Privacy Policy

• Account information — name, email address, and authentication identifiers when you sign up.
• Workspace data — workspace names, team members, settings, and automation content you configure.
• Instagram data — when you connect an Instagram Professional account, we receive the basic account identifiers, encrypted access credentials, and messaging events required for the automation features you enable.
• Shopify store data — when you connect Shopify, we read product, variant, inventory and collection information needed to answer Commerce AI questions from your own catalog. We do not request Shopify customer or order scopes in the catalog-only launch.
• Usage & diagnostic data — logs, error reports, and webhook delivery metadata used to operate and debug the service.

AutoPilotDM requests only the Instagram permissions needed for the messaging automation features available in your approved account configuration:

• instagram_business_basic — read basic professional-account information.
• instagram_business_manage_messages — receive and respond to messaging events on your behalf.

You can revoke access at any time from Instagram's app settings or by disconnecting the account inside AutoPilotDM.

AutoPilotDM reads Shopify catalog data only to provide the Commerce AI features you choose. Shopify access credentials are encrypted at rest and are never exposed in the browser.

When Shopify sends an app/uninstalled webhook, we mark the installation inactive. When Shopify sends a shop/redactwebhook, we erase the exact shop's installation record, encrypted credential, OAuth handoffs, pending install claim, and Shopify event records. We do not retain Shopify customer data because the app does not request or store it.

• Provide, operate, and maintain the AutoPilotDM service.
• Execute the Instagram automations you configure.
• Answer Commerce AI questions from your connected store's catalog.
• Display analytics, logs, and inbox history inside your workspace.
• Communicate service updates, security notices, and support responses.
• Detect abuse and enforce our Terms of Service.

We do not sell personal data or use message content to train third-party AI models.

Access tokens are encrypted at rest using AES-256-GCM. Data is transmitted over TLS. Access to production systems is restricted to authorized personnel and protected by role-based access control and row-level security in our database. Instagram and Shopify webhook payloads are verified before processing.

We rely on the following processors to run AutoPilotDM:

• Meta Platforms, Inc. — Instagram Graph API and webhooks.
• Shopify Inc. — Shopify Admin API and compliance webhooks.
• Supabase — authentication, database, and storage.
• Cloud hosting providers — application hosting and delivery.

These providers process data only on our instructions and under their own security and privacy commitments.

We retain account and workspace data while your account is active. Operational logs are retained only as long as needed for troubleshooting. You can request deletion at any time — see our Data Deletion page.

Depending on your jurisdiction (including under GDPR and CCPA), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, email us at support@autopilotdm.app.

AutoPilotDM is not directed to children under 13 (or the equivalent minimum age in your country), and we do not knowingly collect data from them.

We may update this Privacy Policy from time to time. Material changes will be communicated inside the product or by email.

Questions or requests? Contact us at support@autopilotdm.app.