OperPilot Privacy Policy

1. Data Controller

The controller of personal data is Warsaw Trade Spółka z Ograniczoną Odpowiedzialnością, ul. Eugeniusza Kwiatkowskiego 6/12, 03-984 Warsaw, Poland, KRS 0000583526, EU VAT ID: PL1132897602, REGON 362907969 (hereinafter: "Controller").

For any privacy inquiries or to exercise your GDPR rights, contact: kontakt@operpilot.com.

2. Scope of this Policy

This Privacy Policy applies to registered Users of OperPilot, organization representatives, platform visitors, and social media accounts connected via integrations.

3. Categories of Processed Data

• Account Data: Display name, email address, password hash, account ID, preferred language, security settings.
• External SSO Data: Google account ID, verified email address, profile name.
• Brand Workspace Data: Brand name, industry, tone of voice, website URL, target audience descriptors.
• Content & Media: Drafts, prompts, captions, images, videos, and post schedules.
• Publishing Data: Selected destination profiles, scheduled publication timestamps, delivery statuses, network response codes.
• Integration Tokens: OAuth authorization tokens and refresh keys (stored encrypted).
• Technical & Diagnostics: IP address, device/browser identifiers, session tokens, error logs, and abuse prevention telemetry.
• Billing Data: Transaction history, Stripe customer identifiers, and corporate invoicing details.

4. Purposes and Legal Bases under GDPR

• Operating User accounts, scheduling content, and executing publications – Art. 6(1)(b) GDPR (contract performance);
• External authentication and voluntary third-party network integrations – Art. 6(1)(b) GDPR;
• AI generation features – Art. 6(1)(b) GDPR;
• Service notices, password resets, and customer support – Art. 6(1)(f) GDPR (legitimate interest);
• Platform security, intrusion detection, diagnostics, and backups – Art. 6(1)(f) GDPR;
• Invoicing, tax compliance, and statutory accounting – Art. 6(1)(c) GDPR (legal obligations).

5. Integrations & Third-Party Platforms

Google and Meta (Facebook/Instagram) authorizations are performed via OAuth. OperPilot never stores or accesses external passwords.

6. Artificial Intelligence Data Processing

AI features leverage the OpenAI API strictly to generate requested content variations. Data submitted through the API is not used to train external models.

7. Sub-processors and Service Providers

Data processing is supported by trusted infrastructure partners:

• Server and database hosting: webh.pl;
• Secure object and backup storage: Cloudflare R2;
• Transactional email delivery: Resend;
• AI model inference: OpenAI;
• Payment gateway: Stripe;
• Social platform APIs: Google, Meta Platforms.

8. International Data Transfers

Transfers outside the European Economic Area are safeguarded under European Commission Adequacy Decisions, the EU-US Data Privacy Framework, or Standard Contractual Clauses (SCC).

9. Data Subject Rights

Under Chapter III of the GDPR, you have the right to access, rectify, erase, restrict processing of, and export your personal data. You also have the right to lodge a complaint with a supervisory data protection authority.