Privacy policy

Who we are

PostPilot is a Google Business Profile posting service operated by SocialViens from India. In this policy, “we” means PostPilot, and “you” means the person who signs up and the business they represent. For anything on this page, write to support@socialviens.in.

What we collect

Account details

Your name, email address and a bcrypt hash of your password (we never store the password itself), plus your plan, trial end date, subscription status and whether you want email notifications. If you sign in with Google, we store the email, name and profile photo URL Google gives us instead of a password.

Business profile

Everything you enter during onboarding and later change in Settings: business name, category, city and area, phone number, website, logo, your two brand colours, the description of what you do, the keywords your customers search for, and your posting preferences (frequency, preferred time, timezone, language, tone, whether posts auto-approve, which post types you want, and your default call-to-action link).

Your Google connection

When you connect Google, we store the access token and refresh token Google issues, along with the account ID, location ID and location name you pick. Both tokens are encrypted with AES-256-GCM before they are written to our database and are only decrypted in memory at the moment we call Google on your behalf. We request the narrowest scope that lets us read your locations and publish posts to the one you choose. We never receive your Google password.

Generated posts

The captions, headlines, hashtags and images we generate for you, the topic and post type behind each one, when it was scheduled, when it was published, the Google post ID and search link that Google returns, and any error message if a publish fails. Offers you create are stored with their title, details, validity date and call-to-action.

Technical data

A signed session cookie so you stay logged in, server request and error logs, and the results of the scheduled jobs that generate and publish your posts. We keep no advertising or cross-site tracking cookies on this website.

What we do not collect

• Card or bank details. Payments are handled on request against an invoice, so there is nothing to store.
• Personal data about your customers. We do not import your reviews, contacts or order history.
• Your location, your device contacts, or anything from other apps.

Why we use it

• To create posts that sound like your business and look like your brand.
• To publish those posts to the Google location you connected, on schedule.
• To show you what is coming, what went live, and what failed, and to email you about approvals, publishes and failures if you have notifications on.
• To apply your plan limits and raise invoices when you change plan.
• To keep the service working, find bugs and prevent abuse.

Who else sees it

Google Business Profile API

To publish, we send Google the post you approved: its text, image, call-to-action and the location it belongs to. Google processes it under its own terms and privacy policy. PostPilot is not affiliated with, endorsed by or certified by Google.

Google Gemini

To write a caption, we send Gemini the business details you gave us (name, category, city, description, keywords, tone, language) and the topic for that day. We do not send your Google tokens, your email address or anything about your customers.

Infrastructure providers

Our hosting, database and transactional email providers process data on our instructions so that the service can run. They are bound by contract to use it for nothing else.

We do not sell your data, and we never will. We do not share it with advertisers or data brokers. We will disclose data if a valid Indian legal order requires it, and we will tell you unless we are legally barred from doing so.

How long we keep it

• Account and business data: for as long as your account exists, and for 30 days after you delete it, so an accidental deletion can be undone.
• Posts and generated images: kept as your history while the account is active, deleted with the account.
• Google tokens: deleted immediately when you disconnect the profile in Settings or delete your account. Revoking access from your Google account has the same effect from Google’s side.
• Invoices and payment records: kept as long as Indian tax and accounting law requires, even after the account is closed.
• Server and error logs: rotated and deleted within 90 days.

Your rights

Under the Digital Personal Data Protection Act, 2023, you can ask us for a copy of your data, correct anything wrong, withdraw consent for the Google connection, or have everything erased. Email support@socialviens.in with the subject “Delete my data” from the address on your account. We confirm within 7 working days and complete the deletion within 30 days. Grievances about how we handle your data go to the same address and are answered by a person, not a form.

Security

Passwords are hashed with bcrypt, Google tokens are encrypted at rest, and the whole application runs over HTTPS. Access to the production database is limited to the people who operate the service. No system is perfect: if a breach ever affects your data, we will tell you and the relevant authority as required by law.

Children

PostPilot is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.

Changes to this policy

If we change what we collect or who we share it with, we update the date at the top of this page and email account holders before the change takes effect.

Governing law

This policy is governed by the laws of India. Any dispute about it is subject to the exclusive jurisdiction of the courts at Mumbai, Maharashtra.