Who we are
AttentionPilot is operated by Alexander Martinovic AB, a company registered in Sweden. We are the data controller for the personal data described here.
For any privacy question, or to exercise any of the rights below, email [email protected]. A person reads that address; it is not a ticket queue.
What we store
Your email address, used to sign you in. We use magic links, so we never hold a password.
Access tokens for the social accounts you connect. These are what let us publish on your behalf. They are stored server-side and are not readable by any browser session, including your own — the database explicitly withholds those columns from client access.
The posts you write, the media you upload, and when each was scheduled or published.
Engagement figures we fetch back from each network for posts you published through AttentionPilot.
Basic billing records if you subscribe. Card details are handled by Stripe and never reach our servers.
What we do with it
We use it to run the product: writing captions, scheduling posts, publishing them, and showing you what happened.
If you use the AI writer, the text of your idea and your brand-voice settings are sent to Anthropic to generate captions. We do not send your access tokens, your media, or anything about your audience.
We do not sell your data, and we do not use your posts to train anything.
Who else sees it
The social networks you connect, when we publish on your behalf — that is the point of the product.
Supabase, which hosts our database and file storage. Vercel, which hosts the application and measures page speed. PostHog (EU-hosted), which counts page views and product usage for us — cookielessly and anonymously until you sign in, at which point usage is tied to your account so we can improve the product; nothing is shared onward or used for advertising. Anthropic, for AI caption generation only. Stripe, for payments. Resend, which delivers sign-in emails. We run no advertising trackers.
Nobody else. We do not run advertising trackers on the application.
The social networks you connect
When you connect an account on TikTok, Instagram, Facebook, Threads, LinkedIn, X, YouTube, Pinterest or Bluesky, that network sends us an access token and basic profile information about the account: its identifier, its handle, its display name and, where the network provides one, its avatar. We use these only to show you which account you connected and to publish the posts you ask us to publish.
We request the narrowest permissions that allow publishing. We do not read your inbox or direct messages, we do not read your follower lists, and we do not post anything you have not composed and scheduled yourself.
For posts you published through AttentionPilot, we fetch back the engagement figures that network makes available, so we can show you how the post did.
Your use of each network remains governed by that network's own terms and privacy policy in addition to this one. Revoking our access inside the network, or disconnecting the account here, stops all of it and deletes the stored token.
Google and YouTube data
If you connect a YouTube channel, we use the YouTube Data API. What we receive from Google is an OAuth token, your channel's id, title and handle, and — for videos you uploaded through AttentionPilot — the view, like and comment counts YouTube reports. We do not read your subscriptions, your watch history, your other videos, or anything in your Google account beyond the channel you connected.
We use it for exactly two things: showing you which channel is connected, and uploading and reporting on the videos you ask us to publish. We do not use Google user data for advertising, we do not sell it, and we do not share it with data brokers or any third party except the infrastructure providers named above who process it on our behalf.
AttentionPilot's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never used to develop, improve or train generalised AI or machine learning models. Our AI features write captions from text you provide and never receive data obtained from Google APIs.
Google's own handling of your data is governed by the Google Privacy Policy at policies.google.com/privacy, and your use of YouTube by the YouTube Terms of Service at youtube.com/t/terms. You can revoke our access at any time at myaccount.google.com/permissions, which stops all of the above and deletes the stored token.
Why we are allowed to use it
Where GDPR or UK GDPR applies, our legal basis is performance of a contract: you asked us to publish on your behalf, and holding your posts and tokens is what makes that possible. Billing records are kept on the basis of our legal obligation to retain accounting records.
Where we rely on consent, such as connecting a particular social account, you can withdraw it at any time by disconnecting that account.
Where it is processed
Our database and file storage run in the European Union (Supabase, eu-west-2). The application is hosted by Vercel.
Two processors are outside the EU: Anthropic, which generates AI captions, and Stripe, which handles payments. Transfers to them rely on the European Commission's Standard Contractual Clauses. When you publish to a social network, your post travels to that network under its own terms, wherever it operates.
Cookies
We set one kind of cookie: the session cookie that keeps you signed in. There are no advertising cookies, no third-party trackers and no cross-site profiling, which is why the site has no cookie banner asking you to accept any.
How it is kept safe
Access tokens are held server-side and are withheld from client access at the database level, so they are not readable by any browser session, including your own. Traffic runs over TLS. Access to production data is limited to the operator of the service.
No system is perfect. If a breach affects your personal data, we will notify you and the relevant supervisory authority as the law requires.
Children
AttentionPilot is a business tool and is not directed at children. You must be at least 16 to hold an account. We do not knowingly collect data from anyone younger, and will delete it if we discover we have.
How long we keep it
For as long as your account exists. Delete your workspace and the posts, media, tokens and metrics go with it.
Disconnecting a social account deletes its stored tokens immediately.
Your rights
You can export or delete your data at any time — see the data deletion page for how. If you are in the UK or EU, you additionally have the rights granted by UK GDPR and GDPR, including access, rectification, erasure and portability.
To exercise any of these, or to ask anything about this policy, email [email protected] or use the data deletion page. We answer within 30 days.
If you think we have handled your data badly, you can complain to your local supervisory authority. In Sweden that is Integritetsskyddsmyndigheten (IMY).
Changes
If this policy changes in a way that materially affects you, we will tell you by email before it takes effect rather than quietly updating the date at the top.