1. Who we are
AutoGP (the "Service") is operated by Shirman LLC ("we," "us"), the data controller for the personal data described below. Contact: support@autogp.ai.
2. What we collect
2.1 Account data. When you sign up: your email address, a hashed password (we never store your password in plain text), and account status (your plan, post count remaining). We also record which version of our Terms of Service you accepted and when; when you ticked the box on the sign-up form confirming that you understand AutoGP posts from your own Facebook account, that Facebook applies its own rules to every account and that you use AutoGP at your own discretion (for an account made before that box, when you confirmed it on your dashboard or, earlier, in the browser extension), and which version of that wording you saw; the country you signed up from, looked up from your IP address at that moment (we don't keep the IP address); and, unless your browser sends a Global Privacy Control or Do Not Track signal, the first page of our website you visited, the website that referred you to it (its domain only, such as google.com) and the campaign labels on the link you arrived by, if it carried any (its UTM tags, such as utm_campaign). If you use Continue with Google, Google shares your name, email address and profile picture with us and confirms that the address is yours; we keep your name, your email address and an identifier for your Google account, but not the picture.
2.2 Billing data. If you subscribe to a paid plan, or save a card for your free posts (Terms 4.9(b)), payment is handled entirely by our payment processor, Stripe — we never see or store your card number. We keep a record of your subscription status, plan, and billing history as provided back to us by Stripe, and for a saved card its brand and last four digits, to show it on your dashboard and in the reminder we email before Pro starts. We also record which free trial your account got at sign-up, with or without a card (Terms 4.9), which we decide from the country in 2.1 by the same rule as the price shown for your location; it isn't used for anything else.
2.3 Facebook data — what we do NOT collect. AutoGP runs inside your own browser using your own already-logged-in Facebook session. We never ask for, see, or store your Facebook password. The extension reads and interacts with the Facebook pages you have open, on your device, to identify your groups and submit the posts you write — this happens locally in your browser. We do not scrape, store, or transmit your Facebook friends list, private messages, or content from groups you haven't chosen to post to.
2.4 Product usage data. To enforce the free-tier post allowance and Pro billing, we store a count of posts made per account, and basic device-pairing information linking your browser extension to your account (so the extension knows which account's allowance to check). For each posting run, we also store when it started, how many of its posts went through and how many didn't, as numbers only — never which groups they were for or what they said — to show you on your dashboard how many posts you make each week and what share of them went through. For the posts that didn't go through, the extension's last report on a run also says why, as a short code for each kind of reason with how many posts it applied to (for example "post box not found: 3" or "not a member of the group: 2"), and which version of the extension made the run. It also says how the run ended, as one short code from the same fixed list (for example "finished", "stopped by you" or "stopped after a warning from Facebook"). The codes come from a fixed list in the extension and never name a group or include anything from it or from your post. We use them to find and fix what stops posts from going through, and to answer you when you ask why a run failed. When you click "Post here with AutoGP" on a group post in your Facebook feed, the extension tells us that you clicked and when, and marks a run you start within 30 minutes of it as started from that button; nothing about the group or the post is sent. We count these to see whether the button helps customers start posting. When the extension shows you a screen offering a paid plan (for example when your free posts run out, or when you use a feature your plan doesn't include), it tells us which screen it was, when, and the extension's version, and we note each time you open Stripe Checkout and from which screen; we count these to learn which screens help customers choose a plan. This uses no cookie and nothing stored in your browser beyond the extension's existing connection to your account. We also record each time you sign in to your AutoGP account: when, whether with a password or Google, the country we look up from your IP address at that moment, and your browser's type and operating system (such as "Chrome on Windows"); we don't keep the IP address or the rest of what your browser sends. We use these records, with your posting runs and paired browsers, to decide refund requests and to answer a payment you dispute with your bank. We may also log basic diagnostic/error information to keep the Service working. The extension also keeps your posting pace: the answers you give about each Facebook account you post from (roughly how old it is, and whether it has posted in groups before), when its warm-up started, and its current daily limit. We store each Facebook account's pace under a code the extension makes from that account's ID and a random value kept with your AutoGP account, so we never receive the ID itself. To count the Facebook accounts your plan posts as each billing month (Section 4.1 of our Terms of Service), we also keep, for each profile or Page you post as, that same code, whether it is a profile or a Page, the name Facebook shows for it, and when it first and last posted, so your dashboard can show you which accounts were counted and let you remove one. So that each Facebook account gets its free posts once (Section 4.9(c) of our Terms of Service), on the free tier we also keep a second code the extension makes from the account's ID and a fixed value that is the same for every AutoGP account, with how many free posts that Facebook account has used and when. We never receive the account's Facebook ID, password or content.
2.5 Cookies and website analytics. The dashboard uses essential cookies for authentication/session management. We don't use advertising or tracking cookies. To understand how visitors find and use our website, we use Vercel Web Analytics, which sets no cookies and stores nothing on your device. For each page view it receives the page address (without any query string), the referring website, your approximate location (country, region, and city, looked up from your IP address), and your browser, operating system, and device type; clicks on our sign-up buttons are counted the same way. Vercel tells visitors apart using a hash of the incoming request that it discards after 24 hours, so it cannot recognize you across websites or over time, and we see only aggregated statistics. If your browser sends a Global Privacy Control or Do Not Track signal, our website sends none of this.
2.6 Support messages and feedback. If you write to us — by email, or through Send feedback in the extension — we receive what you wrote, your email address, your plan, and the version of the extension you are using. The feedback form has an Attach diagnostics tick, which is off unless you turn it on; before you send, the form shows you the exact text that would be attached, so you can read it first. That text describes how AutoGP is set up on your computer and how your last run went, and it can include the names of Facebook groups you posted to and the name of the Facebook account your groups were synced from. It never includes your Facebook password or any Facebook login token, and it never includes the content of your posts. Support messages live in our support mailbox, not in your account record.
2.7 Ask AutoGP, our help assistant. Our website has an AI help assistant, Ask AutoGP, which answers questions from our published help, pricing and policy pages. Its answers are generated automatically by Anthropic's Claude (Section 4) and can be wrong; the page each answer links to, and a person at support@autogp.ai, have the final word. When you use it, we receive what you type and keep the conversation — your questions, the answers and the pages they linked — so that we can see which questions it answers badly and improve our help. Before a question is kept or sent to Anthropic, we remove anything that looks like a card number, a password or a login code, but please don't type those or anything else you don't want kept. Anthropic receives your question and the conversation so far in order to write the answer. If you're logged in to AutoGP when you ask, the conversation is linked to your account and included when you download your data; if you aren't, it isn't linked to you. To limit how many questions can be asked, we count questions against a hashed form of your IP address (or against your account, if you're logged in), and to answer questions about prices, we look up your country from your IP address; neither your IP address nor your country is kept with the conversation.
2.8 Your AutoGP setup. So that a new computer or a reinstall doesn't lose your work, the extension keeps a copy of your AutoGP setup on your account: your saved templates (their text and a small preview of the first image), your bundles, your settings, your scheduled posts (their text and when they go out), the Facebook groups you've hidden or added by link (their IDs, names and links), and which trophies you've earned and when. Images and videos stay on your computer. The copy is replaced each time your setup changes, and you can turn it off in the extension's Settings, which deletes it. It is included when you download your data.
2.9 Coming from one of our ads. If you come to our website from an ad on Google, the page's address carries an identifier Google adds to the ad click, and often labels naming the campaign and search phrase. If you then sign up, we keep that identifier with your sign-up record (Section 2.1). If you buy directly from one of our offer pages (the pages at autogp.ai/start/, and the page our ads open on a phone), we keep, with your order: your email address, the plan and price you chose, the country we look up from your IP address at that moment (we don't keep the IP address), whether you started on a phone or a computer, Google's click identifier and those labels. If you ask us to email you the page's link instead, we keep the same details with your email address and send you that one email. AutoGP tells Google which ad click led to a purchase, so that Google can show our ads to people more likely to find AutoGP useful and we can see which ads work: once a day we give Google Ads, for each purchase that followed a click on one of our Google ads, Google's click identifier, your email address in hashed form (an irreversible code made from it, which Google can match only to a Google account it already knows), what was bought and its value, when you bought, and whether your account was created and the extension connected afterwards. We give Google no name, no unhashed email address and nothing about your posts or your Facebook account. If you are in the EEA, the UK or Switzerland, we do this only if you ticked the box on an offer page that lets us, and otherwise tell Google nothing about your purchase; you can withdraw that consent at any time by emailing support@autogp.ai.
3. Why we collect it, and our legal basis (GDPR)
For users in the EEA, UK, or Switzerland, we rely on the following legal bases under the GDPR for each purpose:
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and running your account | Email, hashed password | Performance of a contract (Art. 6(1)(b)) |
| Processing subscription payments | Billing status (via Stripe) | Performance of a contract (Art. 6(1)(b)) |
| Enforcing your plan's post allowance | Post count, device pairing | Performance of a contract (Art. 6(1)(b)) |
| Counting the Facebook accounts your plan posts as each billing month, and listing them on your dashboard | For each profile or Page: the code the extension makes for it, whether it is a profile or a Page, its name on Facebook, and when it first and last posted | Performance of a contract (Art. 6(1)(b)) |
| Showing your posting activity on your dashboard | When each run started, and how many of its posts went through and how many didn't | Performance of a contract (Art. 6(1)(b)) |
| Finding and fixing what stops posts from going through, and answering you about a failed run | For each run, the reason codes for its posts that didn't go through, with counts and how it ended, and the extension version | Legitimate interests (Art. 6(1)(f)) — keeping the Service working and helping you when posts fail |
| Keeping the Service secure and working | Diagnostic/error logs | Legitimate interests (Art. 6(1)(f)) — keeping the Service reliable and secure |
| Answering your support messages and feedback | What you wrote, your email address, your plan, the extension version, and any diagnostics you chose to attach | Performance of a contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)) — answering you and fixing what you reported |
| Answering your questions in Ask AutoGP, and improving its answers and our help pages | Your questions, the answers, and whether you were logged in to your account | Legitimate interests (Art. 6(1)(f)) — offering help at any hour and improving it; performance of a contract (Art. 6(1)(b)) when you're a customer asking about the Service |
| Keeping a record of the Terms of Service you accepted | Terms version, time of acceptance | Performance of a contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)) — being able to show which terms you agreed to |
| Keeping a record that you were told about the risk to your Facebook account when you signed up | Time of your confirmation, version of the notice | Legitimate interests (Art. 6(1)(f)) — being able to show you were told |
| Deciding refund requests and answering payments disputed with your bank | Your sign-ins, posting runs, paired browsers, and the Terms version you accepted | Performance of a contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)) — applying our refund terms and defending against chargebacks |
| Understanding how visitors find our website and where our customers come from | Aggregated website statistics; your sign-up country, first page visited, referring website, and the link's campaign labels | Legitimate interests (Art. 6(1)(f)) — improving our website and deciding where to offer the Service |
| Measuring which of our Google ads lead to purchases, and telling Google about those purchases | Google's click identifier, the campaign labels, your hashed email address, the purchase and its value, and whether the account was created and the extension connected | Legitimate interests (Art. 6(1)(f)) — knowing which advertising works; in the EEA, UK and Switzerland, consent (Art. 6(1)(a)), given with the box on an offer page and withdrawable anytime |
| Sending you service emails (billing, renewal reminders, security, and at most two emails that help a new account finish setting up: one if AutoGP isn't added to Chrome an hour after sign-up, one if nothing has posted a day after it is connected, each with a link to stop them) | Email address, whether a browser is connected, and whether a run has posted | Performance of a contract / legitimate interests |
| Sending optional marketing emails, if you opt in | Email address | Consent (Art. 6(1)(a)) — withdrawable anytime |
4. Who we share data with
We share data only with the service providers ("processors") needed to run AutoGP, under data processing agreements:
- Stripe, Inc. — payment processing and billing. If you dispute a payment with your bank, we give Stripe the record of your use of AutoGP described in Section 2.4 (your sign-ins, posting runs and paired browsers) and the Terms you accepted, and Stripe passes it to your card issuer to decide the dispute.
- Vercel Inc. — application hosting, infrastructure, and website analytics (Vercel Web Analytics).
- Turso (Chiselstrike, Inc.) — database hosting (libSQL/SQLite-compatible), account data storage.
- Resend (Plus Five Five, Inc.) — sending transactional email (password resets, email confirmations, billing notices) and delivering the feedback you send from the extension to our support mailbox.
- Anthropic, PBC — generating the answers of Ask AutoGP, our website's help assistant (Section 2.7). Anthropic doesn't use what it receives from us to train its models.
- Google LLC (Google Ads) — if you bought after clicking one of our Google ads, the purchase details in Section 2.9, so we can measure our ads. Google uses them under its own terms for advertisers and its privacy policy.
If you choose Continue with Google, Google (Google LLC) handles that sign-in under its own privacy policy.
We do not sell your data, and we do not share it with data brokers or with other advertisers. The only advertising platform we tell anything is Google Ads, and only about purchases that followed a click on its ads, as Section 2.9 describes. We only disclose data beyond the above if required by law (e.g., a valid legal request) or to protect our rights, users, or the public from harm.
5. International data transfers
AutoGP serves customers internationally. If your data is processed in a country outside the EEA/UK (for example, if a processor above is US-based), we rely on Standard Contractual Clauses or another lawful transfer mechanism recognized under GDPR Chapter V to protect it. Contact us at support@autogp.ai for details on the specific safeguards in place for a given processor.
6. Cookie consent
Our website analytics (Section 2.5) set no cookies and store nothing on your device, and the only cookies we set are essential ones (needed to keep you logged in and the Service functioning), which don't require consent under the ePrivacy Directive. That is why we don't show a cookie banner. If we ever add a non-essential cookie, we will ask for your consent first where the law requires it. You can object to website analytics at any time by turning on Global Privacy Control or Do Not Track in your browser, or by emailing support@autogp.ai.
7. Data retention
We keep your account data for as long as your account is active. If you delete your account, we delete or anonymize your personal data within a reasonable period, except where we're required to keep billing records for tax/accounting purposes (typically several years under applicable law) or need to retain limited data to prevent free-tier abuse (e.g., recognizing a previously-used free allowance tied to a deleted account). The second code in Section 2.4 and its count of free posts used are kept after your account is deleted, for that reason only. The sign-up record and the confirmation about your Facebook account described in Section 2.1, and the list of Facebook accounts your plan has posted as (Section 2.4), are kept with your account and deleted with it. Support messages and feedback (Section 2.6) are kept in our support mailbox for as long as they are useful for answering you and improving the Service, and no longer than three years; ask us and we will delete your correspondence sooner. The copy of your AutoGP setup (Section 2.8) is kept with your account and deleted with it, or as soon as you turn it off. The record of your sign-ins (Section 2.4) is kept with your account and deleted with it. If you delete an account that has paid us, we keep a record of how it was used (its email address and plan, the Terms and the Facebook notice you accepted, the times and post counts of your posting runs, your paired browsers and your sign-ins) for 18 months after the deletion, only to answer a payment you dispute with your bank, and then delete it. If you dispute a payment, a record of the dispute (its amount, reason and outcome) is kept with our billing records. Ask AutoGP conversations (Section 2.7) are deleted automatically 90 days after their last message, or sooner with your account if they are linked to it and you delete it; ask us and we will delete a conversation sooner. Anthropic deletes what it receives from us within 30 days, unless it needs to keep something longer to enforce its usage policies or to comply with the law. Website analytics are held by Vercel as aggregated statistics and are available to us for 12 months. An order started from one of our offer pages but never paid, and a request to email you a page's link, are deleted after 90 days. A paid order is kept with your account and deleted with it.
8. Your rights
If GDPR applies to you, you have the right to: access the personal data we hold about you; correct inaccurate data; request deletion ("right to be forgotten"); restrict or object to certain processing; receive your data in a portable format; and withdraw consent at any time where processing is based on consent. To exercise any of these, email support@autogp.ai. You also have the right to lodge a complaint with your local data protection authority.
If you're a California resident, you have similar rights under the CCPA (know what's collected, delete it, opt out of sale — noting again that we don't sell personal data) to the extent CCPA applies to us.
9. EU representative
(To confirm before publishing: as a non-EU business serving EU customers on an ongoing subscription basis, AutoGP likely needs to designate an EU representative under GDPR Article 27, since the "occasional processing only" exemption likely doesn't apply to a regular SaaS subscription with an ongoing EU customer base. This is an open action item, not yet appointed — see the Status Log / launch checklist.)
10. Children
AutoGP is not directed at, and we don't knowingly collect data from, anyone under 18. If we learn we've collected data from a minor, we'll delete it.
11. Security
We use industry-standard measures to protect your data — hashed passwords, secure session handling, and standard protections against common web attacks (CSRF, XSS). No system is 100% secure, and we can't guarantee absolute security.
12. Chrome Web Store "Limited Use" compliance statement
AutoGP's Chrome extension accesses Facebook page content solely to identify your groups and submit the posts you author, strictly to provide and improve the single, disclosed purpose of the extension — automating Facebook group posting for your own account. Consistent with Google's Chrome Web Store User Data Policy (Limited Use requirements):
- We do not use data accessed via the extension for any purpose other than operating and improving that single disclosed feature.
- We do not sell user data collected through the extension.
- We do not use or transfer such data for personalized advertising.
- We do not allow humans to read this data except with your affirmative consent (e.g., for support), for security purposes (e.g., investigating abuse), or to comply with applicable law.
- If our data practices materially change, we will notify you and, where required, seek renewed consent before the change takes effect.
13. Changes to this policy
We may update this policy from time to time. Material changes will be communicated by email or an in-product notice before they take effect.
14. Contact
Questions about this policy or your data: support@autogp.ai.