Privacy Policy

Autonomik ("Autonomik", "we", "us") is an AI-assisted marketing platform that helps brands and agencies plan, create, publish and analyse social media content. Autonomik is operated by [Company legal name, CR number], [Registered address, City, Kingdom of Saudi Arabia]. This policy explains what personal data we process, why, with whom we share it, how long we keep it and the rights you have, including under the Saudi Personal Data Protection Law (PDPL).

Autonomik is currently offered as a pilot (beta) to a limited number of business customers.

1. Who is responsible

For your Autonomik account we decide how your data is used (controller). For content and social media data that a customer organisation places in Autonomik, that organisation decides what is processed and we process it on its behalf (processor), under our Terms of Service. Questions: privacy@your-domain.example.

2. Data we collect

• Account data: name, email address, password (stored only as a secure hash), language and display preferences, organisation and team membership, roles and invitations.
• Brand content: brand profiles, logos, colours, fonts, products, strategies, briefs, drafts, generated images, videos, voiceovers and captions, files you upload, approval comments, and the content calendar.
• Connected social accounts: when you connect a platform (for example Facebook, Instagram, Threads, TikTok, X, LinkedIn, YouTube, Snapchat, Pinterest, WhatsApp, Telegram or Google Business Profile), we store the account identifiers and the access tokens or app credentials you provide. These credentials are encrypted before they are stored, with keys kept separately from the database, and are never shown again in the browser.
• Social data: posts we publish for you, their performance statistics (reach, engagement and similar metrics), and — where you use the inbox — comments and messages sent to your connected accounts, including the public name or handle of the sender.
• Competitor and market research: publicly available business information obtained through official platform APIs or public web pages that you ask us to analyse. We do not scrape platforms with login cookies.
• Technical data: IP address, browser type, timestamps and security/audit logs (for example sign-ins, permission changes, connections and disconnections), used to keep the service secure.
• Cookies: a sign-in session cookie and cookies that remember your language and theme. We do not use advertising or third-party tracking cookies.

3. How we use data

• To provide the service: create content, schedule and publish it to the accounts you connect, and show you analytics.
• Social media data is used only to publish and analyse content for the customer that connected the account. We do not sell it, use it for advertising, or combine it across customers.
• To secure the service: authentication, rate limiting, fraud and abuse prevention, audit trails.
• To communicate with you about your account (for example password-reset codes and invitations).
• To meet legal obligations.

Legal bases: performance of our contract with you or your organisation, our legitimate interest in operating a secure service, your consent where required (for example when you connect a social account), and legal obligations.

4. Artificial intelligence providers

To generate text, images, video and voice, Autonomik sends the relevant brand content and instructions to the following AI providers, who act as our sub-processors:

• Google (Gemini API) — images, video, voice and analysis.
• OpenAI — text, strategy and creative direction.
• xAI (Grok API) — images and text.

We send only what is needed for the task (brand and marketing content). We do not send passwords or social account credentials to AI providers. Some English voiceovers are produced by an open-source model that runs on our own server. AI output can be inaccurate; review content before publishing it.

5. Other service providers

• Server hosting: [hosting provider, data-centre location].
• File storage: Cloudflare (R2 object storage) for images, videos and uploads.
• Email delivery: [email provider].
• Social platforms and Canva: only when you connect them, and only to perform the actions you request. Their own privacy policies apply to data held by them.

Some of these providers process data outside the Kingdom of Saudi Arabia. Where the PDPL requires it, we rely on the safeguards it provides for such transfers (for example standard contractual clauses) and transfer only the minimum necessary.

6. Retention

• Account data and brand content: while your organisation's account is active, then deleted within 30 days of closure or of a verified deletion request.
• Social account credentials: deleted immediately when you disconnect the account.
• Inbox comments and messages: up to 12 months, then deleted on a rolling basis.
• Database backups: kept for 14 days, then overwritten. Deleted data disappears from backups within that period.
• Security and audit logs: as long as needed for security and legal purposes, normally no longer than [period].

7. Security

Data is transmitted over HTTPS. Each customer organisation's data is isolated in the database by row-level security. Social credentials are encrypted at rest. Access to production systems is restricted to authorised personnel. No system is perfectly secure; if a breach affects your personal data we will notify you and the competent authority as required by law.

8. Your rights (Saudi PDPL)

Subject to the law, you have the right to:

• be informed about how your personal data is processed (this policy);
• access your personal data and obtain a copy in a readable format;
• correct, complete or update your personal data;
• request the destruction of your personal data when it is no longer needed;
• withdraw your consent at any time, where processing is based on consent;
• lodge a complaint with the Saudi Data & AI Authority (SDAIA).

To exercise these rights email privacy@your-domain.example from the address registered to your account. We answer within 30 days. If your data was provided by a customer organisation (for example as a member of its team, or as someone who commented on its page), we may forward your request to that organisation. See also Data deletion.

9. Children

Autonomik is a business service and is not intended for anyone under 18.

10. Changes

We will post changes on this page and update the date above. Material changes will be announced in the app or by email.

11. Contact

[Company legal name, CR number], [Registered address, City, Kingdom of Saudi Arabia]. Email: privacy@your-domain.example.