Privacy Policy

Account data: name, e-mail, and a password stored as a hash (never in plain text), plus access timestamps used to keep your session alive.

Connected profiles: the identifier, public name, and access tokens returned by Facebook, Instagram, TikTok, TikTok Business, YouTube, X, LinkedIn, Pinterest, Threads, or Kwai. We never receive or ask for your social network password — the connection is OAuth, performed on the platform's own screen.

What you publish: the images and videos you upload, the caption, the scheduled time, the outcome of each publication (success, failure, the post link), and metrics returned by the network, such as reach, views, and interactions.

People who interact with you: Instagram sends comments and DMs by webhook. The Inbox also periodically retrieves comments from Facebook Pages, Threads, YouTube, X, LinkedIn, and TikTok Business, plus Messenger DMs for the Page. We store the text, the person's identifier and public name, the date, and the source post or comment, along with any public fields returned by the platform. This lets you view the conversation and send the reply you choose. Pinterest, Kwai, and personal TikTok accounts are not included in the Inbox because their current APIs do not provide those comments to Piloto.

Site access: Cloudflare, which hosts the service, logs IP address and technical request data for security and abuse prevention.

Navigation on public pages: Microsoft Clarity receives page events, clicks, scrolling, pointer movements, viewport size, technical failures, and a visual reconstruction of the session. The tool masks sensitive form fields. Clarity uses the IP address to estimate location and may use cookies and browser storage.

• Send the content you scheduled for publication, using the scheduled time as the target.
• Retrieve and display metrics for connected profiles and posts.
• Synchronize supported comments and DMs and deliver automated or human replies you send through the Inbox.
• Keep your session, refresh tokens when the network provides a refresh token, and warn you when a connection breaks.
• Use Clarity to understand where public pages fail or confuse visitors.
• Investigate failures, abuse, and fraud.

If you belong to an organization, invited owners, admins, and members may view and operate workspace data according to their authorized role. No one outside an organization to which they were expressly added receives that access.

We do not use your data or your audience's data for third-party advertising, we do not sell data, and we do not train AI models on your message content.

• Performance of a contract (LGPD art. 7, V) — account data, connected profiles, and scheduled content: without them the service cannot do what it was hired to do.
• Legitimate interest (art. 7, IX) — technical access logs, security, abuse prevention, and public-page usability measurement through Clarity. You may object through the options in section 5 or by writing to contato@pilotodoafiliado.com.br.
• Consent (art. 7, I) — connecting each profile, granted on the social network's own screen and revocable at any time there or here.

Only with those the service requires, and each receives only what it needs:

• Cloudflare — hosting, database, and media storage.
• Microsoft Clarity — public-page usage measurement, interaction maps, and session reconstruction used to find navigation failures.
• The social network you choose to connect — Meta (Facebook, Instagram, and Threads), TikTok, Google/YouTube, X, LinkedIn, Pinterest, or Kwai. It receives only the token, content, and commands required to connect the profile, publish, retrieve metrics, or answer interactions you authorized.
• Resend — delivery of invitation e-mails, when e-mail sending is configured. It receives the recipient's address and the invitation's individual link.

These providers may process data outside Brazil. The countries, subprocessors, and transfer mechanisms vary with the network you choose and are described in that provider's own policy. You may request the list applicable to your case at contato@pilotodoafiliado.com.br.

We may also disclose data under a court order or legal requirement.

Piloto's cookie is the session cookie, created when you sign in and deleted when you sign out. It is strictly necessary — without it there is no way to know the next page is yours.

Your light/dark theme choice lives in your browser's localStorage, never leaves it, and is not a cookie.

Microsoft Clarity loads when a public page opens, without waiting for a banner. It may set its own cookies and use browser storage to measure page views and interactions. We rely on legitimate interest for this measurement, use it to fix the site, and do not use it for behavioral advertising.

You can prevent collection by selecting Microsoft in the Digital Advertising Alliance opt-out, enabling Global Privacy Control, or blocking clarity.ms in your browser. You may also clear cookies in your browser settings and object by e-mailing contato@pilotodoafiliado.com.br. See the Microsoft Privacy Statement.

When you connect a YouTube channel, you authorize only the openid and youtube.force-ssl scopes. With that authorization, Piloto stores access and refresh tokens and retrieves the channel ID, name, avatar, and subscriber count; available playlists; the ID and link of published videos; view, like, and comment metrics; and the comments and replies needed for the Inbox. openid is used only to receive the Google Account's stable sub and turn it into an HMAC: this cryptographic fingerprint correlates channels covered by the same authorization so revocation is safe. The raw sub is neither displayed nor used to build a profile.

We use this data only to show the connected channel, publish a video and thumbnail, add it to the playlist you choose, display metrics and comments, and send a reply you request. We do not use Google data for advertising, data sales, credit assessment, or AI model training.

Authorized YouTube data may be viewed and operated only by you and the owners, admins, and members expressly invited to the same organization.

We handle information received from Google APIs according to the Google API Services User Data Policy, including its Limited Use requirements. By using the connector, you are also bound by the YouTube Terms of Service and the Google Privacy Policy.

You can revoke access under Accounts → Remove or on the Google Account security permissions page. Revoking access at Google stops new calls; removing the connection in Piloto also revokes the authorization and deletes local data under the time limits in the next section.

• Account and connected profiles: while the account exists.
• Access tokens: while the profile is connected. Removing a profile blocks the token from every new use immediately. For Meta, it may remain encrypted only long enough to confirm the remote unsubscribe. A refusal that proves the operation did not happen may be retried; an ambiguous result is not repeated. A credential error deletes the token at once, and every other case has a 30-day maximum, after which the token is deleted even without remote confirmation.
• Uploaded media: while the publication exists in your account.
• Conversations (DMs and comments): while the account exists, so you keep your support history.
• YouTube API Data: statistics are kept for more than 30 days only while authorization and resources are revalidated at least once a month. Other data is refreshed or deleted within 30 days. Removing the connection through Piloto revokes authorization and deletes authorized data within 7 days; if access is revoked outside Piloto and detected by token validation, deletion occurs within 30 days.
• Technical access logs: per Cloudflare's retention, typically a few days.
• Microsoft Clarity: session playback data remains available for 30 days; click and heatmap data for 9 months; labeled or favorited sessions for 9 months.
• Security audit: who made a change, which route was used, and its outcome, without a request body, password, or token, for up to 180 days.

Once the account is deleted, operational data under our control that identifies you is erased within 30 days; Clarity data follows the provider retention stated above. An opaque technical marker may remain, without your name, e-mail, raw social ID, token, or message content. It contains only a cryptographic fingerprint of the social identity and the operation checkpoint needed to prevent an old, uncertain action from being repeated after a disconnect, reconnection, or ownership transfer. The marker remains until a late response or an explicit authenticated decision closes the pending state and is deleted within 30 days after that; it cannot recover the identity or authorize a new network request. Only the minimal hash of an idempotency key may remain, without identity or content, so that the same message can never be sent twice. When a Web Push result is uncertain, the SHA-256 fingerprint of that subscription may also remain without a time limit. It stores no endpoint, keys, owner, or content and is used only to stop the same subscription from being reused by another account; a new browser subscription produces a different fingerprint. See Data deletion.

Under the LGPD you may request confirmation of processing, access, correction, anonymization, blocking, erasure, portability, information about sharing, and withdrawal of consent.

To exercise any of them, write to contato@pilotodoafiliado.com.br. We reply within 15 days.

A profile connection can be cut at any time without contacting us: here, under Accounts → Remove; or on the social network's side, by revoking the app's access.

Social network tokens are stored encrypted (AES-GCM) and are only decrypted, in memory, at the moment of publishing or replying.

Every database query requires membership in the active organization. Invited owners, admins, and members access its data according to their authorized role, without seeing organizations they do not belong to.

The webhook that receives Meta events validates the cryptographic signature of every call and rejects everything if the key is not configured. Without that, anyone who discovered the URL could send messages on a profile's behalf.

Interactions from other networks are retrieved only with the connected account's OAuth token; there is no public endpoint that accepts a message and chooses its recipient.

No system is infallible. In the event of an incident with relevant risk, we notify the data subjects and the Brazilian DPA (ANPD), as the law requires.

Changes to this policy appear on this page with the update date at the top. Any change that broadens the use of data is announced by e-mail before it takes effect.