Privacy & GDPR
What personal data Obelism Content stores and where it goes, so you can complete your own privacy policy, records of processing and DPA.
This page describes what data Obelism Content stores about the people who edit your content, what it does (and doesn't) see of your website's visitors, and which services process it. Use it to fill in your own privacy policy, records of processing and data processing agreement.
Watch out
This is a technical description of data flows, not legal advice. Review it with your own counsel before you rely on it in a privacy policy or DPA.
Your content is your data
Everything you put into Content (entries, rich text, asset files, alt text and titles, names and paths) is stored as you wrote it. Content doesn't inspect it for personal data. For that content, your organization is the controller and Obelism processes it on your behalf.
If your content includes personal data, such as a team page with names and photos, or a testimonial with a customer's name, treat it like any other personal data you hold: you decide what goes in, and you remove it when you have to (see deleting content).
Your website's visitors
Content doesn't track the visitors of your site. The delivery API stores nothing about who asked for content: no IP address, no cookie, no visitor id. For each API token it keeps only when it was last used.
Two kinds of request can still reach Content from a visitor's browser:
- Asset files (
/files/{id}/{name}) are served fromcontent.obelism.studio, so a visitor's browser loads your images and files from there. Content sets no cookies on these responses. - Delivery API calls made from the browser with a delivery token, if your site works that way rather than calling the API from your server.
Like every request to a Cloudflare Worker, these pass through Cloudflare and are kept in Content's request logs (Workers Logs). Content's own database stores nothing about them.
People who edit your content
Accounts, organizations and memberships are shared by every Obelism product and live on www.obelism.studio: signing in, sign-up and the profile happen there, not in Content. Content reads the same session cookie (obelism_session, set on .obelism.studio) and the same tables.
What Content itself stores about editors:
| Data | What it is | Kept |
|---|---|---|
| Author ids | The user id of who created or last changed an entry, a content type, an asset, an API token or a webhook | As long as the item exists |
| Version history | Every save and every publish stores a version of the entry, with its content, time and the user id who made it | The entry's newest 100 versions, as long as it exists |
| Site sessions | When someone signs in to edit on your own site: their user id, the space, the redirect URI and a hashed token | 8 hours; ended sessions are cleared the next time that person signs in on a site |
| Preview tokens | The read-only token the canvas gives your site: the user id and a hashed token | 8 hours; expired tokens are cleared whenever a new one is made |
| MCP connections | OAuth grants and hashed tokens for AI tools connected to Content at /mcp | In Cloudflare KV |
| Rate limit counters | Prompts and agent API calls counted per user id, per minute | Per minute, in Cloudflare |
Tokens are stored only as SHA-256 hashes. The dashboard and the agent API show an editor's name or email address next to versions by reading it from the shared account; Content doesn't copy it.
If an account is removed, the author ids that pointed at it are cleared, and its site sessions and preview tokens are deleted. The content and versions themselves stay.
Prompts
When an editor edits by prompt or writes a new page by prompt, Content sends a request to a language model with:
- the editor's prompt,
- the entry or selected block in one locale (rich text as Markdown), or, for a new page, its path, content type and an existing page as an example,
- the content type definitions involved.
It doesn't send the editor's name, email address or user id. Prompts and answers aren't stored in Content's database; the answer becomes an unsaved draft, which the editor saves or discards.
Where the request goes:
- Workers AI (Cloudflare), by default.
- Your own prompt endpoint, when you set one under Settings → Preview and site → Prompt editing. Then the request goes to your server instead, signed with your endpoint's secret, and whatever model you call there is your own sub-processor, not Obelism's.
If your content holds personal data, it can be part of what is sent. Choose your own endpoint if it shouldn't reach Workers AI.
Webhooks
Webhooks send to the URL you configure. Their payloads carry ids, names and paths, never entry content: for an entry its id, content type, name and path; for an asset its id and file name; for model and locale changes the content type ids and locale codes. Deliveries, with their payloads, are kept for 30 days.
Deleting content
- Entries: deleting an entry deletes it with its version history in that environment.
- Assets: deleting an asset removes its file from storage. An asset still used by any entry, draft or published, in any environment, can't be deleted until it's removed there first. Asset URLs are public to anyone who has them and may be cached by browsers for up to a year, so a copy can outlive the deletion there. Cloudflare's edge keeps its copy for up to a day.
- Organizations: deleting an organization (on www) stops its delivery API, dashboard and editing at once. Thirty days later its spaces are removed with all their content, versions and files.
- Versions: there's no way to delete single versions yet. To remove personal data from an entry's history, delete the entry, or contact us.
Data retention
Content has no automatic retention limit for content, assets or version history: they stay until you delete them. Webhook deliveries are kept for 30 days. If your privacy policy commits to a retention period, contact us and we'll help enforce it.
Sub-processors & data residency
| Service | Used for | Where |
|---|---|---|
| Cloudflare Workers | Runs Content, its API and its dashboard; request logs and traces | Cloudflare's global network, at the location nearest the request |
| Cloudflare Hyperdrive | Connection pooling between the Worker and the database | Cloudflare's global network |
| Cloudflare R2 | Uploaded asset files | Cloudflare |
| Cloudflare KV | The session cache, cached delivery API responses (1 hour) and MCP OAuth grants | Cloudflare's global network |
| Cloudflare Images | Resizing images on asset URLs (?w=…) | Cloudflare's global network |
| Cloudflare Workers AI | Prompt editing, unless you set your own prompt endpoint | Cloudflare's global network |
| PlanetScale | The PostgreSQL database: content, the model, versions, accounts and organizations | Frankfurt, Germany (AWS eu-central-1) |
Content shares its database with Improve and www.obelism.studio.
For a current, complete sub-processor list or a signed DPA, contact us at hello@obelism.studio.
Checklist for your own privacy policy
- List Obelism as a processor for the content you store in Content, and the sub-processors above.
- Check whether your content holds personal data (names, photos, quotes) and how you'd remove it on request, including from version history.
- Decide whether prompts may go to Workers AI, or set your own prompt endpoint.
- If your site serves asset files from
content.obelism.studio, note that visitors' browsers request them from Obelism, through Cloudflare. - Note that each entry keeps its newest 100 versions; factor that into your own retention commitments.