Privacy Policy

Last updated: September 22, 2026

1. Introduction

SocialPilot AI ("we", "us", "our") respects your privacy. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have. It applies to all users of our platform, website, and services. This policy complies with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and other applicable privacy laws.

2. Information We Collect

Account information: your name, email address, and authentication data when you register or sign in via Google, Microsoft, or other supported providers.

Workspace & brand data: brand name, industry, website, country, target audience description, brand voice, goals, content categories, and other details you provide during onboarding.

Content: the media, text, topics, prompts, and files you upload or generate for analysis, optimization, and publishing. This includes AI-generated images and videos.

Social account data: platform handles, usernames, and connection status for social accounts you connect. We store credentials you enter manually (encrypted) but do not store OAuth tokens for platforms that require manual connection.

Usage data: how you interact with the Service, including features used, scheduling actions, publishing events, analytics queries, and device/browser information (IP address, browser type, operating system).

Payment data: processed securely by Base44 Payments (Wix). We receive transaction status, plan information, and billing email but do not store full card numbers, CVVs, or complete payment details.

Communications: support requests, feedback, and correspondence you send us.

3. How We Use Your Information

We use your information to: provide, operate, and improve the Service; analyze and optimize your content; schedule and publish to your connected accounts; generate AI-powered images, videos, and content suggestions; process payments and manage subscriptions; send you account, security, and service-related communications; ensure security, prevent fraud and abuse; comply with legal obligations; and aggregate and anonymize data for analytics and product improvement.

4. Legal Basis for Processing (GDPR)

Where EU/UK law applies, we process your data on the following legal bases:

• Contract — to provide the Service you requested (account creation, content processing, publishing, payments).
• Legitimate interests — for security, service improvement, fraud prevention, and analytics (where balanced against your rights).
• Consent — for optional analytics, marketing communications, and non-essential cookies. You can withdraw consent at any time.
• Legal obligation — where required by law, regulation, or court order.

5. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect about you and how it is used or shared.
• Delete your personal information, subject to legal exceptions.
• Opt out of the "sale" or "sharing" of your personal information. We do not sell your personal information.
• Limit the use of sensitive personal information to purposes necessary to provide the Service.
• Non-discrimination — we will not discriminate against you for exercising your privacy rights.

To exercise these rights, contact us through the app or our support team. We will verify your identity before processing requests and respond within 45 days.

6. AI & Third-Party Processing

To analyze content and generate suggestions, we use AI and large language model providers who process data on our behalf as subprocessors. These providers may be located outside the EU/UK. We do not use your prompts, uploaded content, or AI-generated images/videos to train models for the benefit of third parties. Social platform integrations transfer data to those platforms under their own privacy policies, which we encourage you to review.

7. Cookies & Tracking Technologies

We use cookies and similar technologies for:

• Essential — authentication, session management, and security.
• Functional — remembering your preferences and settings.
• Analytics — understanding how the Service is used (only with your consent where required).
• Marketing — measuring the effectiveness of campaigns (only with your consent).

You can manage cookie preferences through your browser settings. See our Cookie Policy for details.

8. Data Sharing & Subprocessors

We share data only with service providers who support our operations under contracts that require confidentiality and data protection:

• Hosting & infrastructure — cloud hosting providers for data storage and compute.
• AI processing — large language model and image/video generation providers.
• Payments — Base44 Payments (Wix) for subscription billing.
• Analytics — usage analytics providers.
• Email — email delivery services for transactional and account messages.

We never sell your personal data. We may disclose information when required by law, to protect our rights and safety, or in connection with a merger, acquisition, or asset sale (in which case we will notify you).

9. Data Retention

We keep your data as follows:

• Active accounts — for as long as your account is active and as needed to provide the Service.
• After account closure — we retain data for up to 90 days to complete operations, resolve disputes, and comply with legal obligations, then delete it.
• Payment records — retained as required by tax and financial regulations (typically 5–7 years).
• AI-generated content — retained in your Content Library until you delete it or close your account.
• Usage logs — retained for up to 24 months for security and analytics, then aggregated or deleted.

You can request earlier deletion of your data at any time, subject to legal retention requirements.

10. Data Security

We use reasonable technical and organizational measures to protect your data, including:

• Encryption in transit (TLS/SSL) and at rest where applicable.
• Access controls limiting data access to authorized personnel only.
• Regular security reviews and monitoring.
• Secure payment processing through certified providers (we do not store full card details).

No method of transmission or storage is 100% secure. We cannot guarantee absolute security but work to protect your information using industry-standard practices.

11. Your Rights (GDPR & Other Jurisdictions)

Where applicable, you have the right to:

• Access — request a copy of your personal data.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your data ("right to be forgotten").
• Restriction — request that we limit processing of your data.
• Objection — object to processing based on legitimate interests.
• Data portability — receive your data in a structured, machine-readable format.
• Withdraw consent — withdraw consent for processing based on consent at any time.
• Lodge a complaint — with your local data protection authority.

You can exercise these rights from your account settings or by contacting us. We will verify your identity and respond within 30 days.

12. International Data Transfers

Your data may be processed in countries other than your own, including the United States and EU member states. Where this involves a transfer to a non-adequate jurisdiction, we use appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission, or rely on applicable adequacy decisions. We will inform you of any changes to transfer mechanisms.

13. Children's Privacy

The Service is not intended for children under 16 (or the digital-consent age in your country). We do not knowingly collect personal data from children. If you believe a child has registered or provided personal data, contact us and we will promptly delete the account and associated data.

14. Sensitive Information

We do not knowingly collect or process sensitive personal information (such as health data, racial or ethnic origin, religious beliefs, or biometric data) unless necessary to provide the Service and permitted by law. If you inadvertently submit such information, contact us to request its deletion.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service features. We will notify you of material changes through the app or by email. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

16. Contact

Privacy questions or requests? Contact our support team through the app or our contact page. For data protection inquiries, you may also contact your local data protection authority.