Privacy Policy

Last updated: July 10, 2026

This policy explains what data Content League (operated by GAINZ / Xander Parisella, "we," "us") collects, why, who processes it, and how you can see, export, or delete it. It covers this website (contentleague.io), the membership, and the Studio web app (studio.contentleague.io).

The short version

• We collect only what we need to run the membership and Studio.
• We never sell your personal data. Ever.
• Payments are handled entirely by Whop; we never see your card number.
• This website uses cookieless, anonymized analytics and no tracking cookies. An advertising pixel only runs if we ever advertise, and the cookies section below will say so before it does.
• You can export your data and delete your account yourself, from Studio Settings.

What we collect

• Account details from Whop: when you log in with your Whop account, we receive your name, email address, and Whop user ID so we can verify your membership and run your account.
• Your Instagram handle: the public handle you give Studio so it can work for you.
• Your public Instagram data: Studio fetches your publicly available Instagram content and metrics (posts, reels, captions, views, likes, comments counts, follower counts) on your behalf, and transcribes the audio of your reels. This is data that is already public on Instagram; Studio does not access private accounts, direct messages, or passwords.
• Competitor handles: the public Instagram accounts (up to 5) you choose to track, and the publicly available data of those accounts.
• Files you upload: CSV analytics exports from Meta that you choose to upload into Studio.
• AI assistant messages: if you use Studio's AI assistant (Cheatcode), we collect the messages you send it and the video links you ask it to analyze, so it can reply, keep your chat history, and enforce usage limits.
• Support emails: if you email us, we keep the correspondence so we can help you.
• Anonymized usage analytics: aggregate page-view statistics with no cookies and no personal identifiers (see "Cookies and analytics" below).
• Email signup: if we run an email list and you join it, we collect your email address to send you what you signed up for. Every email includes a working unsubscribe link.

What we never collect: your card or bank details (Whop handles all payment data), your Instagram password, or data from private accounts.

Why we use it

• To verify your membership and give you access to the course, community, and Studio.
• To provide Studio's features: fetching and displaying your metrics, transcribing your reels, tracking the competitors you chose, and processing the CSVs you upload.
• To answer support requests.
• To understand overall site usage (in aggregate, anonymously) and improve the product.
• To send you emails you asked for, and service messages about your account (like renewal or policy-change notices).

We do not build profiles of you for third parties, and we do not sell or rent personal data to anyone. If we ever enable an advertising pixel to measure our own ads, it is disclosed in "Cookies and analytics" below before it runs.

Our legal grounds, in plain words

• Contract: most processing happens because you bought a membership and we need the data to deliver it (account info, Studio data, billing status).
• Consent: you choose to connect your Instagram handle, upload CSVs, track competitors, and join any email list. You can withdraw that consent by removing the data or unsubscribing.
• Legitimate interests: keeping the service secure, preventing abuse, and measuring anonymous site usage.
• Legal obligation: keeping records we are legally required to keep, like basic transaction records.

Who processes it for us

We use a small set of service providers ("processors") to run the business. Each one handles data only to provide its service to us, under its own security and privacy commitments:

• Whop (whop.com): membership, checkout, payments, and login. Whop handles all payment data.
• Supabase: our database, where your Studio data is stored.
• Vercel: hosting for the Studio app.
• Cloudflare: hosting and delivery for this website and our domain.
• Apify: fetches publicly available Instagram data on your behalf.
• Groq: transcribes reel audio into text.
• Anthropic: powers Studio's AI assistant (Cheatcode). The messages you send the assistant and the content it analyzes for you are processed by Anthropic's Claude API to generate replies.
• Meta (only if and when we advertise): if we turn on the Meta pixel to measure ads for this website, Meta receives site visit and purchase events. It is currently off.
• Umami: cookieless, anonymized website analytics.
• Discord: hosts part of the members community. What you post there is also subject to Discord's own privacy policy.
• Kit (when active): email delivery, if and when we run an email list.

If we add or change a processor that handles personal data, we will update this page.

Cookies and analytics

• This website: no tracking cookies. Analytics run on Umami, which is cookieless and anonymized; it counts visits without identifying you. The Meta advertising pixel is currently OFF; if we ever enable it to run ads, it will set cookies and share visit and purchase events with Meta, and this section will be updated first.
• Studio: one essential session cookie that keeps you logged in. That is it. No advertising or cross-site tracking cookies anywhere.

How long we keep it

• Account and Studio data: kept while your membership is active, so the product keeps working for you.
• After you delete your account: your account and Studio data are deleted. Residual copies in encrypted backups are removed as those backups expire on a rolling basis.
• Support emails: kept as long as reasonably needed to handle follow-ups.
• Transaction records: kept as long as tax and accounting laws require.

Export and deletion, self-serve

You do not need to ask permission to leave. From Studio Settings you can export your data and delete your account at any time. Deleting your account deletes your data as described above. If you prefer, or if you never used Studio, you can also email us and we will handle export or deletion for you.

Your rights

Wherever you live, we honor these rights over your personal data. If you are in the EU, UK, California, or a similar jurisdiction, most of these are also your legal rights (under GDPR, UK GDPR, CCPA/CPRA, and similar laws):

• Access: ask what data we hold about you and get a copy.
• Correction: ask us to fix inaccurate data.
• Deletion: ask us to delete your data (or do it yourself in Studio Settings).
• Portability: get your data in a usable format (the Studio export does this).
• Objection and restriction: object to or limit certain processing.
• Withdraw consent: at any time, for anything based on consent.
• No sale or sharing: we do not sell personal data or share it for cross-context behavioral advertising, so there is nothing to opt out of.
• No discrimination: exercising your rights never affects the service you receive.

To exercise any of these, email us. We respond within 30 days. We may need to verify it is really you before acting. If you are in the EU or UK and believe we have not handled your data properly, you also have the right to complain to your local data protection authority.

Security

In plain language: connections to the site and Studio are encrypted (HTTPS), data is stored with established infrastructure providers, access to production data is limited to what is needed to run the service, and secrets and credentials are kept out of the codebase. No system is perfectly secure, but if we ever discover a breach affecting your personal data, we will notify you as required by law.

International transfers

Our processors are primarily based in the United States, so your data is processed and stored in the US regardless of where you live. Where laws like GDPR apply, our processors rely on recognized transfer safeguards (such as standard contractual clauses and data privacy frameworks) for these transfers.

Children

Content League is for adults. You must be 18 or older to join, and we do not knowingly collect data from anyone under 18. If we learn we have, we will delete it.

Changes to this policy

If we change this policy in a meaningful way, we will notify members (for example by email or a community announcement) and update the "Last updated" date above. Minor clarifications may be posted without separate notice.

Contact

Privacy questions or requests: email us.