Privacy Policy

Last updated: 24 September 2026

1. Who we are

Social Autopilot is a social media publishing tool for small businesses and agencies. It is currently operated by Kunal Kava as an individual, ahead of incorporating a company. When the company is formed, this policy will be updated to name it as the operator.

For any privacy question or request, contact privacy@social-autopilot.com.

2. What we collect

If you join the waitlist

• Your email address, and any other details you choose to enter in the waitlist form.

If you use the Social Autopilot app

• Account details: your name, email address and login information.
• Workspace details: your workspace name, time zone and the people you invite.
• Connected social accounts: when you connect Instagram or Facebook, we receive your account ID, username or Page name, profile picture, and an access token that lets us publish on your behalf. We also record which permissions you granted and when the token expires.
• Your content: the captions, comments, images and videos you upload, and the schedule you set.
• Publishing records: the result of each publish attempt, such as the post ID and link returned by Instagram or Facebook, or the error message if it failed.
• Billing details (once paid plans launch): your plan and billing status. Card and payment details are handled by our payment provider and are never stored by us.

When you visit our website

• Basic usage data, such as pages visited, approximate location, device and browser type, collected through Google Analytics.

3. Data we receive from Instagram and Facebook

When you connect an Instagram professional account or a Facebook Page, you authorise Social Autopilot through Meta's own login screen and choose which permissions to grant. We use the data we receive only to:

• show you which account is connected,
• publish the posts, Reels, carousels, Stories and first comments you schedule, and
• tell you whether each post succeeded or failed.

We do not read your private messages, we do not sell or rent data received from Meta, we do not use it for advertising, and we do not share it with anyone except the service providers listed below who help us run the product. Access tokens are stored encrypted and are never shown in the app, in logs or in emails.

You can revoke our access at any time from Instagram (Settings, then Apps and websites) or Facebook (Settings, then Business integrations). Revoking access stops all publishing immediately.

4. How we use your data

• To provide the service: publish your content at the time you choose and show you its status.
• To keep your account secure and to prevent misuse.
• To send you service emails, such as a warning that a connected account needs reconnecting or that a post failed.
• To contact you about the waitlist and the product launch, if you joined the waitlist. You can unsubscribe at any time.
• To understand, in aggregate, how the website and product are used so we can improve them.

If you are in the European Union or the United Kingdom, our legal bases are: performing our contract with you (running the service), our legitimate interests (security, product improvement, service emails), and your consent (waitlist emails and analytics cookies, where required). You can withdraw consent at any time.

5. Service providers

We use a small number of trusted providers to run Social Autopilot. They process data only on our instructions.

Where data is transferred outside your country, we rely on the safeguards our providers offer, such as standard contractual clauses.

6. How long we keep data

• Waitlist emails: until the product launches and you have been invited, or until you ask us to remove you.
• Account, workspace and content data: for as long as your account is active.
• Access tokens: until you disconnect the account, revoke access, or delete your account.
• Publishing logs: up to 90 days, for troubleshooting.
• After deletion: data is removed from our live systems within 30 days. Copies in backups are overwritten on a rolling basis within a further 30 days.

7. Your rights

Depending on where you live, including under the EU General Data Protection Regulation and India's Digital Personal Data Protection Act, 2023, you can ask us to:

• give you a copy of your data,
• correct inaccurate data,
• delete your data (see our Data Deletion page),
• stop or restrict certain processing, or
• move your data to another service.

Write to privacy@social-autopilot.com. We reply within 30 days. If you are unhappy with our response, you can complain to your local data protection authority.

8. Security

Data is encrypted in transit. Social media access tokens are encrypted at rest in a dedicated secrets store. Each workspace's data is isolated at the database level so one customer cannot access another's data. No system is perfectly secure, but we will tell affected users promptly if a breach affects their data.

9. Children

Social Autopilot is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.

10. Changes to this policy

If we make material changes, we will update the date at the top of this page and, if you have an account, notify you by email before the changes take effect.

11. Contact

Questions or requests: privacy@social-autopilot.com