Privacy Policy

1. Who we are

BrandPilots ("we", "us", "our") operates the social media management platform available at https://brandpilots.io. This policy explains what data we collect, how we use it, and your rights.

Questions? Email us at hello@brandpilots.io.

2. Data we collect

Account data

When you create an account we collect your name, email address, and a hashed password (or a Google OAuth token if you sign in with Google).

Brand and workspace data

Content you create inside BrandPilots — brand guidelines, posts, captions, images, campaign data, and scheduling information — is stored in your workspace and associated with your account.

Social media connection data

When you connect a social media account (Facebook, Instagram, Pinterest, LinkedIn), we receive and store:

• An OAuth access token issued by that platform
• Your platform user ID and display name
• For Facebook/Instagram: page names and page access tokens for pages you manage
• For Instagram: your Instagram business account username

We never store your social media password. Access tokens allow BrandPilots to publish content on your behalf. You can revoke access at any time from both BrandPilotsSettings and the respective platform's app settings.

Usage and log data

We collect standard server logs (IP address, browser type, pages visited, timestamps) for security and debugging purposes. This data is retained for 30 days.

Payment data

Billing is handled by Stripe. We do not store credit card numbers. We receive and store your Stripe customer ID and subscription status.

3. How we use your data

• To provide and operate the BrandPilots service
• To publish content to your connected social media accounts when you request it
• To generate AI-powered content tailored to your brand guidelines using third-party AI providers (Anthropic, OpenAI)
• To send transactional emails (account verification, billing receipts)
• To detect and prevent fraud, abuse, and security incidents
• To comply with legal obligations

We do not sell your data. We do not use your content to train AI models. We do not share your data with third parties except as described in Section 4.

4. Third-party services

We share data with the following services to operate BrandPilots:

5. Facebook and Instagram data

BrandPilots uses the Facebook Graph API to connect your Facebook Pages and Instagram Business accounts. By connecting these accounts you grant BrandPilots permission to:

• Read your Page and Instagram account information
• Publish posts, images, and videos to your Page and Instagram account
• Read engagement data (likes, comments, reach) from your published posts

Data deletion: You can disconnect your Facebook or Instagram account at any time in BrandPilots Settings → Social Accounts → Disconnect. A confirmed disconnect removes that stored connection and token. Deleting a personal account does not remove social connections or content owned by a shared organization; ownership and connections must be transferred or disconnected separately. You can also request data deletion via this page or by emailing hello@brandpilots.io.

BrandPilots does not share Facebook or Instagram data with any third party other than those listed in Section 4, and only to the extent necessary to operate the service.

6. Data retention

• Personal account data: retained for the life of your account and removed through the account-deletion workflow, subject to ownership safeguards
• Social access tokens: retained until the connection is disconnected or its owning workspace is deleted
• Shared organization posts and content: retained until deleted through that organization's lifecycle
• Server logs: 30 days
• Billing records: 7 years (legal requirement)

7. Your rights

Depending on your location, you may have the right to:

• Access — request a copy of your personal data
• Correction — update inaccurate data
• Deletion — request deletion of your data
• Portability — receive your data in a portable format
• Objection — object to certain processing

To exercise any of these rights, email hello@brandpilots.io. We will respond within 30 days.

8. Cookies

We use strictly necessary cookies for authentication (Supabase session cookies). We do not use tracking cookies or advertising cookies.

9. Security

We use industry-standard security measures including encryption in transit (HTTPS), encrypted storage, row-level security on all database tables, and rate limiting on all API endpoints. No method of transmission over the internet is 100% secure. If you discover a security vulnerability, please report it to hello@brandpilots.io.

10. Children

BrandPilots is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by email or by posting a notice in the app. The effective date at the top of this page reflects the most recent update.

12. Contact

For privacy questions or data requests, contact us at:
hello@brandpilots.io