Effective 2026-01-01

Data Processing & Subprocessors

Operated by Xoxo Digitals. Contact: privacy@creatorpilotpro.com

This page is a compliance template. Replace placeholders (company name, address, emails, effective date) in apps/web/src/lib/legal-meta.ts or via NEXT_PUBLIC_LEGAL_* env vars, then have counsel review before relying on it.

1. Roles

For personal data you upload or connect through SocialCreatorPilot, Xoxo Digitals typically acts as a processor (or service provider) on behalf of your organization (the controller), except where we determine purposes independently (e.g., account administration, security, billing), in which case we act as a controller. A formal Data Processing Addendum (DPA) can be executed on request — contact privacy@creatorpilotpro.com.

2. Processing summary

Subject matter: social content operations, scheduling, publishing, AI ideation/packaging, and related account administration.
Duration: for the term of your use plus limited backup/legal retention.
Nature: storage, transmission, display, automated processing (including AI providers you configure), and deletion on request where feasible.
Types of data: account identifiers, OAuth tokens, content metadata, media references, logs — see the Privacy Policy.

3. Subprocessors (template)

Replace with your actual vendors before production:

[Cloud host / VPS provider] — application & database hosting.
[Object storage provider] — media asset storage (if used).
[Email / SMTP provider] — transactional email (if used).
[AI API provider(s)] — generation features you enable (keys may be customer-provided).
YouTube / Google, Meta, TikTok — destination platforms when you authorize connections (they process data under their own terms).

4. Security measures

High-level controls are described in our Security Overview. Tokens and secrets are encrypted at rest where the product design provides for it.

5. Contact

DPA / subprocessors: privacy@creatorpilotpro.com