Data Management Policy

This policy sets out how we manage the data in Script Pilot across its life: what we hold, where it’s kept, how it’s protected, how long we keep it, and how it’s deleted. It covers all customer data in the app, the API, our website and our support mailbox, and it supports our Privacy Policy.

• Collect only what’s needed to provide the service.
• Use it only for the reason it was given: running Script Pilot for you. We don’t sell data or use your content to train AI models.
• Keep each customer’s data separate: every request is checked against the account that owns the data.
• Protect it with encryption, hashing and limited access.
• Keep it only as long as it’s needed, then delete it.
• Be open about where it goes and who handles it.

Our main database and file storage are in India (Mumbai). Other providers process data in the United States and elsewhere. Each receives only what its job needs.

Technical

• Encryption in transit (HTTPS) for all traffic to the app, the API and our providers.
• Passwords hashed with bcrypt; session tokens and API keys stored as SHA-256 fingerprints; connected-account tokens encrypted.
• Every request is checked so that an account (or an API key) can only reach its own data. Automated tests check this.
• API keys carry only the permissions their owner chose, and can never reach account, billing or connection settings.
• Our database blocks direct public access to every table, and an automated test makes sure every new table does too.
• Requests to fetch web pages for voice examples are checked so they can’t reach internal systems.

Organisational

• Access to production systems and customer data is limited to the people who run the service, and only for running it, fixing problems or answering a customer’s request.
• Secrets such as encryption keys are kept in our hosting provider’s secure settings, not in our code.
• Changes to the service are reviewed and tested before they go live.

We send OpenAI only what a request needs: brand details, topics, relevant voice examples and the media you’ve added. OpenAI doesn’t use data sent through its API to train its models, and keeps it for up to 30 days for abuse monitoring before deleting it. We don’t use customer content to train any model.

What you can delete yourself

• Posts, uploads and connected accounts: delete or disconnect them in the app.
• A brand: deleting it removes its posts, voice examples, connections and history. Files you uploaded for it stay in your account until you delete them.
• Voice examples from a file: adding a file with the same name replaces the earlier text.

Deactivating or deleting your account

Deactivating your account in Settings stops access and billing but keeps your data, so you can come back. To delete your account and its data, email support@scriptpilot.com.au from your account’s address. We:

• confirm the request comes from you;
• within 30 days, delete your account details, brands, voice examples, posts, uploaded files, connections, keys, sessions and security-log entries;
• keep billing records for 5 years, as Australian tax law requires; and
• confirm by email when it’s done.

Copies in providers’ short-lived logs (our hosting provider’s server logs, OpenAI’s 30-day abuse monitoring) expire on their own schedules.

You can correct most information yourself in the app. For a copy of your personal information, or any correction you can’t make yourself, email support@scriptpilot.com.au. We’ll confirm your identity, respond within 30 days and won’t charge you.

If we suspect a data breach, we:

1. Contain it straight away: revoke exposed credentials, close the gap and preserve evidence.
2. Assess it promptly, and within 30 days at most: what data, whose, and whether it’s likely to cause serious harm.
3. Notify: if serious harm is likely, we tell the people affected and the Office of the Australian Information Commissioner as soon as practicable, with what happened and what to do.
4. Review: find the root cause, fix it, and record what we changed.

We review this policy at least once a year and whenever we change how we store or process data, such as adding a provider or moving where data is held. Questions: support@scriptpilot.com.au.