Privacy Policy

This policy explains what personal data Loudpilot (“Loudpilot”, “we”) collects when you use https://loudpilot.app and the Loudpilot apps and API, why we collect it, who we share it with and what you can do about it. Questions: info@brandrepublic.ge.

1. Data we collect

Account data

• Your name and email address, and whether the email is verified.
• A one-way hash of your password, if you set one. We never store the password itself.
• Your Google account id and email, if you sign in with Google.
• A login session: a random token kept in a cookie; we store only its hash. Sign-in links sent by email are stored the same way and expire.

Workspace content

• Your brand kit: website, description, voice, audience, colours, fonts, logo and social links — including what we read from the public website you ask us to import.
• Posts, campaigns, blog articles, designs, hashtag libraries and bio pages you create.
• Images and files you upload or generate.
• Your credit balance and a log of credit purchases and spending.

Connected social accounts

When you connect a Facebook Page, an Instagram professional account or another network, we receive from that platform the account id, name, profile picture and an access token, plus — depending on the permissions you grant — the posts we publish for you, their insights (reach, impressions, engagement), your ad accounts, campaigns, budgets and results, and messages, comments and leads sent to your pages. Access tokens are stored encrypted.

Bio page visitors

For public bio pages we count views and which link was clicked. We do not store visitors' IP addresses, set cookies on them or use third-party trackers.

What we do not collect

We use no advertising or analytics trackers on our site and set no cookies other than the login session cookie. We never sell personal data.

2. Why we use it

• To run your account and sign you in (performance of our contract with you).
• To generate content, plans, forecasts and recommendations you ask for, and to publish, schedule and measure posts and ads on the accounts you connect (contract).
• To send service email: sign-in links, password resets and alerts you turn on (contract).
• To prevent abuse, such as limiting repeated failed logins (legitimate interest in security).
• To keep records the law requires, such as payment records (legal obligation).

Data received from Meta, Google or other platforms is used only to provide Loudpilot features to the account that connected it. It is not used to build profiles of people, not sold, and not used to target ads outside your own campaigns.

3. Who processes data for us

• Google (Gemini API) — receives the text, images and brand details needed to generate content or recommendations you request.
• Google Sign-In — only if you choose to sign in with Google.
• Meta and other social networks — receive the posts, ads and replies you choose to publish through Loudpilot, under their own terms and privacy policies.
• Our hosting provider — runs the servers that store the database and files.

If you use Loudpilot through a partner product (for example a CRM that embeds Loudpilot), that partner gave us your workspace name and its own reference id, and may see your credit balance and activity in its product. The partner's own privacy policy covers what it does with your data.

4. How long we keep it

• Account and workspace data: while your account is open.
• Disconnected social accounts: tokens are deleted at once; data fetched from them within 30 days.
• After you delete your account: everything is deleted within 30 days, except records we must keep by law (such as payment records).
• Sessions expire after 30 days; sign-in links expire within an hour and work only once.

5. Your rights

You can access, correct, export or delete your data, object to or restrict its processing, and withdraw consent you gave (for example by disconnecting a social account). Write to info@brandrepublic.ge from the email on your account. You may also complain to the Personal Data Protection Service of Georgia or the authority where you live.

How to delete your data, including data received from Facebook and Instagram, is described on the data deletion page.

6. Security

Traffic is encrypted with HTTPS. Passwords are hashed, social tokens are encrypted, partner API keys are stored only as hashes, and media files are served only to members of the workspace that owns them (or publicly, if you publish them on a bio page).

7. International transfers

Google and Meta may process data outside Georgia. They do so under their own data-transfer safeguards.

8. Children

Loudpilot is a business tool and is not meant for anyone under 16.

9. Changes

We will update this page when our practices change and change the date above. For significant changes we will also email account owners.

10. Contact

Loudpilot. Email: info@brandrepublic.ge.