Privacy Policy

Autopilot (the "Service") is an AI content-automation workspace. This policy explains what personal data we handle, why, and the choices you have.

We collect and store the following:

• Account data: your name, email address, a salted hash of your password (never the password itself), role, and whether your email is verified.
• Workspace data: workspace names and settings, members and their roles, and the prompts, categories, content batches and per-platform versions you create or generate.
• Connected-account data: the platform accounts you connect and the access credentials you provide. Credentials are encrypted at rest and only used to publish and measure content on your behalf.
• Publishing and analytics data: post status, platform post IDs and links, and engagement metrics retrieved from the platforms you connect.
• Billing data: your plan, subscription status, usage counters, and Stripe customer and subscription identifiers. Card details are handled by Stripe and are not stored by us.
• Security and usage data: audit-log entries for sensitive actions (including actor, action, target, IP address and time), API-key usage counters, and short-lived, hashed rate-limiting counters.

We use a small number of strictly necessary cookies: a session cookie that keeps you signed in (HTTP-only, valid for up to 7 days) and a theme cookie that remembers your light/dark preference. We do not use advertising or third-party tracking cookies.

We use your information to:

• provide, secure and improve the Service;
• generate, adapt and publish content you configure, and report its performance;
• send transactional emails such as email verification and password resets;
• process subscriptions, enforce plan limits and prevent abuse.

To operate the Service we share the minimum necessary data with:

• AI providers configured for your deployment (for example DeepSeek, OpenAI, Anthropic, Google, Groq or Pollinations), which receive the prompts and instructions needed to generate content;
• Social platforms you connect (such as Facebook, Instagram, TikTok, X, YouTube, LinkedIn, Pinterest, Telegram and Discord), which receive the content you publish and return analytics;
• Stripe, for payment processing;
• our database, hosting and email-delivery providers.
• We do not sell your personal data.

Account and workspace data is kept while your account is active. Operational content logs are deleted automatically after 30 days. Rate-limiting counters expire within hours. When an account is deleted we remove its personal data, except where we must retain records for legal, security or billing reasons.

We protect data with HTTPS, salted password hashing, encryption of stored platform credentials and provider keys, HTTP-only session cookies, role-based access controls with workspace isolation, request rate limiting and audit logging. No system is perfectly secure, so we cannot guarantee absolute security.

You can update your name and password in your profile, revoke API keys, disconnect platform accounts at any time, and ask us to access, correct or delete your personal data by contacting the service administrator. Disconnecting an account removes its stored credentials from the Service.

The Service is not directed to children under 13 and we do not knowingly collect their data.

We may update this policy as the Service changes. We will change the "Last updated" date above when we do.

For privacy questions or requests, please contact the service administrator.