Privacy policy

Who we are

autosm is run by [To confirm: the legal entity's name, registered address and company number]. For anything about your data, write to hi@autosm.io.

For your account and your workspace we are the controller. For the posts, pictures and videos you publish through autosm, you decide what goes out and where; we act on your instructions.

What we keep

Your account: your email address, and your name and picture if you sign in with Google. Supabase Auth, which runs sign-in, also records each session's IP address and browser.

Your workspace: its name, members, brand (colours, fonts, logo, tone of voice), settings and plan.

Connected profiles: for each social profile you connect, its name, handle and the access tokens the network gives us, and the keys of the developer apps you create yourself (for example your X, Meta or Google app). Tokens and keys are encrypted at rest and used only to do what you asked: publish, schedule and read your posts' results.

Your content: the posts you write or approve, the pictures made in the Studio and the files you upload, and when and where each was published.

Results: the public numbers networks report about your posts (views, likes, replies, followers) so you can see what worked.

AI connections: if you connect an AI assistant (for example Claude or ChatGPT) to autosm, which assistant it is, when it acted and what it did. We keep only a hash of API keys.

Billing: your plan and its invoices. Payments are made through Perly Pay in bitcoin or dollar stablecoins; we see whether an invoice was paid, never your wallet's keys.

What we do with it

We use your data to run autosm for you: sign you in, publish what you scheduled, show you results, apply your plan's limits and send you the messages the service needs (sign-in codes, a failed post, an invoice due).

We do not sell your data, we do not use it for advertising, and we do not train AI models on it.

We do this to perform our contract with you (running the service you signed up for), in our legitimate interest in keeping autosm secure and free of abuse, and to meet legal duties such as keeping invoices.

An AI assistant you connect acts only on your instructions and only inside your workspace. Posts it creates wait for your approval unless the workspace owner switches that off.

Google user data

autosm's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data from your Google account is used only to sign you in. If you connect YouTube through your own Google project, autosm uses that access only to upload and describe the videos you scheduled and read their results.

Where it lives and who helps us

Your data is stored by Supabase in the European Union (Ireland) and served by Vercel. Sign-in codes are sent by [To confirm: the email provider that sends sign-in codes]. Payments run through Perly Pay. When you publish, your post goes to the networks you chose (for example X, LinkedIn, Instagram, YouTube), under their own privacy policies.

These providers process data only to provide their service to us. Supabase and Vercel are US companies; where data may reach the United States, it is protected by [To confirm: the transfer safeguard for US providers].

How long we keep it

Uploaded files and Studio pictures are deleted 30 days after the last post that uses them is published, or 30 days after upload if no post uses them.

Disconnecting a profile deletes its tokens at once. Deleting your workspace deletes its content, profiles and brand within 30 days. Invoices are kept as long as the law requires for accounting.

Sign-in records, with their IP address and browser, are kept while your account exists.

Your rights

You can see, correct, export or delete your data, and object to how we use it. Most of it is in your workspace's Settings; for the rest, write to hi@autosm.io from the address you sign in with. You may also complain to your data protection authority.

autosm is not for anyone under 16.

Security

Connections are encrypted in transit, access tokens are encrypted at rest, and each workspace's data is kept apart from every other's in the database itself.

Changes

We will tell you in the app and by email before a change that matters takes effect. Last updated 2026-10-20.