Privacy Policy

Last updated: February 14, 2026

1. Introduction

This Privacy Policy describes how gardenpatch ("Company", "we", "us") collects, uses, and protects information through the Chamomile content automation platform ("Service"). We are committed to protecting your privacy and handling your data responsibly.

2. Information We Collect

2.1 Account Information

  • Authentication credentials (admin tokens, API keys)
  • Tenant configuration data (organization name, domain, branding)

2.2 Content Data

  • Topics, briefs, and articles created through the Service
  • Generated images and metadata
  • Publishing history and workflow states

2.3 Integration Data

  • Data synchronized from Notion databases
  • WordPress site information and publishing data
  • Google Search Console performance data
  • Google Analytics data (when enabled)

2.4 Usage Data

  • Server logs (request timestamps, endpoints accessed, response codes)
  • Workflow execution metrics
  • Error logs for debugging and service improvement

3. How We Use Your Information

  • Service Delivery: To operate the content automation pipeline, generate content, and publish articles on your behalf.
  • Performance Optimization: To analyze content performance and provide optimization recommendations.
  • Service Improvement: To diagnose issues, improve reliability, and develop new features.
  • Communication: To send service-related notices and respond to support requests.

4. Data Isolation

Chamomile is a multi-tenant platform with strict data isolation:

  • Each tenant's data is stored in isolated database partitions.
  • All database queries are scoped by tenant ID.
  • In-memory caches are tenant-scoped.
  • API keys and secrets are encrypted and stored per tenant.
  • No tenant can access another tenant's data through the Service.

5. Third-Party Data Sharing

We share data with third parties only as necessary to provide the Service:

  • AI Providers (OpenAI, Anthropic): Content prompts and context are sent to AI models for content generation. These providers process data per their respective privacy policies.
  • Notion: Topic and page data is synchronized with your Notion workspace.
  • WordPress: Published content is sent to your WordPress site.
  • Google: We access Google Search Console and Analytics data via authenticated APIs.
  • Vercel: Content may be deployed through Vercel for static site hosting.

We do not sell your personal data to third parties.

6. Data Security

  • All data in transit is encrypted via TLS (HTTPS).
  • API keys and secrets are encrypted at rest.
  • Admin access requires authentication tokens.
  • Rate limiting and CORS policies protect against abuse.
  • HSTS headers enforce secure connections.
  • Regular security audits and dependency vulnerability scanning.

7. Data Retention

  • Active accounts: Data is retained for the duration of your service agreement.
  • Terminated accounts: Data is retained for 30 days after termination, then permanently deleted.
  • Server logs: Retained for up to 90 days for debugging and security purposes.
  • Backups: Maintained for disaster recovery and deleted on a rolling 30-day schedule.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access and receive a copy of your data.
  • Request correction of inaccurate data.
  • Request deletion of your data.
  • Object to or restrict certain processing activities.
  • Data portability — receive your data in a structured, machine-readable format.

To exercise these rights, contact us at hello@gardenpatch.xyz.

9. Cookies and Tracking

The Service uses a minimal authentication cookie (chamomile_admin_token) for dashboard access. This is a functional cookie required for the Service to operate. We do not use third-party tracking cookies or advertising pixels.

10. Children's Privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect data from children.

11. International Data Transfers

The Service is hosted in the United States. If you access the Service from outside the United States, your data will be transferred to and processed in the United States.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the Service or email. The "Last updated" date at the top reflects the most recent revision.

13. Contact

For privacy-related questions or requests, contact us at hello@gardenpatch.xyz.