Data Controller
ADpilot OÜ ("we", "our", "us", "ADpilot") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website adpilot.ee and related services (collectively, the "Services"). On third-party social media developer platforms (including the Meta Developer Platform), our application is registered and may appear under the name "ADpilot"; ADpilot and the ADpilot Services described in this Policy are the same product operated by ADpilot OÜ.
This Privacy Policy is designed to comply with the General Data Protection Regulation (GDPR) (EU) 2016/679, the Estonian Personal Data Protection Act (isikuandmete kaitse seadus), and other applicable data protection laws.
ADpilot OÜ
Registry code: 17376620
Address: Harju maakond, Tallinn, Kesklinna linnaosa, Ahtri tn 12, 15551, Estonia
Email: [email protected]
01
Information We Collect
1.1 Information You Provide Directly
- +Account Information: Name, email address, password, and profile information when you create an account.
- +Payment Information: Billing address and payment card details (processed securely by Stripe).
- +Communications: Messages, support requests, and feedback you send to us.
- +User Content: Videos, images, text, and other content you upload through our Services.
1.2 Information from Third-Party Platforms (OAuth Connections)
When you connect a third-party platform to the Services, you authorise that platform - via its OAuth consent screen - to grant us a scoped access token. We only request the minimum scopes needed to deliver the Services. We never request scopes that read content you did not publish through our app, and we never request advertising, audience, or messaging scopes.
Across all connected platforms, we receive the following categories of data:
- +Profile basics: account name, username, profile picture, account ID - to display which account is connected and which account we will publish to.
- +Access tokens: the OAuth access token (and refresh token when issued) - stored encrypted at rest and used solely to call the platform APIs on your behalf.
- +Publishing targets: Page IDs, Board IDs, Channel IDs, Subreddit lists - so you can choose where to publish.
- +Engagement metrics on posts you published through ADpilot: likes, replies/comments, reposts/shares, quotes, views, impressions, reach, saves, pin clicks - read via the platform’s analytics endpoint after your post is live. We do not read engagement for posts you did not publish through our app.
- +Search Console performance (Google only): impressions, clicks, position, query data for properties you authorise - used to power the SEO dashboard for sites you own.
The exact OAuth scopes we request, per platform, are listed below. You can review and revoke any of these at any time - either from Brand Setup → Connections inside ADpilot, or from the corresponding platform’s own “Apps and Websites” / “Connected Apps” settings.
Meta Platforms (operated under our app “ADpilot Engine”)
- Facebook Pages - scopes:
pages_show_list, pages_read_engagement, pages_manage_posts, pages_manage_metadata, business_management. Used to list the Pages you administer, publish content you approved in ADpilot, read engagement (likes/comments/shares) on those posts, and manage post metadata required for scheduling.
- Instagram (Business) - scopes:
instagram_business_basic, instagram_business_content_publish. Used to identify the connected business account and publish content you approved in ADpilot. Engagement reads (likes, comments, impressions, reach, saves) are made on the published media’s /insights endpoint within the granted scope.
- Threads - scopes:
threads_basic, threads_content_publish, threads_manage_insights. Used to identify the connected Threads profile, publish posts you approved in ADpilot, and read engagement metrics (likes, replies, reposts, quotes, views) on those published posts via the Threads /insights endpoint.
Our use of data received from Meta Platforms complies with the Meta Platform Terms and Developer Policies. We do not transfer Meta-sourced data to third parties, do not use it for advertising targeting outside your own account, and delete it on disconnect or request as described in Section 7.
LinkedIn
- Scopes:
openid, profile, w_member_social. Used to identify the connected member, publish posts you approved in ADpilot, and read post-level social actions (likes, comments, shares) for posts published through our app.
X (formerly Twitter)
- Scopes:
tweet.read, tweet.write, users.read, media.write, offline.access. Used to identify the connected user, upload media, publish posts you approved in ADpilot, and refresh access without re-prompting. tweet.read is used solely to fetch public_metrics (likes, replies, reposts, impressions, bookmarks) on posts published through our app.
TikTok
- Scopes:
user.info.basic, video.publish, video.upload. Used to identify the connected account, upload video content you approved in ADpilot, and publish it to your TikTok feed. Engagement counters (likes, comments, shares, views) are read for videos uploaded through our app via the TikTok Display API.
Pinterest
- Scopes:
user_accounts:read, boards:read, pins:read, pins:write. Used to identify the account, list boards available for publishing, create new pins from content you approved in ADpilot, and read pin analytics (impressions, saves, pin clicks, outbound clicks) on pins created through our app.
YouTube (Google)
- Scopes:
https://www.googleapis.com/auth/youtube.upload, https://www.googleapis.com/auth/youtube.readonly. Used to upload video content you approved in ADpilot to your own YouTube channel and read basic metadata for videos uploaded through our app. We do not access subscribers’ data, watch history, or videos you did not upload through ADpilot.
Google Search Console
- Scope:
https://www.googleapis.com/auth/webmasters.readonly. Read-only access to Search Console performance data (impressions, clicks, average position, top queries) for properties you have already verified ownership of in Google Search Console. Used to render the SEO Performance dashboard inside ADpilot. We cannot modify or remove anything in Search Console on your behalf.
- Scope:
https://www.googleapis.com/auth/indexing. Lets ADpilot notify Google (via the Web Search Indexing API) when an article you approved is published or updated on your own site, so it is crawled sooner. Only URLs of content published through ADpilot to properties you own are submitted; nothing is read through this scope.
- Access is granted through Google sign-in. We store the refresh token encrypted at rest and use it only to call the two APIs above. Disconnecting in Connections deletes the token and revokes the grant at Google.
Our use of Google API data complies with the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not transferred to third parties, not used for advertising, not read by humans except when required for security/legal/operator-requested support, and not used to train generalised AI/ML models.
Reddit
- Scopes:
identity, submit. Used to identify the connected Reddit account and submit posts to subreddits you have permission to post in, content you approved in ADpilot. We do not read your private messages, voting history, or content you did not submit through our app.
Blog destinations (WordPress, Tumblr, custom webhooks)
- WordPress and Tumblr connections use application passwords / platform-issued tokens (no OAuth scopes). Used solely to publish blog posts you approved in ADpilot to your own site. Custom webhooks fire to URLs you configure with payloads you control.
1.3 Information Collected Automatically
- +Device Information: IP address, browser type, operating system, device identifiers.
- +Usage Data: Pages visited, features used, time spent, click patterns.
- +Log Data: Server logs, error reports, API requests.
- +Cookies and Similar Technologies: See Section 8 for details.
02
Legal Basis for Processing (GDPR)
We process your personal data based on the following legal grounds:
- +Contract Performance (Art. 6(1)(b) GDPR): Processing necessary to provide our Services and fulfil our contractual obligations to you.
- +Legitimate Interests (Art. 6(1)(f) GDPR): Processing for our legitimate business interests, such as improving our Services, fraud prevention, and security.
- +Consent (Art. 6(1)(a) GDPR): Processing based on your explicit consent, such as marketing communications.
- +Legal Obligation (Art. 6(1)(c) GDPR): Processing required to comply with legal requirements.
03
How We Use Your Information
3.1 Service Provision
- +Creating and managing your account.
- +Processing and posting your content to connected social media platforms.
- +Processing payments and subscriptions.
- +Providing customer support.
3.2 Service Improvement
- +Analysing usage patterns to improve our Services.
- +Developing new features and functionality.
- +Conducting research and analytics.
3.3 Communication
- +Sending service-related notifications (transactional emails).
- +Responding to enquiries and support requests.
- +Sending marketing communications (with your consent).
3.4 Security and Compliance
- +Detecting, preventing, and addressing fraud and abuse.
- +Enforcing our Terms of Use.
- +Complying with legal obligations.
3.5 Automated Processing
Our Services rely on automated systems to process and deliver your content to connected social media platforms. This includes scheduling, formatting, and transmitting your content. While we implement safeguards to ensure accuracy, automated processing may occasionally result in errors, including content being delivered to incorrect accounts or platforms.
We do not use automated decision-making that produces legal effects or similarly significantly affects you within the meaning of Article 22 GDPR. If you believe an automated process has adversely affected you, please contact us at [email protected] to request human review.
3.6 Engagement Metrics & AI Content Scoring
Engagement metrics that we read from connected platforms (Section 1.2) - likes, comments/replies, shares/reposts, quotes, views, impressions, reach, saves, pin clicks - are used for two purposes, both strictly scoped to your own organisation:
- Your own analytics surface. Per-post engagement is displayed back to you in the Analytics dashboard so you can see which of your posts performed best on each connected platform.
- Per-organisation AI scoring. Your historical engagement is used to train and rank AI content models that are scoped to your organisation only. The models inform future content drafts and posting-time recommendations for your account. Each customer’s engagement data is database-isolated by an immutable organisation identifier on every row; cross-tenant reads are blocked at the data-access layer.
We do not use engagement metrics from your connected platforms for any of the following: advertising or audience targeting; training generalised foundation models or any model that benefits other ADpilot customers; resale or sharing with third parties; manual review by ADpilot staff except where strictly required for security investigations, fraud prevention, legal compliance, or support requests you initiate.
04
Information Sharing and Disclosure
We do NOT sell your personal data. We may share your information in the following circumstances:
4.1 Service Providers
We share data with trusted third-party service providers who assist us in operating our Services:
- +Payment Processor: Stripe (for payment processing).
- +Cloud Infrastructure: For hosting and data storage.
- +Website Analytics: Google Analytics 4, provided by Google Ireland Limited, only on the public website and only if you accept analytics cookies (see Section 8).
- +Email Services: For transactional and marketing emails.
4.2 Social Media Platforms
When you use our Services to post content, your content and associated metadata are transmitted to the social media platforms you have connected. This transmission is necessary to provide our core service functionality. You acknowledge that once content is transmitted to a third-party platform, it is subject to that platform's terms and privacy policies.
4.3 Legal Requirements
We may disclose your information if required by law, court order, or governmental authority, or when we believe disclosure is necessary to comply with legal obligations, protect our rights, safety, or property, prevent fraud, or respond to lawful requests from public authorities.
4.4 Business Transfers
In the event of a merger, acquisition, reorganisation, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you of any such change and your choices regarding your data.
05
International Data Transfers
Your data may be transferred to and processed in countries outside the European Economic Area (EEA). When we transfer data outside the EEA, we ensure appropriate safeguards are in place, including:
- +Adequacy decisions by the European Commission.
- +Standard Contractual Clauses (SCCs) approved by the European Commission.
- +Binding Corporate Rules where applicable.
- +EU-US Data Privacy Framework certification where applicable.
06
Data Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- +Encryption of data in transit (TLS/SSL) and at rest.
- +Regular security assessments and penetration testing.
- +Access controls and authentication mechanisms.
- +Employee training on data protection.
- +Incident response procedures.
However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
07
Data Retention & Platform Disconnect
7.1 Retention Periods
We retain your personal data for as long as necessary to provide our Services, comply with legal obligations, resolve disputes, and prevent fraud. Specific retention periods:
- +Account Data: Until account deletion + 30 days.
- +Transaction Records: 7 years (in accordance with Estonian Accounting Act requirements).
- +User Content: Until deletion by user or account termination.
- +Log Data: 90 days.
- +Analytics Data: 26 months (aggregated and anonymised).
- +Platform Access Tokens: Until disconnect, expiry, or revocation by the user. Tokens are encrypted at rest.
- +Platform Engagement Metrics: While the connection is active and for up to 90 days after disconnect, then purged (or sooner upon request).
- +Free Tool Leads (Section 1.4): 12 months after the last report request, then deleted (or sooner upon request).
7.2 Disconnecting a Platform
You may disconnect any third-party platform connection at any time from Brand Setup → Connections inside ADpilot. On disconnect we will, within 24 hours:
- +Stop all API calls to that platform on your behalf (no further posting, no further metric fetching).
- +Revoke the stored access token by calling the platform’s token revocation endpoint where one is provided.
- +Delete the access token (and refresh token where present) from our active database.
You may additionally revoke our access directly from the platform’s own settings - e.g. Facebook Settings → Apps and Websites, LinkedIn → Data Privacy → Permitted Services, X → Settings & Privacy → Connected Apps, Google Account → Security → Third-party access, TikTok → Settings → Authorized Apps, Pinterest → Settings → Apps, Reddit → Preferences → Apps.
7.3 Deleting Platform-Sourced Data on Request
To request deletion of all data we have received from a specific third-party platform (engagement metrics, profile basics, account identifiers), email [email protected] or submit a request via our data subject request form. We will purge the requested records within 30 days and confirm completion. If you submit a deletion request from the platform itself (e.g. Meta’s data deletion callback), we will honour it on the same timeline.
08
Cookies and Tracking Technologies
8.1 Essential Cookies
Required for the website and the app to work: your login session, protection against cross-site request forgery, and the ap_consent cookie that remembers your analytics choice for 180 days. These do not need your consent and cannot be switched off.
8.2 Analytics Cookies (Google Analytics 4)
On the public website (not inside the app) we use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to understand which pages people read and how they found us. It runs only if you press Accept in the cookie banner. Until then the Google Analytics script is not loaded, nothing is sent to Google and no analytics cookie is set. Our legal basis is your consent (Article 6(1)(a) GDPR).
If you accept, Google Analytics sets the _ga and _ga_65Z7G4HPLK cookies, which hold a random identifier and expire after up to 2 years, and collects: the pages you view and when, the page that referred you, your browser, device type, screen size and language, and an approximate location (country and city) derived from your IP address. Google Analytics 4 does not log or store IP addresses. We do not send your name, email address or account data to Google Analytics, and we do not use it for advertising: the advertising consent signals (ad storage, ad user data, ad personalisation) stay denied.
Google keeps this data for the retention period set in our Google Analytics property: 2 months by Google’s default, never more than 14 months. Google may process it outside the EU, including in the United States, under the EU-US Data Privacy Framework and the Standard Contractual Clauses. See Google’s own explanation at policies.google.com/technologies/partner-sites.
8.3 Withdrawing Consent
You can change your mind at any time: open Cookie settings (also linked in the footer of every page) and press Reject. We then stop loading Google Analytics and delete its cookies from your browser. You can also clear cookies in your browser settings. Withdrawing consent does not affect processing that happened before.
8.4 Advertising Cookies
We do not use advertising or retargeting cookies.
09
Your Rights (GDPR)
Under the GDPR, you have the following rights regarding your personal data:
- +Right of Access (Art. 15): Request a copy of your personal data we hold.
- +Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data.
- +Right to Erasure (Art. 17): Request deletion of your data (the "right to be forgotten").
- +Right to Restriction of Processing (Art. 18): Request that we limit how we use your data.
- +Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format.
- +Right to Object (Art. 21): Object to processing based on legitimate interests or direct marketing.
- +Right to Withdraw Consent (Art. 7): Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.
- +Right to Lodge a Complaint (Art. 77): File a complaint with a supervisory authority.
9.1 Exercising Your Rights
To exercise any of these rights, please contact us at:
Email: [email protected]
Or use our data subject request form.
Address: Harju maakond, Tallinn, Kesklinna linnaosa, Ahtri tn 12, 15551, Estonia.
We will respond to your request within 30 days. We may need to verify your identity before processing your request.
10
Children’s Privacy
Our Services are not intended for children under the age of 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without verifiable parental consent, we will delete that information immediately. If you believe we have collected data from a child, please contact us at [email protected].
11
Third-Party Links
Our Services may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you access.
12
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a prominent notice on our website at least 30 days before the changes take effect. Your continued use of our Services after the effective date constitutes your acceptance of the updated Privacy Policy.
13
Supervisory Authority
If you are located in Estonia or the European Union and believe we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with the relevant supervisory authority.
14
Contact Us
For any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
ADpilot OÜ
Registry code: 17376620
Address: Harju maakond, Tallinn, Kesklinna linnaosa, Ahtri tn 12, 15551, Estonia
Email: [email protected]
Website: adpilot.ee
