Privacy Policy

AutoTraction is a marketing platform for solo founders, operated by Rimfrost LLC, United States, which is the data controller for the personal data described here. This policy explains, in plain language, what data we collect, why we collect it, who processes it, and how to get it deleted. If anything here is unclear, email us and we will give you a straight answer.

What we collect and why

Account. Your email address and a password (or your Google sign-in), handled by Supabase Auth. We need this to know which workspace is yours.

Brand inputs. What you tell us about your product, audience, and voice during onboarding. This is the raw material for everything we draft for you.

Connected accounts. When you connect a social or ad account (Meta, X, TikTok, LinkedIn, Reddit), the platform gives us an access token limited to the scopes you approved. We store these tokens encrypted at rest with AES-256-GCM, alongside the account id and display name so you can see what is connected.

Content. Drafts, published posts, launch assets, and other marketing material we generate for you or you write in the product.

Site analytics. If you install our tracking snippet on your own site, it sends us events from that site: pageviews, signups, purchases, the page URL, referrer, UTM parameters, ad click ids, and a random per-browser session id kept in localStorage. This exists so you can see which marketing actually works. We do not use it to build profiles of your visitors across other sites.

Billing. Payments run through Stripe-hosted checkout. Card numbers go to Stripe, never to us. We store your Stripe customer id and a ledger of the credits you have bought and spent.

Outreach data. If you use outreach, we store the leads you source (names, emails, companies), the mailboxes used to send, the messages sent and replies received, and a suppression list so people who opt out stay opted out.

What we never do

• We never sell your data, or anyone else's data, to anyone.
• We never post, message, or act on a connected account beyond what you have explicitly authorized in the product.
• We never read or request data from connected accounts beyond the scopes you granted when connecting them.

Third-party processors

We use a small set of services to run AutoTraction. Each one only receives what it needs:

• Supabase: database and authentication.
• Vercel: application hosting.
• Cloudflare: DNS, domain registration, and email routing for domains managed through the product.
• Stripe: payments and billing.
• Anthropic and OpenRouter: AI text generation. Your brand inputs and content prompts are sent to these providers to generate drafts.
• InboxKit: outreach mailbox provisioning.
• Platform APIs (Google/YouTube, Meta, X, TikTok, LinkedIn, Reddit): used to publish and manage what you approved, on the accounts you connected.

Google user data

When you connect a YouTube channel, we request two scopes: youtube.upload and youtube.readonly. From these we receive and store your channel id and channel name, the video ids of videos we published for you, and their public view, like and comment counts.

Who we share it with. We do not sell, rent, or trade Google user data, and we do not share it for advertising, profiling, or credit purposes. We do not transfer it to any third party except:

• Supabase (database hosting, France) and Vercel (application hosting, United States), which store it on our behalf as processors under contract.
• Google itself, when we call the YouTube Data API to publish or read on your behalf.
• Where we are legally required to, such as a valid court order, or to investigate abuse or a security incident.

Google user data is never sent to our AI providers. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we protect your data

• In transit. Every connection to AutoTraction and to every API we call is encrypted with TLS 1.2 or higher. We do not accept unencrypted connections.
• At rest. Databases, backups and file storage are encrypted at rest with AES-256 by our infrastructure providers.
• OAuth tokens. Access and refresh tokens for connected accounts, including Google, are additionally encrypted by us with AES-256-GCM before they are written to the database, using a key held outside the database. A copy of the database alone does not yield a usable token.
• Access control. Your data is scoped to your workspace and unreachable by other customers. Administrative access to production is limited to the company's engineers and is used only to operate and support the service.
• Deletion. Disconnecting a channel deletes its stored tokens immediately. Deleting your account deletes the Google user data we hold, as described below.

Data retention

We keep your data for as long as your account is active. When you delete your account, or ask us to, we delete your workspace data: brand inputs, content, connected-account tokens, analytics events, and outreach records. Billing records are kept as long as tax and accounting law requires. Backups roll off on the infrastructure providers' standard schedules.

Deletion rights

Email support@autotraction.ai from your account email and we will delete your data. No forms, no retention offers.

If you connected a Meta account, you can also trigger deletion from Meta itself: remove AutoTraction in your Facebook settings and Meta will send us a deletion request. We delete the stored connection and tokens and give you a confirmation code you can check on our data deletion status page.

Cookies

The app uses cookies for one thing: keeping you signed in (the Supabase auth session). No advertising cookies, no third-party tracking cookies. The analytics snippet you may install on your own site does not set cookies either; it keeps a random session id in the browser's localStorage on your site.

Contact

Questions about this policy or your data: support@autotraction.ai.