Privacy Policy

1. Scope & Who We Are

Autoadify ("we", "us", "our") is operated by Tech Evolve Consulting (OPC) Private Limited, a company registered in India. Our website is available at autoadify.com.

This Privacy Policy describes how Tech Evolve Consulting (OPC) Private Limited ("Autoadify") collects, uses, discloses, and protects personal information when you visit autoadify.com, create an account, or use our AI social media management platform (the "Service").

For users in the EEA and UK, Autoadify acts as the data controller for personal data processed under this Policy. Where we process data on your behalf (e.g., your social media audience data), we act as a data processor.

This Policy does not apply to third-party platforms (Meta, TikTok, LinkedIn, Reddit, X, Shopify, WooCommerce) that you connect to Autoadify, or to Dodo Payments, our Merchant of Record. Their own privacy policies govern their data practices.

2. Information We Collect

2.1 Account & Identity Information

• Name, email address, and password (hashed) when you register;
• Business name, website, and industry (optional profile information);
• Billing name, billing address, country, and tax identifiers, and payment card details — collected and processed by Dodo Payments, our Merchant of Record (see Section 4.1). We do not receive or store full card numbers.

2.2 Social Media Account Data (via OAuth)

When you connect a social media account, the relevant platform provides us with an OAuth access token and, depending on the permissions you grant:

• your public profile information (username, profile picture, page/channel name);
• account identifiers required to publish content on your behalf;
• performance metrics (impressions, reach, engagement) for content published through Autoadify;
• audience demographics (in aggregate form only, where provided by the platform).

We do not access or store your social media passwords. OAuth tokens are encrypted at rest. You can revoke access at any time from your account settings or directly on the platform.

2.3 Content You Create or Upload

• Text, images, video, and audio you create using Autoadify's AI tools;
• Content prompts and instructions you submit to AI models;
• Scheduled posts and content drafts;
• Shopify and WooCommerce product data synced to your account (product names, images, descriptions, prices).

2.4 Usage & Technical Data

• Log data: IP address, browser type and version, OS, referrer URL, pages visited, timestamps;
• Device identifiers and session IDs;
• Feature usage patterns (tools used, scheduling frequency, AI model preferences);
• Error logs and crash reports to diagnose and fix bugs.

2.5 Communications

• Messages you send to our support team;
• Feedback, survey responses, and feature requests;
• Waitlist registration email addresses.

2.6 Content Safety Records

Prompts, briefs and posts you submit are screened against our Acceptable Use policy before we generate or publish them. Where a submission is declined, we record the account and user concerned, the date and time, the category and severity of the breach, the reason shown to you, the identifier of the model that made the assessment, and the first 500 characters of the submitted text. This is described in full in Section 6.1.

3. How We Use Your Information

We do not use your content, social media data, or AI-generated outputs to train AI models without your explicit, informed consent.

4. How We Share Your Information

We do not sell your personal information. We share data only as described below:

4.1 Payments — Dodo Payments (Merchant of Record)

Payments for Autoadify subscriptions and credit purchases are processed by Dodo Payments, which acts as the Merchant of Record for those transactions. Dodo Payments is therefore an independent data controller (not our processor) for the payment data it collects: it is the party you contract with for the purchase, and it is responsible for billing, invoicing, fraud screening, and the collection and remittance of applicable sales tax, VAT, and GST.

Dodo Payments collects your payment card or other payment instrument details, billing name and address, country, and any tax identifiers directly from you. We never receive or store your full card number. Dodo Payments shares back with us only what we need to operate your account — transaction and subscription identifiers, plan, amount, currency, payment status, and the last four digits and brand of your card. Dodo Payments' handling of your data is governed by its own privacy policy, available at dodopayments.com/privacy-policy.

4.2 Other Service Providers

We use trusted third-party vendors who process data on our behalf under data processing agreements:

• Supabase — database hosting and authentication (AWS data centres);
• Vercel — web hosting and edge network;
• Resend / SendGrid / Postmark (or equivalent) — transactional email;
• Vercel Analytics — privacy-preserving usage analytics.

4.3 Legal Disclosures

We may disclose your information if required by law, court order, or governmental authority, or where disclosure is necessary to protect our rights, prevent fraud, or respond to a safety emergency.

4.4 Business Transfers

If Autoadify is involved in a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you before your data becomes subject to a different privacy policy.

4.5 With Your Consent

We may share data with additional third parties where you have provided explicit consent.

5. Social Media Platform API Data

5.1 Meta (Instagram & Facebook)

We request OAuth permissions to publish posts and reels and to retrieve account insights. Meta user data is used solely to provide the Service features you have enabled. We comply with Meta's Platform Terms and data use restrictions and do not share Meta user data with unrelated third parties.

You can request deletion of the Meta data associated with your account at any time — see Section 5.5, Data Deletion Requests.

5.2 TikTok

We request permissions to upload videos and retrieve basic account metrics. TikTok data is used strictly to fulfil the scheduling and publishing features you activate and is not shared with unrelated third parties.

What we receive. When you connect a TikTok account, TikTok's Login Kit provides us with your open_id and union_id (stable identifiers TikTok assigns to your account for our application), your display name, your avatar image URL, and your username. When you publish through Autoadify we additionally receive the publish status and the post identifier for the content we posted on your behalf, and the view, like, comment and share counts for those posts. We do not read your direct messages, your follower or following lists, your drafts, or any post that Autoadify did not publish.

How we use TikTok data. We use data obtained from the TikTok API only to operate the features you have asked for: showing you which account is connected, publishing the content you compose, and reporting the performance of those posts back to you. We do not sell TikTok data; we do not use it for advertising, targeting or solicitation; we do not use it to build or supplement profiles or databases; and we do not share it with any third party other than the infrastructure providers identified in this policy who host it on our behalf.

TikTok data and AI providers. We do not use TikTok data to train, fine-tune, or evaluate machine-learning models, and we do not send it to the AI providers listed in Section 6. For clarity: when you use Autoadify's AI features, the prompts, images, captions and other content you create are processed by those providers because you asked us to generate or edit that content. Identifiers, profile fields and post metrics obtained from the TikTok API are never included in those requests.

5.3 LinkedIn, Reddit, X (Twitter)

We access these platforms' APIs solely to publish content and retrieve basic performance metrics on your behalf. Data obtained is used only to provide the features you have enabled and is not used for advertising targeting or sold to third parties.

5.4 E-Commerce (Shopify & WooCommerce)

When you connect your store, we access product catalogues (names, images, descriptions, prices, URLs) to generate and schedule social media content. We do not access customer data, order data, or payment information from your store.

5.5 Data Deletion Requests

You can request deletion of your Autoadify account data and of the data we hold from any connected platform at any time. Two routes are available and both are honoured equally:

• use our data deletion page at app.autoadify.com/data-deletion, which also handles Meta's Data Deletion Request Callback and returns a confirmation code you can use to track the request; or
• email privacy@autoadify.com from the address on your account.

You may also disconnect an individual platform at any time from your account settings or from that platform's own app permissions screen, which revokes our access token immediately. Deletion is completed within the timeframes set out in Section 7.

6. AI Model Providers

To generate content, Autoadify sends your prompts and inputs to third-party AI providers via their APIs:

We do not pass personally identifying information (such as your name or email) to AI providers unless you include it in your prompts. We select providers who commit to not using API input data to train their models where such opt-out policies are available.

Data obtained from a connected platform's API is not sent to these providers. In particular, identifiers, profile fields and post metrics obtained from the TikTok API are never included in AI requests and are never used to train, fine-tune, or evaluate models — see Section 5.2, TikTok.

6.1 Content Safety Screening

What we process. When you submit a prompt, brief or post for generation or publication, that text is sent to a third-party AI provider for a safety assessment before it is acted on. Where the assessment is that the request breaches our Acceptable Use policy, we record: the account and user concerned, the date and time, the category and severity of the breach, the reason given to you, the identifier of the model that made the assessment, and the first 500 characters of the submitted text.

Why. To comply with our obligations under the Information Technology Act, 2000 and the rules made under it; to protect users and third parties from harmful content; to enforce our Terms of Use; and to investigate complaints. Under the GDPR we rely on legal obligation and on our legitimate interests in keeping the Service and its users safe; under the DPDP Act, 2023 we rely on the legitimate uses provided for in connection with compliance with law.

Where it goes. Content submitted for assessment is processed by our AI provider outside India. We do not permit providers to use content submitted through the Service to train their models.

How long we keep it. The extract of submitted text is deleted after 90 days. The record that a refusal occurred, and its category, is retained for 24 months so that we can identify repeated misuse and respond to complaints.

Who sees it. Screening records are available only to authorised personnel reviewing a complaint, an appeal, or a suspected pattern of misuse. They are not used for advertising, for profiling for marketing, or for any purpose unrelated to safety and enforcement.

Automated screening is imperfect in both directions, and a decision not to block content is not our approval of it. If you believe a decision about your content is wrong, see Section 9, Automated Decision-Making.

7. Data Retention

When you delete your account, we will delete or anonymise your personal data within 30 days, subject to legal retention requirements. You can start a deletion request at app.autoadify.com/data-deletion or by emailing privacy@autoadify.com (see Section 5.5).

TikTok Data Retention & Deletion

Disconnecting a TikTok account in Autoadify revokes our access token with TikTok and deletes the access token, refresh token and profile fields we stored for that account. You can also revoke Autoadify's access at any time from TikTok itself, under Settings and privacy → Security and permissions → Manage app permissions. Post metrics kept for your analytics history are deleted within 30 days of you deleting your Autoadify account. We will delete all data obtained through the TikTok API on TikTok's request, or if our authorisation under the TikTok Developer Terms of Service ends.

8. Security

We implement industry-standard security measures to protect your data:

• Encryption in transit: all data transmitted uses TLS 1.2+;
• Encryption at rest: sensitive data (OAuth tokens, passwords) is encrypted using AES-256 or equivalent;
• Access controls: role-based access limits employee access to personal data on a need-to-know basis;
• Vulnerability management: regular security assessments and dependency updates;
• Incident response: we maintain a data breach response plan and will notify affected users and authorities within the timeframes required by law.

No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately at privacy@autoadify.com.

9. Your Rights — EEA & UK (GDPR)

• Right of Access: request a copy of the personal data we hold about you;
• Right to Rectification: request correction of inaccurate or incomplete data;
• Right to Erasure: request deletion of your personal data (subject to legal retention obligations) — by email or directly at app.autoadify.com/data-deletion;
• Right to Restriction: request that we restrict processing in certain circumstances;
• Right to Data Portability: receive your data in a machine-readable format;
• Right to Object: object to processing based on legitimate interests (including direct marketing);
• Right to Withdraw Consent: withdraw consent at any time where processing is consent-based;
• Automated Decision-Making: right not to be subject to decisions made solely by automated processing that produce significant legal effects.

You also have the right to lodge a complaint with your national supervisory authority (e.g., the ICO in the UK).

Automated Decision-Making & Human Review

Decisions to decline a generation or publication request are made automatically, by an AI classification model applied to the text of your request (see Section 6.1). Decisions to suspend or terminate an account are not automated and are taken by a member of our team.

If an automated decision has been made about your content and you believe it is wrong, you may contact our Grievance Officer at grievance@autoadify.com to have the decision reviewed by a member of our team, to express your point of view, and to contest the outcome.

International Transfers

Autoadify is operated from India. If you are in the EEA or UK, your data will be transferred to and processed in India, and may also be processed in the United States and other countries where our sub-processors operate. India is not covered by a European Commission adequacy decision, so we rely on Standard Contractual Clauses (SCCs) — and, for UK transfers, the UK International Data Transfer Addendum — together with supplementary technical and organisational measures to ensure an adequate level of protection. You may request a copy of the transfer mechanism we rely on by writing to privacy@autoadify.com.

10. Your Rights — California (CCPA / CPRA)

If you are a California resident, the CCPA as amended by the CPRA grants you the following rights:

• Right to Know: request information about categories and specific pieces of personal information we collect, use, disclose, and sell;
• Right to Delete: request deletion of your personal information — by email or directly at app.autoadify.com/data-deletion;
• Right to Correct: request correction of inaccurate personal information;
• Right to Opt Out of Sale / Sharing: we do not sell or share personal information for cross-context behavioural advertising;
• Right to Limit Sensitive Personal Information: we do not use sensitive personal information beyond what is necessary to provide the Service;
• Right to Non-Discrimination: we will not discriminate against you for exercising your CCPA rights.

To exercise your rights, email privacy@autoadify.com with the subject "California Privacy Rights Request." We will verify your identity and respond within 45 days.

Categories of Personal Information (12-Month Summary)

We collect identifiers, internet activity data, commercial information (subscription records), and inferences drawn from usage data. We disclose these categories to service providers for business purposes. We do not sell personal information.

11. Your Rights — India (DPDP Act, 2023)

Tech Evolve Consulting (OPC) Private Limited is incorporated in India and acts as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act") in respect of the personal data described in this Policy. If you are a Data Principal — an individual whose personal data we process — the following applies to you.

Notice & Consent

We process your personal data for the purposes set out in Section 3 of this Policy. Where we rely on your consent, that consent is sought for a specified purpose, is free, informed, specific and unconditional, and may be withdrawn at any time with the same ease with which it was given by emailing privacy@autoadify.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and may limit your ability to use parts of the Service. We also process personal data for certain legitimate uses permitted under Section 7 of the DPDP Act, such as where you voluntarily provide data for a specified purpose or where processing is required to comply with law.

Purpose & Data Minimisation

We collect only the personal data necessary for the specified purpose, retain it in line with Section 7 of this Policy, and erase it when the purpose is no longer served and retention is no longer required by law.

Your Rights as a Data Principal

• Right to Access Information: a summary of the personal data we process, the processing activities undertaken, and the identities of other Data Fiduciaries and Processors with whom it has been shared;
• Right to Correction & Erasure: to have inaccurate or misleading data corrected, incomplete data completed, and data erased where it is no longer needed for the purpose it was collected for — erasure can be requested at app.autoadify.com/data-deletion or by email;
• Right of Grievance Redressal: to a readily available means of raising a grievance with us, described below;
• Right to Nominate: to nominate another individual to exercise these rights on your behalf in the event of your death or incapacity;
• Duties: the DPDP Act also requires you not to impersonate another person, suppress material information, or file false or frivolous grievances.

Grievance Redressal

To exercise any of these rights, or to raise a grievance about our handling of your personal data, contact our Grievance Officer at grievance@autoadify.com (details in Section 16). We acknowledge grievances within 24 hours and aim to resolve them within 15 days. If your grievance remains unresolved, you may escalate it to the Data Protection Board of India.

12. Cookies & Tracking Technologies

We do not use third-party advertising cookies or cross-site behavioural tracking technologies. You can control cookies through your browser settings. Disabling essential cookies will impair Service functionality.

13. Children's Privacy

The Service is not directed to children under 13 years of age (or under 16 in certain EEA member states). We do not knowingly collect personal information from children. If we become aware that we have collected data from a child without verified parental consent, we will delete it promptly.

If you believe a child has provided us with their personal information, contact us at privacy@autoadify.com.

14. Third-Party Links & Integrations

The Service may contain links to third-party websites or integrate with third-party services. This Privacy Policy does not apply to those third parties. We encourage you to read the privacy policies of any third-party services you connect or visit.

15. Changes to This Privacy Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email and/or a prominent notice at least 14 days before taking effect. We encourage you to review this Policy regularly.

16. Contact Us, Grievance Officer & Data Protection Officer

For questions, requests, or complaints regarding this Privacy Policy, please contact:

If you have an unresolved privacy concern, you may contact your local data protection authority.