Privacy Policy

Post Pilot ("we", "us", or "our") is an AI-powered business automation platform operated by Sitemaker Lab, incorporated under the laws of India. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights.

By using Post Pilot, you agree to the practices described in this policy. If you do not agree, please do not use our services.

1. What Data We Collect

1.1 Account Information

• Name, email address, and password (hashed — we never store plaintext passwords)
• Business name, business type, and contact details provided during onboarding
• Profile picture (if signing in via Google OAuth)

1.2 Platform Integration Data

When you connect a third-party platform to Post Pilot, we collect and store:

• Instagram: Instagram Business Account ID, username, access tokens (encrypted with AES-256-GCM), page ID, follower count, and media count. Obtained via Meta's Instagram Graph API with your explicit OAuth consent.
• WhatsApp Business: WhatsApp Business Account (WABA) ID, phone number ID, display name, and access tokens (encrypted). Obtained via the official Meta WhatsApp Cloud API and Embedded Signup flow.
• Google Business Profile: Business location ID, business name, category, and Google OAuth tokens (encrypted). Obtained via Google's Business Profile API with your explicit consent.

1.3 Content Data

• AI-generated captions, images, and hashtags created in the Content Lab
• Scheduled post content and publish times
• Incoming WhatsApp and Instagram messages visible in your Inbox

1.4 Usage and Log Data

• Automation activity logs (posts published, messages sent)
• API error logs for debugging
• Browser type, device type, and IP address (standard server logs)

1.5 Payment Data

Payments are processed by Razorpay. We do not store your card details. We store transaction IDs, order IDs, and subscription status received from Razorpay.

2. How We Use Your Data

• To provide the service: Publishing posts to Instagram and Google Business Profile on your behalf, sending and receiving WhatsApp messages using your connected business number, and generating AI content.
• To operate your automations: Queuing and scheduling content, running automation rules, and triggering AI replies — all actions you have explicitly configured.
• To manage your account: Authentication, billing, team management, and support.
• To improve the platform: Aggregate, anonymised usage analytics to understand which features are used most.
• To comply with legal obligations: Responding to lawful requests from regulatory authorities.

We do not sell your data to third parties. We do not use your content to train AI models without your explicit consent.

3. Meta Platform Data

Post Pilot uses Meta's APIs (Instagram Graph API, WhatsApp Business Cloud API) to act on your behalf. By connecting your Instagram or WhatsApp account, you authorise Post Pilot to:

• Read your Instagram Business Account profile information
• Publish media posts to your Instagram Business Account
• Send and receive WhatsApp messages via your registered business number

Data obtained from Meta APIs is governed by Meta's Platform Terms in addition to this policy. We use this data only to provide the automation services you have explicitly enabled. We do not share Meta-sourced data with any third party except as required to operate the service.

3.1 Google Workspace & API Data Usage

Post Pilot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, regarding Google Business Profile data:

• We only use Google data to provide the core scheduling and automation features within the Post Pilot dashboard.
• We do not use Google data to develop, improve, or train generalized AI or machine learning models.
• We do not share, transfer, or sell your Google data to third parties, except as strictly necessary to provide the Post Pilot service or comply with legal requirements.

4. Data Retention

• Active accounts: Data is retained for the duration of your subscription plus 90 days after cancellation.
• After deletion request: All personal data is permanently deleted within 30 days of a verified deletion request.
• Logs: System logs are retained for up to 12 months for security and debugging purposes, then automatically purged.
• Payment records: Transaction records are retained for 7 years as required by Indian GST and accounting regulations.

5. Data Security

• All platform access tokens are encrypted at rest using AES-256-GCM
• All data is transmitted over HTTPS/TLS
• Passwords are hashed using bcrypt (work factor 12)
• Access to production systems is restricted to authorised personnel only

6. Your Rights

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your account and all associated data. You may also disconnect individual platform integrations at any time from your Accounts page.
• Portability: Request an export of your data in a machine-readable format.
• Withdraw consent: Disconnect any platform integration at any time, which immediately revokes our access to that platform's data.

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

7. Data Deletion & Access Revocation (Meta & Google)

Meta Users: If you connected your Facebook or Instagram account and later remove Post Pilot from your Facebook app settings, Meta will notify us automatically. We will delete all data associated with your Meta account within 30 days.

Google Users: You can revoke Post Pilot's access to your Google Business Profile at any time by visiting your Google Account's Security settings and removing Post Pilot from your connected third-party apps. Upon disconnection, we will delete your associated Google data from our active servers within 30 days.

You can check the status of a deletion request at postpilot.sitemakerlab.com/data-deletion/status.

8. Third-Party Services

• Meta (Facebook / Instagram / WhatsApp): Platform API provider
• Google: Business Profile API and authentication provider
• Razorpay: Payment processing
• Groq / Google Gemini / Replicate: AI content generation
• Redis / BullMQ: Job queue infrastructure (self-hosted)

9. Cookies

Post Pilot uses only essential cookies required for authentication (JWT tokens stored in localStorage). We do not use advertising or tracking cookies.

10. Children's Privacy

Post Pilot is not intended for use by anyone under the age of 18. We do not knowingly collect data from minors.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and update the effective date above.

12. Contact Us

• Email: [email protected]
• Company: Sitemaker Lab (A Registered Partnership Firm)
• D-U-N-S Number: 772366425
• Address: House No: 31, Ground Floor, Swahid Dilip Hazuri Path, Near SBI Colony, Dispur, Guwahati, Assam 781006
• Country: India