1. Who we are
AutoGP (the "Service") is operated by Shirman LLC ("we," "us"), the data controller for the personal data described below. Contact: support@autogp.ai.
2. What we collect
2.1 Account data. When you sign up: your email address, a hashed password (we never store your password in plain text), and account status (your plan, post count remaining). We also record which version of our Terms of Service you accepted and when; when you first confirmed, in the browser extension, that you understand AutoGP posts from your real Facebook account and that Facebook can limit or restrict accounts that post too much, and which version of that notice you saw; the country you signed up from, looked up from your IP address at that moment (we don't keep the IP address); and, unless your browser sends a Global Privacy Control or Do Not Track signal, the first page of our website you visited and the website that referred you to it (its domain only, such as google.com). If you use Continue with Google, Google shares your name, email address and profile picture with us and confirms that the address is yours; we keep your name, your email address and an identifier for your Google account, but not the picture.
2.2 Billing data. If you subscribe to Pro, payment is handled entirely by our payment processor, Stripe — we never see or store your card number. We keep a record of your subscription status, plan, and billing history as provided back to us by Stripe.
2.3 Facebook data — what we do NOT collect. AutoGP runs inside your own browser using your own already-logged-in Facebook session. We never ask for, see, or store your Facebook password. The extension reads and interacts with the Facebook pages you have open, on your device, to identify your groups and submit the posts you write — this happens locally in your browser. We do not scrape, store, or transmit your Facebook friends list, private messages, or content from groups you haven't chosen to post to.
2.4 Product usage data. To enforce the free-tier post allowance and Pro billing, we store a count of posts made per account, and basic device-pairing information linking your browser extension to your account (so the extension knows which account's allowance to check). For each posting run, we also store when it started, how many of its posts went through and how many didn't, as numbers only — never which groups they were for or what they said — to show you on your dashboard how many posts you make each week and what share of them went through. We may also log basic diagnostic/error information to keep the Service working. The extension also keeps your posting pace: the answers you give about each Facebook account you post from (roughly how old it is, and whether it has posted in groups before), when its warm-up started, and its current daily limit. We store each Facebook account's pace under a code the extension makes from that account's ID and a random value kept with your AutoGP account, so we never receive the ID itself. To count the Facebook accounts your plan posts as each billing month (Section 4.1 of our Terms of Service), we also keep, for each profile or Page you post as, that same code, whether it is a profile or a Page, the name Facebook shows for it, and when it first and last posted, so your dashboard can show you which accounts were counted and let you remove one. We never receive the account's Facebook ID, password or content.
2.5 Cookies and website analytics. The dashboard uses essential cookies for authentication/session management. We don't use advertising or tracking cookies. To understand how visitors find and use our website, we use Vercel Web Analytics, which sets no cookies and stores nothing on your device. For each page view it receives the page address (without any query string), the referring website, your approximate location (country, region, and city, looked up from your IP address), and your browser, operating system, and device type; clicks on our sign-up buttons are counted the same way. Vercel tells visitors apart using a hash of the incoming request that it discards after 24 hours, so it cannot recognize you across websites or over time, and we see only aggregated statistics. If your browser sends a Global Privacy Control or Do Not Track signal, our website sends none of this.
2.6 Support messages and feedback. If you write to us — by email, or through Send feedback in the extension — we receive what you wrote, your email address, your plan, and the version of the extension you are using. The feedback form has an Attach diagnostics tick, which is off unless you turn it on; before you send, the form shows you the exact text that would be attached, so you can read it first. That text describes how AutoGP is set up on your computer and how your last run went, and it can include the names of Facebook groups you posted to and the name of the Facebook account your groups were synced from. It never includes your Facebook password or any Facebook login token, and it never includes the content of your posts. Support messages live in our support mailbox, not in your account record.
2.7 Ask AutoGP, our help assistant. Our website has an AI help assistant, Ask AutoGP, which answers questions from our published help, pricing and policy pages. Its answers are generated automatically by Anthropic's Claude (Section 4) and can be wrong; the page each answer links to, and a person at support@autogp.ai, have the final word. When you use it, we receive what you type and keep the conversation — your questions, the answers and the pages they linked — so that we can see which questions it answers badly and improve our help. Before a question is kept or sent to Anthropic, we remove anything that looks like a card number, a password or a login code, but please don't type those or anything else you don't want kept. Anthropic receives your question and the conversation so far in order to write the answer. If you're logged in to AutoGP when you ask, the conversation is linked to your account and included when you download your data; if you aren't, it isn't linked to you. To limit how many questions can be asked, we count questions against a hashed form of your IP address (or against your account, if you're logged in), and to answer questions about prices, we look up your country from your IP address; neither your IP address nor your country is kept with the conversation.
3. Why we collect it, and our legal basis (GDPR)
For users in the EEA, UK, or Switzerland, we rely on the following legal bases under the GDPR for each purpose:
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and running your account | Email, hashed password | Performance of a contract (Art. 6(1)(b)) |
| Processing subscription payments | Billing status (via Stripe) | Performance of a contract (Art. 6(1)(b)) |
| Enforcing your plan's post allowance | Post count, device pairing | Performance of a contract (Art. 6(1)(b)) |
| Counting the Facebook accounts your plan posts as each billing month, and listing them on your dashboard | For each profile or Page: the code the extension makes for it, whether it is a profile or a Page, its name on Facebook, and when it first and last posted | Performance of a contract (Art. 6(1)(b)) |
| Showing your posting activity on your dashboard | When each run started, and how many of its posts went through and how many didn't | Performance of a contract (Art. 6(1)(b)) |
| Keeping the Service secure and working | Diagnostic/error logs | Legitimate interests (Art. 6(1)(f)) — keeping the Service reliable and secure |
| Answering your support messages and feedback | What you wrote, your email address, your plan, the extension version, and any diagnostics you chose to attach | Performance of a contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)) — answering you and fixing what you reported |
| Answering your questions in Ask AutoGP, and improving its answers and our help pages | Your questions, the answers, and whether you were logged in to your account | Legitimate interests (Art. 6(1)(f)) — offering help at any hour and improving it; performance of a contract (Art. 6(1)(b)) when you're a customer asking about the Service |
| Keeping a record of the Terms of Service you accepted | Terms version, time of acceptance | Performance of a contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)) — being able to show which terms you agreed to |
| Keeping a record that you were told about the risk to your Facebook account before your first run | Time of your confirmation, version of the notice | Legitimate interests (Art. 6(1)(f)) — being able to show you were told |
| Understanding how visitors find our website and where our customers come from | Aggregated website statistics; your sign-up country, first page visited, and referring website | Legitimate interests (Art. 6(1)(f)) — improving our website and deciding where to offer the Service |
| Sending you service emails (billing, renewal reminders, security) | Email address | Performance of a contract / legitimate interests |
| Sending optional marketing emails, if you opt in | Email address | Consent (Art. 6(1)(a)) — withdrawable anytime |
4. Who we share data with
We share data only with the service providers ("processors") needed to run AutoGP, under data processing agreements:
- Stripe, Inc. — payment processing and billing.
- Vercel Inc. — application hosting, infrastructure, and website analytics (Vercel Web Analytics).
- Turso (Chiselstrike, Inc.) — database hosting (libSQL/SQLite-compatible), account data storage.
- Resend (Plus Five Five, Inc.) — sending transactional email (password resets, email confirmations, billing notices) and delivering the feedback you send from the extension to our support mailbox.
- Anthropic, PBC — generating the answers of Ask AutoGP, our website's help assistant (Section 2.7). Anthropic doesn't use what it receives from us to train its models.
If you choose Continue with Google, Google (Google LLC) handles that sign-in under its own privacy policy.
We do not sell your data, and we do not share it with advertisers or data brokers. We only disclose data beyond the above if required by law (e.g., a valid legal request) or to protect our rights, users, or the public from harm.
5. International data transfers
AutoGP serves customers internationally. If your data is processed in a country outside the EEA/UK (for example, if a processor above is US-based), we rely on Standard Contractual Clauses or another lawful transfer mechanism recognized under GDPR Chapter V to protect it. Contact us at support@autogp.ai for details on the specific safeguards in place for a given processor.
6. Cookie consent
Our website analytics (Section 2.5) set no cookies and store nothing on your device, and the only cookies we set are essential ones (needed to keep you logged in and the Service functioning), which don't require consent under the ePrivacy Directive. That is why we don't show a cookie banner. If we ever add a non-essential cookie, we will ask for your consent first where the law requires it. You can object to website analytics at any time by turning on Global Privacy Control or Do Not Track in your browser, or by emailing support@autogp.ai.
7. Data retention
We keep your account data for as long as your account is active. If you delete your account, we delete or anonymize your personal data within a reasonable period, except where we're required to keep billing records for tax/accounting purposes (typically several years under applicable law) or need to retain limited data to prevent free-tier abuse (e.g., recognizing a previously-used free allowance tied to a deleted account). The sign-up record and the confirmation about your Facebook account described in Section 2.1, and the list of Facebook accounts your plan has posted as (Section 2.4), are kept with your account and deleted with it. Support messages and feedback (Section 2.6) are kept in our support mailbox for as long as they are useful for answering you and improving the Service, and no longer than three years; ask us and we will delete your correspondence sooner. Ask AutoGP conversations (Section 2.7) are deleted automatically 90 days after their last message, or sooner with your account if they are linked to it and you delete it; ask us and we will delete a conversation sooner. Anthropic deletes what it receives from us within 30 days, unless it needs to keep something longer to enforce its usage policies or to comply with the law. Website analytics are held by Vercel as aggregated statistics and are available to us for 12 months.
8. Your rights
If GDPR applies to you, you have the right to: access the personal data we hold about you; correct inaccurate data; request deletion ("right to be forgotten"); restrict or object to certain processing; receive your data in a portable format; and withdraw consent at any time where processing is based on consent. To exercise any of these, email support@autogp.ai. You also have the right to lodge a complaint with your local data protection authority.
If you're a California resident, you have similar rights under the CCPA (know what's collected, delete it, opt out of sale — noting again that we don't sell personal data) to the extent CCPA applies to us.
9. EU representative
(To confirm before publishing: as a non-EU business serving EU customers on an ongoing subscription basis, AutoGP likely needs to designate an EU representative under GDPR Article 27, since the "occasional processing only" exemption likely doesn't apply to a regular SaaS subscription with an ongoing EU customer base. This is an open action item, not yet appointed — see the Status Log / launch checklist.)
10. Children
AutoGP is not directed at, and we don't knowingly collect data from, anyone under 18. If we learn we've collected data from a minor, we'll delete it.
11. Security
We use industry-standard measures to protect your data — hashed passwords, secure session handling, and standard protections against common web attacks (CSRF, XSS). No system is 100% secure, and we can't guarantee absolute security.
12. Chrome Web Store "Limited Use" compliance statement
AutoGP's Chrome extension accesses Facebook page content solely to identify your groups and submit the posts you author, strictly to provide and improve the single, disclosed purpose of the extension — automating Facebook group posting for your own account. Consistent with Google's Chrome Web Store User Data Policy (Limited Use requirements):
- We do not use data accessed via the extension for any purpose other than operating and improving that single disclosed feature.
- We do not sell user data collected through the extension.
- We do not use or transfer such data for personalized advertising.
- We do not allow humans to read this data except with your affirmative consent (e.g., for support), for security purposes (e.g., investigating abuse), or to comply with applicable law.
- If our data practices materially change, we will notify you and, where required, seek renewed consent before the change takes effect.
13. Changes to this policy
We may update this policy from time to time. Material changes will be communicated by email or an in-product notice before they take effect.
14. Contact
Questions about this policy or your data: support@autogp.ai.