Privacy Policy | AbiPilot

1. Introduction

Welcome to AbiPilot. We are operated by Abi Pilot, LLC, a limited liability company formally organized and registered under the laws of the State of Delaware, United States of America (referred to herein as "AbiPilot", "we", "us", or "our").

We respect your privacy and are committed to protecting your personal data. This Privacy Policy describes how we collect, handle, use, secure, and process personal data when you visit our website (abipilot.com), register an account, utilize our autonomous SaaS platform services, or integrate your third-party productivity calendars and social media channels (including Google Calendar, TikTok, Meta, YouTube, and X.com). It also outlines your privacy rights under applicable jurisdictions, including Delaware corporate statutes, the General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA).

2. Google API Compliance & Limited Use Disclosure

Google Integration

Compliance Pledge

• Limited Use Adherence: AbiPilot’s use and transfer to any other app of information received from Google APIs will adhere to the Google User Policy, including the Limited Use requirements.
• No Advertising or Profiling: We do not use, transfer, or share Google Calendar data or Google user data for the purpose of serving advertisements, including personalized, targeted, or retargeted advertising.
• No AI Model Training: We do not use Google Calendar data, event descriptions, or any information retrieved from Google APIs to train, retrain, or fine-tune artificial intelligence, machine learning, or large language models.
• Restricted Transfers: We do not transfer Google user data to third parties unless it is strictly necessary to provide and improve the specific scheduling features of the application, comply with applicable law, or as part of a corporate merger or acquisition, and in all cases, subject to strict confidentiality and Limited Use constraints.

3. Data We Collect

Data Collection Intro

• Identity Data: First name, last name, business name, and username.
• Contact Data: Billing address, email address, and telephone numbers.
• Financial & Billing Data: Payment details and billing history. Payment processing is handled securely by our third-party payment partner, Stripe, and is subject to standard PCIDSS compliance.
• Google Calendar Integration Data: When you connect your Google Account via the OAuth screen, we collect and store:
  • Your Google OAuth 2.0 access and refresh tokens (securely encrypted).
  • Google Calendar metadata (such as timezone, calendar name, and calendar ID).
  • Event details (event titles, descriptions, start/end dates and times, attendee email addresses, organizer names, and Google Meet video links) required for active synchronization.
• Social Media Integration Data (TikTok, Meta, X.com, YouTube): When you connect a social media creator account, we securely store OAuth access/refresh tokens, creator account identifiers (open_id, handle, avatar), and media publication metadata required for executing scheduled posts.
• Technical Data: IP address, session details, browser type and version, timezone settings, location data, operating system, and hardware identifiers.
• Communication Data: Inbound and outbound SMS messages, WhatsApp messaging details, and voice calling logs initiated via our integration with telephony gateways (such as Twilio).

4. How We Use Data

Legal Basis Intro

• Performance of Contract: To set up your account, process payments, operate the autonomous AI agents, and deliver the scheduling and publishing features of the platform.
• Legitimate Business Interests: To improve our service offerings, debug technical issues, detect and prevent fraud, and enhance the security of the SaaS system.
• Legal Compliance: To comply with statutory legal requirements, tax reporting obligations, or regulatory demands.

5. Google Calendar Integration

Google Calendar Integration Intro

This scope is requested for the following direct purposes:

• Read Calendars and Events: To inspect scheduling availability and prevent booking conflicts.
• Create and Update Events: When an AI agent schedules an appointment, AbiPilot creates the calendar event directly on your connected Google Calendar.
• Delete or Reschedule Events: If an appointment is canceled or rescheduled, the corresponding calendar event is updated automatically.

6. TikTok & Social Media Integrations Compliance

AbiPilot enables users and organizations to connect their social media accounts (including TikTok, X.com, Meta platforms, and YouTube) to facilitate autonomous multi-channel marketing, automated content scheduling, and campaign performance tracking.

TikTok Developer Platform & User Data Policy Compliance:

• Scopes & Permissions: When you connect your TikTok account via OAuth 2.0, we request only authorized permissions (user.info.basic to retrieve your verified display name, avatar, and creator Open ID, and video.publish / video.upload to post approved content on your behalf).
• Token Encryption & Storage: TikTok OAuth access and refresh tokens are encrypted at rest using industry-standard AES-256 encryption within Google Cloud Platform secure databases.
• No Sale or Unauthorized Sharing: We do not sell, rent, or transfer your TikTok credentials, user profile information, or multimedia assets to third parties or advertising data brokers.
• No AI Foundation Model Training: Your private TikTok account information, media uploads, and authentication tokens are never used to train or fine-tune public AI foundation models.
• Immediate Token Revocation: You can disconnect your TikTok integration at any time from the AbiPilot Channel Connections page or directly from your TikTok account security settings. Disconnecting immediately deletes all stored OAuth tokens and cached integration data from our production systems.

7. Data Security

Security Measures Intro

• Encryption in Transit: All data transmitted between your browser and our servers is protected using Transport Layer Security (TLS 1.3/HTTPS).
• Encryption at Rest: Sensitive credentials, including Google and TikTok OAuth tokens, are encrypted at rest using AES-256 encryption.
• Access Controls: Access to user data is strictly limited to authorized personnel on a least-privilege basis.
• Infrastructure Security: Our databases and application servers are hosted in secure virtual private environments provided by Google Cloud Platform (GCP).

8. Data Retention and Deletion

Data Retention Intro

Disconnect Google Intro

1. Dashboard Disconnect: You can disconnect your Google Calendar or TikTok integration at any time by navigating to Admin -> Channel Connections in the AbiPilot panel and clicking "Disconnect". This instantly and permanently deletes your OAuth access and refresh tokens, as well as all cached integration metadata from our active servers.
2. External Security Dashboard: You can revoke AbiPilot’s API access externally at any time via the Google Security page (https://myaccount.google.com/permissions) or TikTok account security settings.
3. Complete Deletion Request: If you wish to permanently delete your entire account, including all customer records, billing history, and connected integrations, you can submit an explicit deletion request by contacting us at support@abipilot.com. We will process your request within 30 days, in compliance with applicable law.

9. Third-Party Data Sharing

Third Party Sharing Intro

• Stripe: Secure PCIDSS payment processing and transaction settlement.
• Twilio Share
• Google Cloud Platform: Secure data hosting and server database architecture.

Important Note: Under no circumstances do we share any Google Calendar, TikTok, or social media OAuth data with payment or telephony gateways.

10. GDPR and CCPA Rights

Rights Intro

GDPR (EU and UK Residents):

• Right of Access (request copies of your personal data).
• Right to Rectification (request correction of inaccurate information).
• Right to Erasure (request data deletion, "Right to be Forgotten").
• Right to Portability (request digital transfer of your data).
• Right to Object (object to automated profiling or marketing).

CCPA/CPRA (California Residents):

• Right to Know (request details about categories of data collected and shared).
• Right to Delete (request deletion of personal data).
• Right to Opt-Out (right to opt-out of the "sale" or "sharing" of personal data — note that we do not sell or share your data).
• Right to Non-Discrimination (we will never deny service or charge different prices based on exercising your CCPA rights).

To exercise any of these rights, please email us at legal@abipilot.com.

11. Contact Information

Contact Intro