Privacy Policy

Last updated: October 8, 2026

This Privacy Policy explains how Autopilot Digital (“we,” “us,” or “our”) collects, uses, and protects your information when you use our service. We are committed to handling your data responsibly and transparently.

1.Information We Collect

We collect only the information we need to provide the service:

• Account information — your name and email address, provided when you create an account.
• Social account tokens — secure access tokens issued by connected platforms (such as Meta, TikTok and Google) when you authorize Autopilot Digital to act on your behalf. These tokens let us act on your accounts as you’ve authorized; we do not receive or store your platform passwords.
• Content you create — the posts, captions, media, and scheduling details you produce within the service.
• Billing information — handled by our payment processor (Stripe). We do not store your full card details on our servers.
• Usage data — basic technical and usage information needed to operate, secure, and improve the service.

2.How We Use Your Information

We use your information to:

• Post content on your behalf — the core purpose of the service is to create, schedule, and publish your content to the social platforms you connect.
• Authenticate you and maintain your account;
• Process subscription payments and send service-related communications;
• Provide support, and operate, secure, and improve the service.

Account access by our team. Autopilot Digital staff may open your dashboard account, including your brand settings, photos and posts, only when you’ve asked us to, to provide the managed service, setup or support, or where needed for security or to comply with the law. We never see or ask for your password.

3.How We Share Information

We do not sell your personal data. We do not rent or trade it. We share information only with the service providers needed to run Autopilot Digital, and only to the extent necessary.

Running your account

• Supabase — database, authentication and file storage. Your account details, posts, captions, uploaded photos, video clips and music are stored here.
• Render — hosts the application server that processes your content.
• Vercel — hosts this website and the client dashboard.
• Stripe — payment processing for subscriptions. We do not store your full card details on our servers.
• Resend — sends service and account emails, so it receives your email address and the text of new Google reviews when we alert you about one.

Creating your content

Generating posts means sending parts of your content to specialist providers. We send each one the minimum it needs:

• Anthropic (Claude) — writes captions and hashtags. It receives text only: your business name, niche, tagline, tone, products and services, promotions, and the post topic. It also receives discovery-call notes when we build your Brand Hub, and anything you type into the chat widget on this site. Your photos are never sent to Anthropic. If you use website autofill, it also receives text from your public website (such as your home and About pages, page title and description) so it can suggest Brand Hub details for you.
• Cloudflare — when we read your website for autofill and the page needs a full browser to load, Cloudflare’s Browser Run service opens your public web address and sends the page text back to us. It receives only your website’s address and the public page it loads.
• fal.ai — generates images from a written description. It receives that text prompt only. Your own uploaded photos are never sent to fal.ai.
• OpenAI — transcribes audio for video subtitles, and only when you press “Add Subtitles”. We extract the audio track and send that alone, never the video itself.
• Rendi — renders finished videos. It receives your video clips, any text overlays, and any music you add.

Website autofill only reads public pages of the website you give us. We don’t save the page text; we use it once to suggest details, and nothing is added to your Brand Hub until you review it and press Save.

Publishing

• Meta (Facebook / Instagram) and TikTok — the platforms you connect, so we can publish your content to them on your behalf.
• Google Business Profile — only if you connect it. With your permission we use Google’s Business Profile APIs to publish, edit and delete posts on your listing, and to read your reviews and post, edit or delete your replies. We also read your listing’s performance numbers (such as how often it appeared in Google Search and Maps, and the calls, direction requests and website clicks it received) and the search terms people used to find it, so we can show them in your dashboard. We hold these only in temporary memory on our server and never save them to our database. When you use our listing tools, we update your listing’s phone numbers, website, description, and opening and holiday hours, and add the photos you choose, only when you ask us to. We keep a record of each change, including the old and new values, so you can see your listing’s history. We store the access tokens Google issues, your Google account and location IDs, the IDs of posts we publish for you, and, for each review, its ID, star rating and date, so we only alert you about a new review once. Review text is shown in your dashboard and included in the new-review emails we send you through Resend; we do not otherwise store it. We never sell Google user data, use it for advertising, or use it to train AI models, and we do not send it to our AI providers. Autopilot Digital staff view your Google data only when you’ve asked us to, for the managed service or support, or where needed for security or to comply with the law.

Autopilot Digital’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

This website

These apply to anyone visiting autopilotdigital.ca, whether or not you have an account:

• Microsoft Clarity — records page interactions and heatmaps so we can see where the site confuses people.
• Meta Pixel — measures which visits came from our ads.
• Formspree — receives the details you enter into our enquiry form, such as your name, email and business.
• Google Fonts — serves the site’s typefaces, which means Google receives your IP address when a page loads.
• HeyCatch — records page visits, clicks and the fact that a form was submitted (not what you typed into it), along with your IP address and device details, so we can see how people move through the site. Data is stored in the United States and deleted or anonymised two months after we stop using the service.
• PostHog (used by HeyCatch) — stores those visit and interaction events on HeyCatch’s behalf, in the United States. Session replay is disabled.
• OpenRouter (used by HeyCatch) — receives analytics data when HeyCatch uses AI to summarise it, and passes it to third-party AI model providers. Those providers are contractually barred from training on it.

Most of these providers are based in the United States, so your information may be stored and processed outside Canada, where it is subject to the laws of those countries.

Each of these providers maintains its own privacy and security practices. We may also disclose information if required by law or to protect the rights, safety, and security of our users and the service.

4.Data Storage & Security

Your data is stored with our infrastructure providers using industry-standard safeguards. Social account tokens are stored securely and used only to perform the actions you authorize. While no system can be guaranteed perfectly secure, we take reasonable technical and organizational measures to protect your information.

5.Data Retention

We retain your information for as long as your account is active or as needed to provide the service. When you close your account, we will delete or anonymize your personal data within a reasonable period, except where we are required to retain it to comply with legal, accounting, or regulatory obligations.

6.Your Rights

You may access, correct, or request deletion of your personal information, and you may disconnect any connected social account at any time, which revokes the associated token. For Google Business Profile, disconnecting asks Google to revoke our access. You can also remove our access yourself at any time at myaccount.google.com/permissions. To exercise these rights, contact us at hello@autopilotdigital.ca.

7.Governing Law

Autopilot Digital is based in British Columbia, Canada, and this Policy is governed by the laws of British Columbia and the applicable federal laws of Canada, including the Personal Information Protection and Electronic Documents Act (PIPEDA). By using the service, you understand your information will be processed in accordance with this Policy.

8.Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the “Last updated” date above and, where appropriate, notify you. Continued use of the service after changes take effect constitutes acceptance of the revised Policy.

9.Contact

Questions about your privacy or this Policy? Reach us at hello@autopilotdigital.ca.