residents of California and, where relevant, other US states with comprehensive privacy laws, and only to the extent that those laws apply to us.

11.1 Categories of personal information

In the past 12 months we may have collected the following CCPA/CPRA categories: identifiers (such as name, email, phone, business contact details), commercial information (such as services purchased), internet or other electronic activity (such as website interaction and analytics data), and approximate geolocation.

11.2 Sources and purposes

We collect this information directly from you, from your use of our website, and from public sources (for prospect data - see Section 6). We use it for the business purposes described in this policy: providing the service, communicating with you, marketing, analytics, and meeting legal obligations.

11.3 Sale and sharing

We do not sell your personal information for money. However, our use of the Meta Pixel (Section 5.2) involves disclosing online activity data to Meta for advertising, which can constitute "sharing" for cross-context behavioral advertising as that term is defined under the CCPA/CPRA. You can opt out of this at any time using the Cookie Settings control on our site, and we honour the Global Privacy Control (GPC) browser signal as an opt-out of sale/share. Google Analytics 4, depending on configuration, may also be treated as "sharing"; the same Cookie Settings opt-out and GPC handling apply.

11.4 Your California rights

To the extent these laws apply to us, and subject to verification, California residents have the right to: know or access the personal information we hold and how we use it; delete it; correct inaccurate information; opt out of sale or sharing (we do neither); limit the use of sensitive personal information; and not be discriminated against for exercising these rights.

11.5 How to exercise your rights

Submit a request by emailing support@contentchunky.com. You may also use an authorised agent. Where these laws apply to us, we will acknowledge requests within 10 business days and respond within 45 days (extendable to 90 where permitted). We will take reasonable steps to verify your identity before responding.

12. Data Security

We use appropriate technical and organisational measures to protect personal data, including encryption of stored client and project data and CMS credentials. While no system is completely secure, we work to protect your data against unauthorised access, loss, or misuse.

13. Changes to This Policy

We may update this policy from time to time. When we do, we will revise the effective date at the top. Material changes will be communicated where appropriate, and changes to the purposes of cookies or analytics will be reflected in our cookie banner, which may re-prompt you for consent.

14. Contact Us

For any questions about this policy or to exercise your rights, contact:

ContentChunky

International House, 10 Beaufort Court, Admirals Way, London E14 9XL, United Kingdom

support@contentchunky.com