Who we are
AttentionPilot is operated by Alexander Martinovic AB, a company registered in Sweden. We are the data controller for the personal data described here.
For any privacy question, or to exercise any of the rights below, email attentionpilot@gmail.com. A person reads that address; it is not a ticket queue.
What we store
Your email address and authentication records, used to sign you in through Google, email links or an existing password. Authentication is handled by Supabase.
Access tokens for the social accounts you connect. These are what let us publish on your behalf. They are stored server-side and are not readable by any browser session, including your own — the database explicitly withholds those columns from client access.
The posts you write, the media you upload, and when each was scheduled or published.
Engagement figures we fetch back from each network for posts you published through AttentionPilot.
Basic billing records if you subscribe. Card details are handled by Stripe and never reach our servers.
What we do with it
We use it to connect accounts, schedule and publish the content you or your authorized agent supply, and report delivery.
Your own AI agent supplies content. AttentionPilot does not generate captions or train AI models on your posts.
We do not sell your data, and we do not use your posts to train anything.
Who else sees it
The social networks you connect, when we publish on your behalf — that is the point of the product.
Supabase, which hosts our database and file storage. Vercel, which hosts the application and measures page speed. PostHog (EU-hosted), which measures page views, setup, subscription state and publishing outcomes. Browser analytics use memory-only persistence. We do not intentionally send passwords, API keys, OAuth tokens, captions or media to analytics, and session recording is disabled. Stripe, for payments. Resend, which delivers sign-in emails. We run no advertising trackers.
Nobody else. We do not run advertising trackers on the application.
The social networks you connect
When you connect an account on TikTok, Instagram, Facebook, LinkedIn, X or YouTube, that network sends us an access token and basic profile information about the account: its identifier, its handle, its display name and, where the network provides one, its avatar. We use these only to show you which account you connected and to publish the posts you ask us to publish.
We request the narrowest permissions that allow publishing. We do not read your inbox or direct messages, we do not read your follower lists, and we publish only content requested by you or an agent you authorize.
For posts you published through AttentionPilot, we fetch back the engagement figures that network makes available, so we can show you how the post did.
Your use of each network remains governed by that network's own terms and privacy policy in addition to this one. Revoking our access inside the network, or disconnecting the account here, stops all of it and deletes the stored token.
Google and YouTube data
If you connect a YouTube channel, we use the YouTube Data API. What we receive from Google is an OAuth token, your channel's id, title and handle, and — for videos you uploaded through AttentionPilot — the view, like and comment counts YouTube reports. We do not read your subscriptions, your watch history, your other videos, or anything in your Google account beyond the channel you connected.
We use it for exactly two things: showing you which channel is connected, and uploading and reporting on the videos you ask us to publish. We do not use Google user data for advertising, we do not sell it, and we do not share it with data brokers or any third party except the infrastructure providers named above who process it on our behalf.
AttentionPilot's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never used to develop, improve or train generalised AI or machine learning models. AttentionPilot does not provide an AI caption writer.
Google's own handling of your data is governed by the Google Privacy Policy at policies.google.com/privacy, and your use of YouTube by the YouTube Terms of Service at youtube.com/t/terms. You can revoke our access at any time at myaccount.google.com/permissions, which stops all of the above and deletes the stored token.
Why we are allowed to use it
Where GDPR or UK GDPR applies, our legal basis is performance of a contract: you asked us to publish on your behalf, and holding your posts and tokens is what makes that possible. Billing records are kept on the basis of our legal obligation to retain accounting records.
Where we rely on consent, such as connecting a particular social account, you can withdraw it at any time by disconnecting that account.
Where it is processed
Our database and file storage are hosted by Supabase in the eu-west-2 (London, United Kingdom) region. Vercel hosts the application.
Our infrastructure and payment providers may process data in other countries. Their contractual data-protection terms govern those transfers. When you publish to a social network, your post is processed under that network’s terms.
Cookies
We use essential cookies to keep you signed in, remember your selected profile and secure account connections. Browser analytics use memory-only persistence. We do not use advertising cookies or session recording.
How it is kept safe
Access tokens are held server-side and are withheld from client access at the database level, so they are not readable by any browser session, including your own. Traffic runs over TLS. Access to production data is limited to the operator of the service.
No system is perfect. If a breach affects your personal data, we will notify you and the relevant supervisory authority as the law requires.
Children
AttentionPilot is a business tool and is not directed at children. You must be at least 16 to hold an account. We do not knowingly collect data from anyone younger, and will delete it if we discover we have.
How long we keep it
For as long as your account exists. Deleting a profile removes its posts, media and connected tokens. Billing records may be retained where legally required; trial eligibility records remain while your login exists.
Disconnecting a social account deletes its stored tokens immediately.
Your rights
You can export or delete your data at any time — see the data deletion page for how. If you are in the UK or EU, you additionally have the rights granted by UK GDPR and GDPR, including access, rectification, erasure and portability.
To exercise any of these, or to ask anything about this policy, email attentionpilot@gmail.com or use the data deletion page. We answer within 30 days.
If you think we have handled your data badly, you can complain to your local supervisory authority. In Sweden that is Integritetsskyddsmyndigheten (IMY).
Changes
If this policy changes in a way that materially affects you, we will tell you by email before it takes effect rather than quietly updating the date at the top.