Privacy Policy
How AEO Autopilot handles the information you give it, in the order you are likely to care about it.
Last updated 26 July 2026
The short version
We collect your email address so you can sign in, your website address and its public content so we can write about it, and billing details if you subscribe. We use a small number of named third parties to do that work, listed in full below. We do not sell personal information, and we do not use your data to train our own models. You can ask us to delete everything at any time by writing to privacy@aeoautopilot.com.
Who we are
AEO Autopilot operates aeoautopilot.com and is the controller of the personal information described here. You can reach us atprivacy@aeoautopilot.com.
What we collect and why
Information you give us
- Your email address and name. Held so you can sign in and so we can send service email about your account. Handled by Clerk on our behalf.
- Your website address. The one thing the product needs. We fetch the public pages of that site to work out what you sell and who buys it.
- Your brand details. Brand name, colours, logo and blog description, used to publish articles that look like they belong to you.
- Billing details. Taken and stored by Stripe. We keep only a customer reference, a subscription reference and your plan status. We never see or store your card number.
- Anything you type into the product. Content goals, topic requests and article edits.
Information we generate
- Articles and topic research produced for your website, along with their publication status and history.
- Submission records showing which URLs were sent to which search engines and when.
Information collected automatically
- Usage analytics. Pages viewed and actions taken, through Google Analytics and Amplitude, used to understand where the product is confusing.
- Technical logs. IP address, browser and request metadata, kept for security and debugging.
Access you grant to other services
If you connect Google Search Console or Bing Webmaster Tools, we receive an OAuth token for those accounts. It is encrypted at rest and used for one purpose: verifying that a site is yours and submitting your sitemap. We do not read your search analytics for any other reason, and you can revoke the token from your Google or Microsoft account at any time without our involvement.
What we do not do
- We do not sell personal information, and we have not in the preceding twelve months.
- We do not share personal information for cross-context behavioural advertising.
- We do not use your content or your data to train our own models.
- We do not use your DNS access to change records other than the one that publishes your blog.
Why we are allowed to process it
If you are in the UK or the European Economic Area, our lawful bases under the UK GDPR and the GDPR are: performance of a contract for everything needed to run your account and publish your articles; legitimate interestsfor product analytics, security, and service email about the account you created, balanced against your rights; and consent where we ask for it, which you may withdraw at any time.
Who else receives it
These are every third party that processes customer data for us, and the reason each one does. Each acts on our instructions under a data processing agreement.
| Service | What it does for us | What it receives |
|---|---|---|
| Clerk | Accounts, sign-in and session management | Email address, name, authentication events |
| Stripe | Subscription payments and invoicing | Billing details and payment method, held by Stripe rather than by us |
| Railway | Application hosting and the PostgreSQL database | All service data at rest |
| Cloudflare | Custom blog hostnames, DNS, TLS certificates and content delivery | Blog hostnames, request metadata |
| Anthropic | Researching topics and writing articles | Public content from your website, your brand details and article drafts |
| Search Console submission and website analytics | Sitemap URLs, an OAuth token you grant, and usage analytics | |
| Microsoft | Bing Webmaster Tools submission and IndexNow | Sitemap and article URLs, and an OAuth token you grant |
| Sequenzy | Onboarding and product email | Email address, brand name, article titles |
| Amplitude | Product analytics | Pseudonymous usage events |
We will also disclose information where the law requires it, and to a buyer or successor if the business is sold, in which case this policy continues to apply until you are told otherwise.
Where it is held
Our servers and database are in the United States. If you are outside the United States, using the service means your information is transferred there. For transfers out of the UK and the EEA we rely on the European Commission’s Standard Contractual Clauses, together with the UK Addendum where it applies.
How long we keep it
- Account and website data for as long as your account is open.
- After you close your account, we delete or anonymise personal information within 90 days, except where we must keep it longer.
- Billing records for seven years, because tax law requires it.
- Published articles stay on your domain until you remove them. They are yours, and closing your account does not take them down.
- Technical logs for 30 days.
Your rights
Depending on where you live you may have the right to access the information we hold about you, correct it, delete it, receive it in a portable form, object to or restrict how we use it, and withdraw consent. Californian residents additionally have the right to know what is collected and to be free from discrimination for exercising these rights, under the CCPA as amended by the CPRA.
Write to privacy@aeoautopilot.com and we will respond within 30 days. We will not charge you for it or treat you differently for asking. If you are in the UK or the EEA and you think we have got this wrong, you may complain to your local supervisory authority, and we would rather you told us first so we can fix it.
Cookies
We use cookies that keep you signed in, which the service cannot work without, and analytics cookies from Google Analytics and Amplitude that help us see which parts of the product are confusing. We do not use advertising cookies. Blocking analytics cookies in your browser does not affect anything you can do here.
Security
Data is encrypted in transit and at rest, third-party access tokens are encrypted with a separate key, and access to production systems is limited to those who need it. No service can promise perfect security, and we will not pretend otherwise. If a breach affects your personal information we will tell you and the relevant regulator within the time the law allows.
Children
This is a product for businesses and is not directed at children. We do not knowingly collect information from anyone under 16. If you believe a child has given us information, write to privacy@aeoautopilot.com and we will delete it.
Changes to this policy
When this policy changes we will update the date at the top. If a change materially affects your rights we will email you before it takes effect rather than relying on you to notice.
Contact
privacy@aeoautopilot.com for anything on this page, or hello@aeoautopilot.com for everything else. Both reach a person.