Privacy Policy

This policy explains what Autom collects when you use our website and app, why, who we share it with, and the choices you have. We collect only what we need to run the Service, and we do not sell your data.

What we collect

• Account details: your email address and, if you sign in with Google, the name and profile picture Google shares with us.
• Your content: the images you upload, the prompts and settings you enter, the images you generate, and the models and assets you save.
• Billing: your plan, subscription status and credit history. Card details go straight to Stripe; we never see or store them.
• Onboarding answers: what you tell us in the welcome survey, such as your role, how you heard about us and, if you choose to share it, your brand’s Instagram handle.
• Technical data: server logs such as IP address, browser type, and the time and outcome of requests, used to keep the Service secure and working.

How we use it

• To run the Service: sign you in, generate and store your images, and track your credits.
• To bill you and manage your subscription.
• To keep Autom safe, including checking requests against our content rules and preventing abuse.
• To improve Autom and decide what to build, using your survey answers and how features are used.
• To email you about your account, billing and important changes.

We do not use your uploads or generated images to train AI models.

Who we share it with

We share data only with the providers that run parts of Autom for us, and only what each one needs:

• Supabase: sign-in, database and file storage.
• Stripe: payments and subscriptions.
• Google (Gemini) and Anthropic (Claude): your uploads and prompts are sent to their APIs to write prompts and generate images, under their API terms.
• Google: sign-in, if you choose it.
• Hosting providers: to serve the website and app.

We may also disclose data if the law requires it, to protect our rights or users’ safety, or as part of a merger or sale of the business.

Cookies

We use only the cookies Autom needs to work: one that keeps you signed in, and one that remembers small preferences such as whether the sidebar is collapsed. We do not use advertising or cross-site tracking cookies.

How long we keep it

We keep your data while your account is open. When you delete your account from Settings › Security, we cancel your subscription and delete your account, uploads, generated images and survey answers. Stripe keeps invoices and payment records as tax and accounting law requires, and server logs and backups are removed on their normal cycle.

Your rights

Autom is based in Toronto, Canada, and handles personal information under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). You have the right to access and correct your data, and to withdraw consent by deleting your account. Depending on where you live (for example under the GDPR or California law), you may also have the right to export your data or to object to or restrict how we use it. You can delete your account yourself anytime; for anything else, email us and we will respond within 30 days. You may also complain to the Office of the Privacy Commissioner of Canada or your local data protection authority.

Where your data is processed

Our providers may process and store data outside Canada, including in the United States, where it may be accessible to authorities under local law. Where the law requires it, we rely on safeguards such as the European Commission’s Standard Contractual Clauses.

Security

Data is encrypted in transit, access to your content is limited to your account, and only our servers hold the keys that reach payment and storage systems. No system is perfectly secure, but we will tell you promptly if a breach affects your data.

Children

Autom is for people 18 and over. We do not knowingly collect data from anyone younger.

Changes

If we change this policy in a way that matters, we will tell you by email or in the app before it takes effect.

Contact

Privacy questions or requests: byautom@gmail.com.