Privacy Policy

This Privacy Policy explains what Autopulto ("we", "us") collects when you use Autopulto (the "Service"), how we use it, and your choices.

1. Information we collect

• Account & organization data — your name, email, organization name, and login credentials (passwords are stored only as salted hashes).
• Product & content data — the product details, website URLs, uploaded documents, and marketing content you create or generate.
• Connected-account credentials — when you connect a third-party platform, we store the access tokens needed to act on your behalf: to publish, or, for read-only connections such as Google Search Console (section 11), only to read. These are encrypted at rest. We never receive or store your platform passwords — connections use each platform's official sign-in.
• Search performance data — if you connect Google Search Console, the search queries, pages, impressions, clicks and ranking positions for the properties you choose. See section 11.
• Billing data — handled by our payment processor (Stripe); we store a customer/subscription reference, not your full card details.
• Usage & metering — actions taken, credits consumed, logs, and basic device/analytics data needed to run and secure the Service.

2. How we use it

• To provide the Service — generate, schedule, and publish content you direct.
• To meter usage, bill paid plans, and prevent abuse.
• To secure, maintain, and improve the Service and provide support.
• To communicate with you about your account and important changes.

3. Service providers & sharing

We share data with providers who help us run the Service, only as needed:

• AI providers (e.g. Anthropic, Google) — to generate content from your inputs, under their terms and usage policies.
• Payment processor (Stripe) — to process payments.
• Search data provider (DataForSEO) — to look up real search volume, keyword difficulty and search results for the keywords we plan content around, to check where your site ranks for them, and to see which sites link to yours. We send the keyword phrases we are considering and your site's domain; we do not send your account details or your customers' data.
• Hosting & infrastructure — to run and deliver the Service.
• Platforms you connect — we send the content you direct us to publish to those platforms.

We do not sell your personal information. We may disclose information if required by law or to protect rights and safety.

4. Data retention

We keep your data while your account is active and as needed to provide the Service, meet legal obligations, resolve disputes, and enforce agreements. You can delete content or close your account; some records may be retained as required by law.

5. Security

We use technical and organizational measures to protect your data, including encryption of connected-account secrets at rest and encrypted transport (HTTPS). No system is perfectly secure, but we work to protect your information.

6. Your rights

Depending on where you live (e.g. under GDPR or CCPA), you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these, contact us at support@autopulto.com.

7. Cookies and browser storage

We use strictly-necessary cookies for authentication and session management. We do not require advertising cookies to use the Service.

If a customer switches on the optional “How did you hear about us?” question on a blog we host for them, that blog page stores one key in the reader's browser (local storage) once the question has been answered or dismissed, so the same reader is not asked again. The key records only that the question is done with — no identifier, no answer, and nothing that follows a reader between sites. The answers themselves are kept as daily counts per option and are never linked to a visitor, a session, or an IP address. The same applies to the question on our own signup form.

8. International transfers

We may process data in countries other than yours. Where required, we use appropriate safeguards for such transfers.

9. Changes

We may update this policy; material changes will be posted here with a new "last updated" date.

10. Anonymous strategy previews

If you use the free strategy preview without an account, we process the website URL you submit and your IP address to generate the preview.

We retain the submitted website URL and the generated preview indefinitely. We use them to return the same preview if that site is submitted again, to avoid regenerating work we have already done, to prevent abuse of the free preview, and to understand how the free preview is performing (aggregate counts of previews requested, generated, and converted to accounts). This information concerns a publicly available website. Aside from the IP address described below, which we keep for up to 7 days, we do not link it to an identified individual unless you create an account.

Your IP address is deleted within 7 days. It is retained only that long, for abuse prevention.

If your site changes you can refresh a stored preview from the preview page (once a day). To request deletion of a stored preview, contact us at the address in section 6.

The preview page uses Cloudflare Turnstile to verify you're human; Cloudflare processes technical data under its own privacy policy.

11. Google Search Console data

If you connect Google Search Console, we use Google's API to read the search performance data for the properties you select. The connection is read-only: it cannot publish, change, or delete anything in your Search Console account or on your site, and it reads only the properties you choose — never others on the same Google account.

What we read

For each of your selected properties: the search queries people typed, the pages Google showed them, and the impressions, clicks and average ranking position for each.

How long we keep it

• Search query text is deleted after 16 days. That is the window our reports compare, so we stop holding what people searched two weeks after we have used it.
• Page-level figures — impressions, clicks and position with no query text — are kept for 90 days, so we can show you trends.
• If you disconnect Search Console or remove a property, we delete that property's data.
• Sites that link to you are kept for 90 days after they stop linking. We store the linking site's domain and how many links it gives you — never the page addresses, the link text, or who wrote the page.
• Addresses we use to ask a site for a link are kept for 90 days after we last contacted them, or after we found them if we never did. When we ask a site to link to one of your posts, we store the address that site publishes, or its contact form — never a name, a job title, or an address we guessed. After 90 days we delete the address and the contact-form link; what remains is the site's domain and our own notes about why we approached it, which is what stops us asking the same site twice.
• Findability Check figures are kept for 60 days. When you run the check on one of your own products we look up your site's backlink count, its authority score, and where it ranks for its own name. Those figures are counts only, and the free public check never looks anything up — it can only show figures a customer has already paid for on their own site.
• Site check results are kept while a problem is open and deleted 90 days after it is resolved. Our daily site check stores what it observed about your own site — addresses, status codes, redirect targets and tag values, never page contents. Records of each check run are deleted after 90 days.

What we do with it

We use it to produce your search reports, and to draft the page title and description suggestions those reports point to. Drafting a suggestion sends the relevant page's top queries to our AI provider (section 3) to write it.

You are the controller of this data; we process it on your instructions. We do not sell it, use it for advertising, or use it to train generalized AI models. Autopulto's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Search Console at any time from the product's Connect Accounts page, or revoke our access directly in your Google account permissions.

Site crawling. For products where you have asked us to analyse your site, we fetch your public pages the same way a search engine does — respecting robots.txt and any Crawl-delay you set — and store each page's title, meta description, canonical URL, word count and the internal links between your pages. We store a short text preview of each page, not its full content. This is used to show you which pages nothing links to and which declare a conflicting canonical URL. We do not fetch pages behind a login, and we do not write to your site.

12. Indie App Showcase submissions

When you submit an app to the Indie App Showcase, we store what you enter (the app's name, address, tagline, description, category and platforms, your name and email), a copy of your app's logo, and your signed attestation: the name you typed, the time, your IP address and your browser's user agent. We use this to review and display your listing, to check your listed site once a day, and to email you about your listing. If you opt in, we may also send you occasional Autopulto news.

Unconfirmed submissions are deleted after 7 days. We keep your submission and attestation while the listing exists, and for one year after it is rejected or withdrawn, as a record of what was agreed. You can withdraw your listing at any time from the "manage your listing" link in our emails, or request a new link at /apps/manage.