Privacy Policy

Last updated: July 25, 2026

AI Auto Social (“we”, “us”, “our”) operates the website and service at aiautosocial.com (the “Service”). This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using the Service you agree to this policy.

Information we collect

• Account information — your email address and a securely hashed password.
• Brand & content settings — the brands, niches, prompts, visual styles, calls to action, and characters you configure.
• Connected social accounts — when you connect a platform such as TikTok, we receive and store the access and refresh tokens that the platform issues under the permissions you grant (e.g. video.upload), plus a basic account identifier. We never receive your social-account password.
• Generated content — the images/carousels generated on your behalf and related metadata, stored so you can review, publish, or delete them.
• Usage & technical data — log data, IP address, timestamps, and cookies. A necessary authentication cookie keeps you signed in; with your consent we also use analytics and advertising cookies (see “Cookies, analytics & advertising” below).

How we use information

• Operate the Service — generate content, host your media, and upload drafts to your connected accounts.
• Authenticate you and keep you signed in.
• Maintain, secure, and improve the Service.
• Communicate with you about your account.
• With your consent, measure how our website and advertising perform so we can improve them.

Third-party services

• TikTok — we use the official TikTok API to upload content to your account as drafts, only with your authorization. We access, store, and use TikTok data solely to provide the Service and in accordance with TikTok’s Developer Terms and Community Guidelines. We do not sell TikTok data. Your use of TikTok is also governed by TikTok’s own Terms and Privacy Policy.
• Meta Platforms (Facebook & Instagram) — when you connect a Facebook Page or Instagram professional account, we receive and store the access tokens and account identifiers (Page ID/name, Instagram account ID/username) that Meta issues under the permissions you grant, solely to publish the content you approve. We never receive your Facebook or Instagram password, and we never share this data with any other service.
• Google (Gemini API & YouTube) — the prompts and brand details you configure are sent to Google’s Gemini API to generate text and images. If you connect a YouTube channel, we store the tokens Google issues to upload the videos you approve. This is governed by Google’s applicable terms.
• Google (analytics & advertising) — with your consent we use Google Tag Manager, Google Ads, and Google Analytics to measure site usage and advertising performance. Limited event data (such as that you signed up or created a post), technical data (such as IP address and device/browser information), and — for conversion measurement only — a hashed version of your email may be shared with Google. This is governed by Google’s Privacy Policy. See “Cookies, analytics & advertising” below for how to control it.
• Hetzner Online GmbH — our infrastructure and hosting provider (data centers in Germany/EU). Our application server and database — including connected-account tokens and identifiers — run on Hetzner infrastructure under a GDPR-compliant data processing agreement. Hetzner processes data solely as our hosting provider.

TikTok data — access, storage, and revocation

With your authorization we access a basic account identifier and permission to upload content. Tokens are stored securely and used only to perform actions you initiate or schedule. You can revoke access at any time by disconnecting the account in the Service or removing the app in your TikTok account settings; revoking invalidates the stored tokens.

How we share information

We do not sell your personal information. We share data only with the service providers above as needed to operate the Service, or when required by law (see the next section).

Requests from public authorities

If a public authority (such as law enforcement or a court) requests personal data about a user, we handle the request under the following policy:

• Legality review — every request is reviewed before any response: we verify the requesting authority’s identity, its jurisdiction over us, and the legal basis cited. Requests without a valid legal basis are refused.
• Challenging unlawful requests — if a request appears overbroad or unlawful, we seek legal counsel and challenge it through the available legal channels before disclosing anything.
• Data minimization — where disclosure is legally required, we disclose only the minimum data necessary to satisfy the specific request.
• Documentation — every request is logged, including the requesting authority, the legal basis cited, our assessment, what (if anything) was disclosed, and the people involved.
• User notification — where legally permitted, we notify the affected user before disclosure.

Data retention & deletion

We retain your data while your account is active. You can delete brands, posts, and media at any time from within the Service; deleting media removes the underlying files. To delete your account and associated data, contact us at the address below.

Security

We use reasonable measures including encryption in transit, hashed passwords, and access controls. No method of transmission or storage is 100% secure.

Cookies, analytics & advertising

Strictly necessary. We use a single authentication cookie to keep you signed in, and we store your cookie-consent choice. These are required for the Service to work and are always active.

Analytics & advertising (consent-based). To understand how our website and ads perform, we use Google Tag Manager together with Google Ads and Google Analytics. These set cookies and share limited event data (for example, that you signed up or created a post) and standard technical data (such as your IP address and device/browser information) with Google. If you consent to advertising, we may also share a hashed (irreversible) version of your email with Google to measure whether an ad led to a signup or a created post — this “enhanced conversions” data is used only for measurement, never to contact you.

We load these tools using Google Consent Mode v2. In the EEA, UK, and Switzerland they are disabled by default and activate only after you accept them in our cookie banner; elsewhere they are enabled by default and you can decline at any time. You can change or withdraw your choice whenever you like:

Manage cookie preferences — reopens the consent banner so you can accept or reject.

Your rights

Depending on your location (for example, the EEA/UK under GDPR or California under CCPA), you may have rights to access, correct, delete, or port your data and to object to or restrict processing. Contact us to exercise these rights.

Children

The Service is not directed to children under 16 (or the age required by your jurisdiction), and we do not knowingly collect their data.

Changes

We may update this policy from time to time and will post the new “Last updated” date above.

Contact

Questions? Email support@aiautosocial.com.