Effective date: September 15, 2026
Schedpilot is a social media scheduling application at https://schedpilot.com and https://app.schedpilot.com that lets you connect social media accounts, plan and publish posts, and review how those posts performed. This policy explains what personal data we collect when you use the website and the app, why we collect it, who we share it with, and what choices you have.
Schedpilot is operated by [Sitemile SRL], [Romania], Romania (referred to as “Schedpilot”, “we” or “us”). For the purposes of the EU General Data Protection Regulation (GDPR), we are the data controller for the personal data described in this policy.
If you have questions or want to exercise any of your rights, email us at admin@schedpilot.com.
When you create an account we collect your name, email address and password (stored hashed, never in plain text). If you sign up with Google, we receive your name, email address and profile picture from Google instead of a password. If you buy a paid plan we also collect billing details such as company name, billing address and VAT number. Card numbers are handled by our payment processor and never touch our servers.
Schedpilot works by connecting to your social media accounts through each platform’s official API. When you connect an account we receive and store:
We only request the permissions each platform requires for scheduling and analytics. We never receive your social media passwords.
Tokens are stored encrypted with AES-256. You can disconnect any account at any time from the Schedpilot dashboard, which deletes the stored token. You can also revoke Schedpilot’s access from within the platform itself (for example, Google Account permissions at https://myaccount.google.com/permissions, or Facebook’s Business Integrations settings).
Posts, captions, hashtags, images, videos, links, drafts, comments, labels and schedules that you create in Schedpilot are stored so that we can publish them at the time you choose and show them in your calendar and history. Uploaded media is stored in [storage provider, e.g. Amazon S3 / Cloudflare R2, region].
Uploaded photos and videos may contain embedded metadata (EXIF), including GPS location. We don’t use this metadata for tracking, but the social media platforms you publish to may read it according to their own policies. If that concerns you, strip the metadata before uploading.
If you invite team members to your workspace, we collect their name and email address to send the invitation and set up their account. If you are invited by someone else, the workspace owner can see the posts you create and your activity within that workspace.
Like most web services, we automatically log your IP address, browser type and version, operating system, referring URL, pages viewed, and the date and time of each request. We also record which features you use inside the app (for example, how often you use the AI caption assistant) so we can see what works and what doesn’t.
If you email us or use in-app chat, we keep the conversation, along with any attachments or screenshots you send, so we can follow up and refer back to it later.
If you leave a comment on the Schedpilot blog we collect the name, email and website you enter in the comment form, plus your IP address and browser user agent, which helps us catch spam. An anonymized hash of your email address may be sent to Gravatar to check for a profile picture. Gravatar’s privacy policy is at https://automattic.com/privacy/.
This section applies if you sign in with Google or connect a YouTube channel.
What we access. With your consent through Google OAuth 2.0, we access your email address, first and last name, and profile picture (for sign-in), and your YouTube channel data: channel ID and metadata, a list of your uploaded videos with their titles, descriptions and thumbnails, and video performance statistics.
How we use it. We use this data only to authenticate you, show your channel and videos inside Schedpilot so you can pick what to schedule, upload and publish videos to YouTube on your behalf at the scheduled time, edit titles, descriptions and other metadata you ask us to change, and display analytics for videos published through Schedpilot.
Limited Use disclosure. Schedpilot’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: we don’t use Google data for advertising, we don’t sell it, we don’t use it to train AI models, we don’t let humans read it except with your permission, for security reasons or to comply with the law, and we only transfer it to third parties when that transfer is needed to perform the action you requested (i.e. sending your post to YouTube).
YouTube API Services. Schedpilot uses YouTube API Services. By using the YouTube features you also agree to the YouTube Terms of Service. Google’s privacy policy is at https://policies.google.com/privacy. We don’t store your raw video files long term; videos you upload for scheduling are held until they have been published to YouTube and are then removed from our storage within [30] days. Other YouTube data we cache (video lists, statistics) is refreshed regularly and deleted within 30 days of you disconnecting your channel.
You can revoke Schedpilot’s access to your Google data at any time at https://myaccount.google.com/permissions.
Each platform has its own rules about what data developers may access and how it may be used. Schedpilot follows those rules, including Meta’s Platform Terms and Developer Policies, X’s Developer Agreement, LinkedIn’s API Terms and TikTok’s Developer Terms. In every case we use platform data only to provide the scheduling, publishing and analytics features you’ve asked for. We don’t use it to build advertising profiles, and we don’t sell it.
When you disconnect a platform, or delete your Schedpilot account, we delete the stored tokens and the cached platform data within 30 days.
Under the GDPR we need a legal basis for each use of personal data. Here is how that maps out.
To provide the service (performance of a contract). Creating and managing your account, storing your posts, publishing them to your connected platforms at the scheduled time, showing analytics, processing payments and providing customer support.
With your consent. Connecting a social media account (you grant consent through the platform’s OAuth screen), sending marketing emails, setting non-essential cookies. You can withdraw consent at any time without affecting what happened before.
Our legitimate interests. Keeping the service secure and preventing abuse, fixing bugs, understanding how features are used so we can improve them, and sending you service announcements. We balance these interests against your rights; if you’d rather we didn’t process your data for one of these reasons, see section 9.
Legal obligations. Keeping invoices and tax records for as long as Romanian and EU law requires, and responding to lawful requests from authorities.
Schedpilot includes optional AI features such as caption suggestions and hashtag recommendations. When you use them, the text you enter is sent to our AI provider, [provider, e.g. OpenAI / Anthropic], to generate a response. We have contractual assurances that this provider does not use your inputs to train its models. We don’t send your connected-account data or your media library to AI providers unless you explicitly attach them to a request.
We don’t sell personal data. We share it only in these situations.
Social media platforms. When you connect an account or schedule a post, we send the necessary data (your post content, media, and the access token) to that platform’s API. From that point the platform handles the data under its own privacy policy.
Service providers (processors). Companies that help us run Schedpilot and process data only on our instructions:
| Purpose | Provider |
|---|---|
| Hosting and infrastructure | [e.g. Hetzner / AWS], [region] |
| Media storage | [e.g. Amazon S3 / Cloudflare R2] |
| Payments and invoicing | [e.g. Stripe / Paddle] |
| Transactional email | [e.g. Postmark / SendGrid] |
| Customer support | [e.g. Crisp / Intercom] |
| Product analytics | [e.g. PostHog / Plausible] |
| Error monitoring | [e.g. Sentry] |
| AI features | [provider] |
We’ll keep this list current. If a provider changes, we update this policy rather than notifying you individually, unless the change materially affects how your data is handled.
Your team. Workspace owners and admins can see posts, drafts and activity created by members of their workspace.
Legal reasons. If required by law, a court order, or to protect the rights, safety or property of Schedpilot, our users or others.
Business transfers. If Schedpilot is acquired or merges with another company, your data may transfer to the new owner. We’d notify you by email before that happens and your data would remain subject to this policy until you’re told otherwise.
Our servers are located in [the European Union]. Some of the providers listed above are based in the United States or process data there. Where personal data leaves the European Economic Area we rely on the European Commission’s Standard Contractual Clauses, the EU-US Data Privacy Framework where the provider is certified, or another lawful transfer mechanism. Data you send to social media platforms is transferred to wherever those platforms operate, under their own terms.
| Data | Retention |
|---|---|
| Account and profile data | For as long as your account is active, then deleted within 30 days of account deletion |
| Social media access tokens | Until you disconnect the account or delete your Schedpilot account, then deleted within 30 days |
| Posts, captions and scheduling history | For as long as your account is active; deleted within 30 days of account deletion |
| Uploaded media | Deleted within [30] days after the associated post is published, or when you delete it, whichever is sooner |
| Cached platform data (analytics, video lists) | Refreshed periodically; deleted within 30 days of disconnecting the platform |
| Server logs | 90 days |
| Billing records and invoices | 10 years, as required by Romanian accounting law |
| Support conversations | 3 years after the last message |
| Blog comments | Indefinitely, so we can recognise and auto-approve your follow-up comments |
Backups may hold a copy of deleted data for up to 30 additional days before they cycle out.
The Schedpilot website and app use these cookies:
Strictly necessary. Session and login cookies that keep you signed in, a CSRF token that protects forms, and a cookie that remembers whether your browser accepts cookies. Login cookies last two days, or two weeks if you tick “Remember me”. Logging out removes them.
Preferences. Screen layout and display choices (one year). If you comment on the blog and opt in, your name, email and website are saved in a cookie for one year so you don’t have to retype them. If you edit or publish a post through the dashboard, a cookie storing that post’s ID is set for one day.
Analytics. We use [analytics tool] to understand how the site and app are used. [If using a cookieless tool such as Plausible, say so and delete the consent sentence below.] These cookies are set only with your consent, which you can withdraw through the cookie banner or your browser settings.
Blog posts may contain embedded content from other sites (YouTube videos, tweets, images). Embedded content behaves as though you visited the other site directly, and that site may set its own cookies and track your interaction with the embed.
If you’re in the EEA, the UK or Switzerland, you have the right to:
If you’re a California resident, the CCPA/CPRA gives you similar rights to know, delete and correct your data, and to opt out of “sales” or “sharing” of personal information. We don’t sell or share personal information as those terms are defined under California law, and we don’t use sensitive personal information for anything beyond providing the service. We won’t discriminate against you for exercising your rights.
To exercise any right, email admin@schedpilot.com from the address on your account. We’ll respond within 30 days. We may ask you to confirm your identity first. Exporting your data and deleting your account can also be done directly from your account settings without contacting us.
We use HTTPS for all traffic, encrypt access tokens at rest with AES-256, hash passwords with bcrypt, restrict staff access to production data on a need-to-know basis, and keep audit logs of administrative actions. We review our infrastructure and dependencies regularly. No online service can promise perfect security, so if you believe your account has been compromised, change your password and contact us immediately.
If a data breach affects your personal data in a way that is likely to put your rights at risk, we’ll notify you and the relevant supervisory authority as required by law, within 72 hours of becoming aware of it where the GDPR applies.
Schedpilot is not intended for anyone under 16 (or the age of digital consent in your country, if higher). We don’t knowingly collect data from children. If you believe a child has created an account, email us and we’ll delete it.
We may update this policy from time to time. Minor changes take effect when posted. For material changes, such as new purposes for processing or new categories of data shared with third parties, we’ll email account holders at least 14 days before the change takes effect. The effective date at the top tells you when the policy was last revised.
[Legal entity name] [Registered address] Romania Email: admin@schedpilot.com
If you’d rather write to a dedicated privacy contact: [privacy@schedpilot.com]
Schedule posts, find your best time to publish, and keep your calendar full — without the chaos. SchedPilot makes consistency simple across every channel.
Start for freeFree trial available. Cancel anytime.
SchedPilot