Effective date: October 28, 2026
Schedpilot is a social media scheduling application at https://schedpilot.com and https://app.schedpilot.com that lets you connect social media accounts, plan and publish posts, and review how those posts performed. This policy explains what personal data we collect when you use the website, the app, our API and integrations, and our free tools, why we collect it, who we share it with, and what choices you have.
Schedpilot is operated by SITEMILE SRL, a company registered in Romania with its registered office at Str. Vasile Bideac nr. 4A, Chitila, Ilfov County, Romania, Trade Register no. J2012002424236, fiscal code (CUI) 30584106, VAT number RO30584106 (referred to as “Schedpilot”, “we” or “us”). For the purposes of the EU General Data Protection Regulation (GDPR), we are the data controller for the personal data described in this policy. We have not appointed a Data Protection Officer, as we are not required to; our contact for all privacy matters is below.
If you have questions or want to exercise any of your rights, email us at admin@schedpilot.com.
When you create an account we collect your name, email address and password (stored hashed, never in plain text). If you sign up with Google, we receive your name, email address and profile picture from Google instead of a password. If you buy a paid plan we also collect billing details such as company name, billing address, country and VAT number. Card numbers are handled by our payment processor, Stripe, and never touch our servers; Stripe shares with us only limited details such as the card brand, last four digits, expiry date and payment status.
Schedpilot works by connecting to your social media accounts through each platform’s official API. When you connect an account we receive and store:
We only request the permissions each platform requires for the features you use. We never receive your social media passwords.
Tokens are stored encrypted with AES-256. You can disconnect any account at any time from the Schedpilot dashboard, which deletes the stored token. You can also revoke Schedpilot’s access from within the platform itself (for example, Google Account permissions at https://myaccount.google.com/permissions, or Facebook’s Business Integrations settings).
Posts, captions, hashtags, images, videos, links, drafts, comments, labels and schedules that you create in Schedpilot are stored so that we can publish them at the time you choose and show them in your calendar and history. Uploaded media is stored with our cloud storage and content delivery providers (see section 5).
Uploaded photos and videos may contain embedded metadata (EXIF), including GPS location. We don’t use this metadata for tracking, but the social media platforms you publish to may read it according to their own policies. If that concerns you, strip the metadata before uploading.
If you invite team members to your workspace, we collect their name and email address to send the invitation and set up their account. If you are invited by someone else, the workspace owner can see the posts you create and your activity within that workspace.
If you create API keys or connect an AI assistant or automation tool (for example Claude, ChatGPT, Cursor or n8n) to Schedpilot, we store the keys or authorisation tokens needed for that connection and log the requests we receive (time, endpoint, the action requested and the result) so we can run the integration, enforce limits, detect misuse and help you troubleshoot. The content those tools send us is treated like any other content you create. What the third-party tool itself does with your data is governed by that tool’s own privacy policy.
If you use the Schedpilot Chrome extension, it processes the content you choose to send to Schedpilot (for example a page link, text or image you want to schedule) and your Schedpilot login session. It does not collect your browsing history.
When you use a free tool on schedpilot.com (for example a username checker, calculator, generator or downloader), we process what you type in, such as a username, link or text, to produce the result you asked for. Some tools look up publicly available information from social platforms about the account or link you enter. We use these inputs only to generate your result and to protect the tools from abuse, and we do not use them to build profiles of the people whose accounts are looked up. Please only enter information about other people where you have a legitimate reason to do so.
If you join our affiliate programme, we collect your name, email address, payout details and any tax information required to pay you, and we record the sign-ups and purchases attributed to your referral link so we can calculate your commission. If you arrive at Schedpilot through an affiliate’s link, we record that referral so we can credit the affiliate.
Like most web services, we automatically log your IP address, browser type and version, operating system, referring URL, pages viewed, and the date and time of each request. We also record which features you use inside the app (for example, how often you use the AI caption assistant) so we can see what works and what doesn’t. On the public website we use a self-hosted statistics tool that anonymises and hashes IP addresses and does not use cookies.
If you email us, use our contact form or use in-app chat, we keep the conversation, along with any attachments or screenshots you send, so we can follow up and refer back to it later.
If you leave a comment on the Schedpilot blog we collect the name, email and website you enter in the comment form, plus your IP address and browser user agent, which helps us catch spam. An anonymized hash of your email address may be sent to Gravatar to check for a profile picture. Gravatar’s privacy policy is at https://automattic.com/privacy/.
Your name, email address and, for paid plans, billing details are needed to create an account and enter into a contract with us; without them we cannot provide the Service. Billing details are also required by Romanian tax law. Everything else, such as which accounts you connect or whether you use AI features, is up to you.
This section applies if you sign in with Google or connect a YouTube channel.
What we access. With your consent through Google OAuth 2.0, we access your email address, first and last name, and profile picture (for sign-in), and your YouTube channel data: channel ID and metadata, a list of your uploaded videos with their titles, descriptions and thumbnails, and video performance statistics.
How we use it. We use this data only to authenticate you, show your channel and videos inside Schedpilot so you can pick what to schedule, upload and publish videos to YouTube on your behalf at the scheduled time, edit titles, descriptions and other metadata you ask us to change, and display analytics for videos published through Schedpilot.
Limited Use disclosure. Schedpilot’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: we don’t use Google data for advertising, we don’t sell it, we don’t use it to train AI models, we don’t let humans read it except with your permission, for security reasons or to comply with the law, and we only transfer it to third parties when that transfer is needed to perform the action you requested (i.e. sending your post to YouTube).
YouTube API Services. Schedpilot uses YouTube API Services. By using the YouTube features you also agree to the YouTube Terms of Service. Google’s privacy policy is at https://policies.google.com/privacy. We don’t store your raw video files long term; videos you upload for scheduling are held until they have been published to YouTube and are then removed from our storage within 30 days. Other YouTube data we cache (video lists, statistics) is refreshed regularly and deleted within 30 days of you disconnecting your channel.
You can revoke Schedpilot’s access to your Google data at any time at https://myaccount.google.com/permissions.
Each platform has its own rules about what data developers may access and how it may be used. Schedpilot follows those rules, including Meta’s Platform Terms and Developer Policies, X’s Developer Agreement, LinkedIn’s API Terms and TikTok’s Developer Terms. In every case we use platform data only to provide the scheduling, publishing, engagement and analytics features you’ve asked for. We don’t use it to build advertising profiles, and we don’t sell it.
When you disconnect a platform, or delete your Schedpilot account, we delete the stored tokens and the cached platform data within 30 days. You can also request deletion of your data at any time through our account deletion page.
Under the GDPR we need a legal basis for each use of personal data. Here is how that maps out.
To provide the service (performance of a contract, Art. 6(1)(b) GDPR). Creating and managing your account, connecting the social accounts you choose, storing your posts, publishing them to your connected platforms at the scheduled time, running API and AI agent integrations you set up, showing analytics, processing payments, running the affiliate programme for affiliates, and providing customer support.
With your consent (Art. 6(1)(a) GDPR). Sending marketing emails and newsletters, and setting any non-essential cookies. You can withdraw consent at any time without affecting what happened before, for example by using the unsubscribe link in any marketing email.
Our legitimate interests (Art. 6(1)(f) GDPR). Keeping the service secure and preventing abuse and fraud, fixing bugs, understanding how features are used so we can improve them, running our free tools, crediting affiliates for referrals, processing comments and replies of third parties on your posts so you can manage them, sending you service announcements, and establishing or defending legal claims. We balance these interests against your rights; if you’d rather we didn’t process your data for one of these reasons, see section 9.
Legal obligations (Art. 6(1)(c) GDPR). Keeping invoices and tax records for as long as Romanian and EU law requires, and responding to lawful requests from authorities.
Automated decisions. We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects on you. Automated spam and abuse checks may flag an account for review, but a person makes the final decision on any suspension.
Schedpilot includes optional AI features such as post suggestions, generated posts, hooks and hashtag recommendations. When you use them, the text you enter (and any content you explicitly attach to the request) is sent to our AI provider, OpenAI, to generate a response. Under OpenAI’s API terms, data sent through its API is not used to train its models. We don’t send your connected-account data or your media library to AI providers unless you explicitly attach them to a request. Don’t include sensitive personal data in AI prompts.
We don’t sell personal data. We share it only in these situations.
Social media platforms. When you connect an account or schedule a post, we send the necessary data (your post content, media, and the access token) to that platform’s API. From that point the platform handles the data under its own privacy policy.
Service providers (processors). Companies that help us run Schedpilot and process data only on our instructions, under data processing agreements:
| Purpose | Provider |
|---|---|
| Website hosting | Hostinger |
| Application hosting, databases and backups | Cloud hosting providers |
| Media storage and content delivery | Cloud storage and CDN providers |
| Payments, invoicing and tax calculation | Stripe |
| Transactional email | Postmark (ActiveCampaign) |
| Website statistics | WP Statistics, self-hosted on our own server (no data is sent to a third party) |
| AI features | OpenAI |
| Sign-in with Google | |
| Blog comment avatars | Gravatar (Automattic) |
We’ll keep this list current. If a provider changes, we update this policy rather than notifying you individually, unless the change materially affects how your data is handled. You can ask us for the current list of providers, including their names and locations, at any time.
Your team. Workspace owners and admins can see posts, drafts and activity created by members of their workspace.
Professional advisers and authorities. Our accountants, auditors and lawyers where needed, under confidentiality obligations, and public authorities where required by law, a court order, or to protect the rights, safety or property of Schedpilot, our users or others.
Business transfers. If Schedpilot is acquired or merges with another company, your data may transfer to the new owner. We’d notify you by email before that happens and your data would remain subject to this policy until you’re told otherwise.
We are based in Romania, in the European Union. Some of the providers listed above, including Stripe, OpenAI, Google and Postmark, are based in the United States or process data there. Where personal data leaves the European Economic Area we rely on the EU-US Data Privacy Framework where the provider is certified, the European Commission’s Standard Contractual Clauses, or another lawful transfer mechanism under Chapter V GDPR. You can ask us for a copy of the relevant safeguards. Data you send to social media platforms is transferred to wherever those platforms operate, under their own terms.
| Data | Retention |
|---|---|
| Account and profile data | For as long as your account is active, then deleted within 30 days of account deletion |
| Social media access tokens | Until you disconnect the account or delete your Schedpilot account, then deleted within 30 days |
| Posts, captions and scheduling history | For as long as your account is active; deleted within 30 days of account deletion |
| Uploaded media | Deleted within 30 days after the associated post is published, or when you delete it, whichever is sooner |
| Cached platform data (analytics, video lists, comments) | Refreshed periodically; deleted within 30 days of disconnecting the platform |
| API and integration logs | 90 days |
| Server logs | 90 days |
| Billing records and invoices | 10 years, as required by Romanian accounting law |
| Affiliate records | For as long as you are an affiliate, then as long as needed for accounting and tax purposes (up to 10 years for payment records) |
| Support conversations | 3 years after the last message |
| Blog comments | Until you ask us to delete them, so we can recognise and auto-approve your follow-up comments |
Backups may hold a copy of deleted data for up to 90 additional days before they cycle out. We may keep specific data longer if we need it to establish, exercise or defend a legal claim.
The Schedpilot website and app use these cookies:
Strictly necessary. Session and login cookies that keep you signed in, a CSRF token that protects forms, a cookie that remembers whether your browser accepts cookies, and the cookies our payment processor Stripe sets on checkout pages to prevent fraud. Website login cookies last two days, or two weeks if you tick “Remember me”. Logging out removes them. These cookies don’t need your consent because the service can’t work without them.
Preferences. Language, screen layout and display choices (one year). If you comment on the blog and opt in, your name, email and website are saved in a cookie for one year so you don’t have to retype them.
Analytics. The public website uses WP Statistics, which runs on our own server, does not set cookies, and stores IP addresses only in anonymised and hashed form. We do not use advertising or cross-site tracking cookies. If we ever add non-essential cookies or third-party analytics, we will ask for your consent first through a cookie banner, and you’ll be able to withdraw it at any time.
Blog posts may contain embedded content from other sites (YouTube videos, tweets, images). Embedded content behaves as though you visited the other site directly, and that site may set its own cookies and track your interaction with the embed.
If you’re in the EEA, the UK or Switzerland, you have the right to:
If you’re a California resident, the CCPA/CPRA gives you similar rights to know, delete and correct your data, and to opt out of “sales” or “sharing” of personal information. We don’t sell or share personal information as those terms are defined under California law, and we don’t use sensitive personal information for anything beyond providing the service. We won’t discriminate against you for exercising your rights.
To exercise any right, email admin@schedpilot.com from the address on your account. We’ll respond within one month; for complex or numerous requests we may extend this by up to two further months and will tell you why. We may ask you to confirm your identity first. Exercising your rights is free of charge. Deleting your account can also be done directly from your account settings without contacting us.
If you are someone whose data reaches us through one of our customers (for example, you commented on a post managed with Schedpilot, or you were invited to a workspace), our customer is usually the controller of that data. You can still contact us and we’ll help or forward your request.
We use HTTPS for all traffic, encrypt access tokens at rest with AES-256, hash passwords with bcrypt, restrict staff access to production data on a need-to-know basis, and keep audit logs of administrative actions. We review our infrastructure and dependencies regularly. No online service can promise perfect security, so if you believe your account has been compromised, change your password and contact us immediately.
If a personal data breach occurs, we’ll notify the relevant supervisory authority within 72 hours of becoming aware of it where the GDPR requires, and we’ll notify you without undue delay if the breach is likely to result in a high risk to your rights and freedoms.
Schedpilot is intended for adults. You must be at least 18 years old to create an account, and we don’t knowingly collect data from children. If you believe a child has created an account or given us personal data, email us and we’ll delete it.
We may update this policy from time to time. Minor changes take effect when posted. For material changes, such as new purposes for processing or new categories of data shared with third parties, we’ll email account holders at least 14 days before the change takes effect. The effective date at the top tells you when the policy was last revised.
SITEMILE SRL
Str. Vasile Bideac nr. 4A, Chitila, Ilfov County, Romania
Trade Register no. J2012002424236 · CUI 30584106 · VAT RO30584106
Email: admin@schedpilot.com
Schedule posts, find your best time to publish, and keep your calendar full — without the chaos. SchedPilot makes consistency simple across every channel.
Start for freeFree trial available. Cancel anytime.
SchedPilot