Privacy Policy
This policy explains what CCS Investing LLC ("we", "us") collects when you use Growth Engine (the web and phone app at app.ccsinvesting.com), this website, and the AI Side Hustle Blueprint, and what we do with it. We keep it short and specific; if anything is unclear, write to hello@ccsinvesting.com.
1. What we store
| Data | Why | Where it lives |
|---|---|---|
| Account: email address, display name, sign-in events | To create and secure your account | Supabase (authentication and database) |
| Brand text: your Brand Lock, hook bank, scripts, captions, hashtags, Trial Reels plans and the metrics you log | This is the product — your content system | Supabase (database, row-level security) |
| Uploaded images and videos: reference images of your own likeness, media attached to posts | To build prompts, run the QC gate and assemble post kits | Supabase Storage (private bucket, signed links only) |
| Your Google Gemini API key | So the app can call Gemini on your behalf | Encrypted with AES-256-GCM before it is stored; the key used to encrypt it lives only in our hosting environment. The app can show you the last four characters, never the key. |
| Billing status: plan, subscription status, renewal date, Stripe customer id | To know what you have paid for | Stripe holds the payment details; we store only the status mirror. We never see or store card numbers. |
| Usage events: which AI feature you used, the model, token counts, timestamps | Support, abuse prevention and future fair-use limits | Supabase (database) |
| Waitlist and email: the address you give us on ccsinvesting.com, your Instagram handle if you add it | Launch and product emails you asked for | Resend (audiences and email delivery) |
| Blueprint purchase: name, email, order id | To deliver the PDF and re-send your link | Stripe (payment) and our delivery function on Netlify |
We do not collect precise location, contacts, or advertising identifiers, and we do not run third-party advertising or analytics trackers on the app. The only cookies are the ones needed to keep you signed in.
2. Who processes it for us
- Netlify — hosts the website, the app and its serverless functions.
- Supabase — authentication, database and file storage (AWS, US West region).
- Stripe and Link — subscription billing. Under Stripe's Managed Payments, Stripe/Link is the merchant of record: it charges your card, calculates sales tax or VAT, sends receipts and handles disputes. Their privacy policy applies to the payment itself.
- Resend — transactional and launch email from ccsinvesting.com addresses.
- Google (Gemini API) — all AI text is generated with your own Gemini key, under your Google account and Google's terms. The text you send to Gemini (Brand Lock, scene, script request) goes to Google when you use those features.
- Meta / Instagram — only in the future in-app publishing feature, and only after you connect your account and approve the permissions. Until then the app never contacts Instagram; you post from your phone yourself.
We do not sell personal information and we do not share it with anyone else, except when the law requires it.
3. How long we keep it
- Account, brand text, uploads and keys: for as long as your account exists.
- After you delete your account (see Data deletion): live data is erased immediately and leaves our backups within 30 days.
- Billing records: Stripe keeps the records it must keep for tax and accounting; we keep the subscription status mirror for 7 years as accounting evidence, with no card data.
- Waitlist and email: until you unsubscribe (every email has a link) or ask us to remove you.
- Server logs with IP addresses: 30 days, for security.
4. Your rights
You can see and edit everything we store about you inside the app, export your Trial Reels data as CSV, and delete your account yourself. You can also email hello@ccsinvesting.com from your account address to ask for a copy of your data, a correction, or deletion; we answer within 30 days. If you are in California, the CCPA gives you the right to know, delete and opt out of sale — we do not sell personal information — and we will not treat you differently for exercising those rights. If you are in the EU or UK, the GDPR rights to access, rectification, erasure, portability and objection apply, and you may complain to your local supervisory authority.
5. Security
Everything travels over HTTPS. Database rows are protected by row-level security so an account can only read its own data; uploaded files are served through short-lived signed links; API keys are encrypted at rest; secrets live only in our hosting providers' vaults. No system is perfect — if we learn of a breach that affects you, we will tell you by email without undue delay.
6. Age
Growth Engine and the Blueprint are for adults. You must be 18 or older to create an account or buy from us. We do not knowingly collect data from anyone under 18; if you believe we have, email us and we will delete it.
7. Changes and contact
If we change this policy in a way that matters, we will email account holders before it takes effect and update the date at the top. Questions: hello@ccsinvesting.com · CCS Investing LLC, 415 Herondo St, Hermosa Beach, CA 90254, United States.
This page is written in plain language on purpose. It is not legal advice to you, and it will be reviewed by counsel before the Founding 50 seats open.