CTRL+AI

Sign In

Privacy Policy

Effective Date: May 11, 2026 | Last Updated: July 11, 2026

CTRL+AI ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how your personal information is collected, used, and disclosed by CTRL+AI when you use our social media management and auto-reply services.

1. Information We Collect from Meta

When you connect your Facebook or Instagram pages to CTRL+AI, we collect the following data from Meta:

• Page Access Tokens & Page IDs: Required to authenticate our system to publish posts and send replies on your behalf.
• Instagram Business Account IDs: Required to link your Instagram interactions to your Facebook Page.
• Inbound Message Content: The text of direct messages sent to your connected pages.
• Inbound Comment Content: The text of public comments left on your connected pages' posts.
• Sender IDs: The Meta-provided identifiers for users who interact with your pages.

2. Information We Collect from Google / YouTube

When you connect your YouTube channel to CTRL+AI, we request access to the following Google API scopes:

• youtube.upload (https://www.googleapis.com/auth/youtube.upload): Used exclusively to upload video content to your YouTube channel on your behalf, only when you explicitly initiate a post through CTRL+AI.
• youtube.readonly (https://www.googleapis.com/auth/youtube.readonly): Used to read basic channel information (channel name, ID) to confirm a successful connection and display your account in the CTRL+AI dashboard.

We do not read, store, or analyze your YouTube video content, watch history, subscriptions, private playlists, or any other YouTube data beyond what is strictly required for the above purposes. OAuth tokens are stored encrypted and used only to fulfill your explicit posting requests.

CTRL+AI's use of Google user data is limited to the purposes described above and is fully compliant with the Google API Services User Data Policy, including the Limited Use requirements.

3. Why We Collect This Information

We strictly limit data collection to what is necessary for our core functionality:

• To publish social media content to your connected platforms (Facebook, Instagram, YouTube, LinkedIn, TikTok, Threads, Pinterest) on your explicit request.
• To generate context-aware AI auto-replies to incoming messages and comments.
• To maintain conversation context so the AI can provide continuous support.
• To train the brand voice parameters of your specific AI Assistant.
• To provide you with audit logs of what the AI has responded to on your behalf.

4. Data Storage and Security

Your data is stored securely in our Supabase (PostgreSQL) database infrastructure. All data, including access tokens and message logs, is encrypted at rest. We employ strict Role-Level Security (RLS) policies to ensure that only authorized CTRL+AI systems and the authenticated page owner can access this data.

5. Third-Party Processors and Sharing

We do not sell your personal data or your page's content to third parties for advertising. We only share data with the following infrastructure processors:

• Google Gemini: Inbound message content and your configured Knowledge Base are sent to Google Gemini exclusively for the purpose of generating the AI auto-reply. Google is restricted from using this data to train their public models.
• YouTube (Google): Video files and metadata are uploaded directly to YouTube via the YouTube Data API v3 when you explicitly request a YouTube post through CTRL+AI. No data is shared with Google beyond what is necessary to complete your upload request.
• Outstand: We use Outstand's social media API infrastructure to facilitate posting to Facebook, Instagram, LinkedIn, Threads, Pinterest, and TikTok. OAuth tokens for these platforms are securely transmitted to Outstand only for the purpose of publishing your content.
• Netlify: Our serverless functions and web hosting are provided by Netlify, which routes the webhook traffic securely.
• Supabase: Our primary database and authentication provider. All data is encrypted at rest and protected by Row-Level Security policies.

6. Data Retention Period

We retain message and comment logs for a standard period of 90 days to provide you with audit trails and conversation context. After 90 days, historical message content is purged. Page Access Tokens are retained continuously until you disconnect the page from our platform.

7. Your Data Rights

You have the right to request access to, correction of, or deletion of your data at any time. If you wish to purge your data immediately, you may disconnect your page via the CTRL+AI Dashboard, which instantly invalidates our access, or you may submit a full account deletion request (see our Data Deletion policy).

8. Contact Us

For any privacy-related inquiries or data requests, please contact our Data Protection Officer at:

support@ctrlplusai.services