Privacy Policy

Last updated: July 5, 2026

AI Auto Social (“we”, “us”, “our”) operates the website and service at aiautosocial.com (the “Service”). This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using the Service you agree to this policy.

Information we collect

• Account information — your email address and a securely hashed password.
• Brand & content settings — the brands, niches, prompts, visual styles, calls to action, and characters you configure.
• Connected social accounts — when you connect a platform such as TikTok, we receive and store the access and refresh tokens that the platform issues under the permissions you grant (e.g. video.upload), plus a basic account identifier. We never receive your social-account password.
• Generated content — the images/carousels generated on your behalf and related metadata, stored so you can review, publish, or delete them.
• Usage & technical data — log data, IP address, timestamps, and a single authentication cookie that keeps you signed in.

How we use information

• Operate the Service — generate content, host your media, and upload drafts to your connected accounts.
• Authenticate you and keep you signed in.
• Maintain, secure, and improve the Service.
• Communicate with you about your account.

Third-party services

• TikTok — we use the official TikTok API to upload content to your account as drafts, only with your authorization. We access, store, and use TikTok data solely to provide the Service and in accordance with TikTok’s Developer Terms and Community Guidelines. We do not sell TikTok data. Your use of TikTok is also governed by TikTok’s own Terms and Privacy Policy.
• Meta Platforms (Facebook & Instagram) — when you connect a Facebook Page or Instagram professional account, we receive and store the access tokens and account identifiers (Page ID/name, Instagram account ID/username) that Meta issues under the permissions you grant, solely to publish the content you approve. We never receive your Facebook or Instagram password, and we never share this data with any other service.
• Google (Gemini API & YouTube) — the prompts and brand details you configure are sent to Google’s Gemini API to generate text and images. If you connect a YouTube channel, we store the tokens Google issues to upload the videos you approve. This is governed by Google’s applicable terms.
• Hetzner Online GmbH — our infrastructure and hosting provider (data centers in Germany/EU). Our application server and database — including connected-account tokens and identifiers — run on Hetzner infrastructure under a GDPR-compliant data processing agreement. Hetzner processes data solely as our hosting provider.

TikTok data — access, storage, and revocation

With your authorization we access a basic account identifier and permission to upload content. Tokens are stored securely and used only to perform actions you initiate or schedule. You can revoke access at any time by disconnecting the account in the Service or removing the app in your TikTok account settings; revoking invalidates the stored tokens.

How we share information

We do not sell your personal information. We share data only with the service providers above as needed to operate the Service, or when required by law (see the next section).

Requests from public authorities

If a public authority (such as law enforcement or a court) requests personal data about a user, we handle the request under the following policy:

• Legality review — every request is reviewed before any response: we verify the requesting authority’s identity, its jurisdiction over us, and the legal basis cited. Requests without a valid legal basis are refused.
• Challenging unlawful requests — if a request appears overbroad or unlawful, we seek legal counsel and challenge it through the available legal channels before disclosing anything.
• Data minimization — where disclosure is legally required, we disclose only the minimum data necessary to satisfy the specific request.
• Documentation — every request is logged, including the requesting authority, the legal basis cited, our assessment, what (if anything) was disclosed, and the people involved.
• User notification — where legally permitted, we notify the affected user before disclosure.

Data retention & deletion

We retain your data while your account is active. You can delete brands, posts, and media at any time from within the Service; deleting media removes the underlying files. To delete your account and associated data, contact us at the address below.

Security

We use reasonable measures including encryption in transit, hashed passwords, and access controls. No method of transmission or storage is 100% secure.

Cookies

We use a single authentication cookie to keep you signed in. We do not use third-party advertising cookies.

Your rights

Depending on your location (for example, the EEA/UK under GDPR or California under CCPA), you may have rights to access, correct, delete, or port your data and to object to or restrict processing. Contact us to exercise these rights.

Children

The Service is not directed to children under 16 (or the age required by your jurisdiction), and we do not knowingly collect their data.

Changes

We may update this policy from time to time and will post the new “Last updated” date above.

Contact

Questions? Email support@aiautosocial.com.