Privacy Policy

Script Pilot AI is operated by Company name TBC (ABN TBC) (“Script Pilot”, “we”, “us”). This policy explains how we collect, use, disclose and protect personal information when you use scriptpilot.com.au, the Script Pilot app and the Script Pilot API.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. You can contact us about privacy at any time at support@scriptpilot.com.au.

Your account

• Your name, email address and password. We store your password only as a one-way bcrypt hash; we can’t see it.
• Your plan, trial and subscription status, and when you signed up and last signed in.
• The IP address of your most recent sign-in, used to protect your account.

What you put into Script Pilot

• Brand details: names, descriptions, target audience, website, voice settings, hashtags and keywords.
• Voice examples: past posts you paste in, the text of web pages you link to, and the text extracted from files you add. We keep the text, not the original file.
• Drafts, posts, schedules and the results of our automated checks on them.
• Photos, videos and documents you upload, plus the AI-written description of each photo or video (which can include a transcript of up to 1,500 characters of a video’s speech).

Accounts you connect

If you connect a social account (currently LinkedIn), we receive your account ID and name and an access token that lets us publish the posts you schedule. Tokens are stored encrypted.

Payments

Payments are handled by Stripe. You enter card details directly with Stripe; we never see or store your card number. We keep your Stripe customer reference, plan and billing dates.

API keys

If you create API keys, we keep each key’s name, first characters, permissions and when it was last used. The full key is shown to you once and stored only as a one-way fingerprint.

When you contact us

Emails you send us, including attachments, and our replies.

Technical information

• Our servers log each request’s IP address, browser details and the page or endpoint requested, and some logs include your email address (for example when you sign in).
• When something breaks, technical details of the error are sent to our error-monitoring provider.
• We count page views on our website with Vercel Web Analytics, which doesn’t use cookies and drops the query string from each address.

We don’t ask for sensitive information (such as health, racial or religious information). Please don’t include it, or other people’s personal information, in your content unless you have the right to.

• From you, when you sign up, set up a brand, add content or contact us.
• From services you connect, such as LinkedIn, when you ask us to.
• From Stripe, about the status of your payments.
• Automatically, through our servers and website, as described above.

• To provide Script Pilot: write drafts in your brand’s voice, describe your photos and videos, plan your calendar, and publish what you schedule to accounts you connect.
• To run your account: sign-in, security, preventing misuse, and enforcing plan limits.
• To bill you and manage your subscription.
• To send service emails: email verification, password resets, payment and subscription notices, failed-post alerts and a weekly summary for active plans.
• To answer your questions and give support.
• To find and fix problems and improve the service.
• To meet our legal obligations.

We don’t sell your personal information, and we don’t use your content to train AI models. Our AI provider, OpenAI, doesn’t use data sent through its API to train its models either.

Script Pilot uses AI models provided by OpenAI to write drafts, describe photos and videos, transcribe speech in videos and compare drafts with your brand settings. To do this we send OpenAI the brand details, topics, voice examples and media relevant to the request.

An automated check reviews each draft and can stop a draft being approved or scheduled until a flagged problem is fixed. You can always edit the draft. We don’t make decisions by automated means that significantly affect your rights or interests, such as decisions about your eligibility for the service.

AI-written drafts can contain mistakes. Review every draft before you publish it.

We share personal information only with:

• the service providers below, so they can run parts of Script Pilot for us;
• platforms you connect, when you schedule a post there (published posts are public on that platform);
• authorities, where the law requires it or to protect people’s safety; and
• a buyer of our business, if Script Pilot is sold, who must handle it under this policy.

Our database and file storage are in India (Mumbai), and several of our providers are in the United States or operate across several countries (see the table above). So your personal information is disclosed to and stored outside Australia, mainly in India and the United States.

We choose established providers that publish their own security and privacy commitments, and we send each one only what it needs. By using Script Pilot you consent to this. If you don’t consent, please don’t use the service.

• All traffic to Script Pilot is encrypted in transit (HTTPS).
• Passwords are stored as bcrypt hashes, API keys and session tokens as one-way fingerprints, and connected-account tokens are encrypted.
• Every request is checked so an account can only reach its own brands, posts and files, and access to our production systems is limited to the people who run the service.
• Our database blocks direct public access to every table.

Uploaded files: photos, videos and documents you upload are stored at long, unguessable web addresses. Anyone who has a file’s address can open it, so only upload material you’re comfortable publishing.

No system is perfectly secure. If you think your account has been compromised, tell us straight away.

More detail, including how deletion works, is in our Data Management Policy.

• Correct your name, brands and content in the app at any time.
• Get a copy of the personal information we hold about you by emailing support@scriptpilot.com.au.
• Deactivate your account in Settings. This stops access and billing but keeps your data so you can come back.
• Delete your account and data by emailing support@scriptpilot.com.au from your account’s email address. We delete it within 30 days, except billing records we must keep for tax law. Copies in our providers’ logs and caches expire on their own schedules (see above).

We respond to requests within 30 days and don’t charge for them. We may need to confirm your identity first. If we refuse a request, we’ll tell you why.

We send the service emails listed above. To stop the weekly summary, email support@scriptpilot.com.au and we’ll turn it off. We don’t send marketing emails unless you’ve agreed to receive them, and any we send will include a way to unsubscribe.

We don’t use advertising or tracking cookies. The app stores these in your browser to work:

Our pages load typefaces from Google Fonts, which receives your IP address and browser details when they load. Page-view analytics (Vercel) is cookieless.

Script Pilot is for people aged 18 and over. We don’t knowingly collect information from anyone younger.

If a data breach is likely to cause you serious harm, we’ll notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires, and tell you what you can do to protect yourself.

Contact us at support@scriptpilot.com.au. We’ll acknowledge your complaint and respond within 30 days. If you’re not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992).

We’ll update this policy when our practices change. If a change is significant, we’ll email you before it takes effect. The effective date at the top shows when it last changed.