Privacy Policy

This Privacy Policy describes how xpilot ("we", "us", or "our"), operated by Karol Ordowski, an individual conducting unregistered business activity based in Poland, collects, uses, and protects your personal data when you use https://xpilot.ink ("the Service"). Karol Ordowski is the data controller within the meaning of Regulation (EU) 2016/679 (GDPR). Contact: karolordowski@gmail.com

We collect the following categories of personal data: a) Data you provide directly • Email address — when you join the waitlist or create an account b) Data collected via X (Twitter) OAuth login • X user ID, display name, username (@handle), and profile picture • Access token required to perform actions on your behalf (e.g. publishing posts) c) Content you create within the Service • Draft posts, scheduled posts, and threads you write using our tools d) Usage data • Log data: IP address, browser type, pages visited, time and date of access • Device type and operating system (collected automatically) e) Payment data • We do not store payment card details. Payments are processed by Paddle, acting as our Merchant of Record. We receive confirmation of successful payment and your subscription status only.

We process your personal data on the following legal bases: • Performance of a contract (Art. 6(1)(b) GDPR) — to provide the Service you signed up for, including account management, post scheduling, and billing • Legitimate interests (Art. 6(1)(f) GDPR) — to improve the Service, prevent fraud, and ensure security • Consent (Art. 6(1)(a) GDPR) — for sending marketing emails (waitlist updates and launch announcements). You may withdraw consent at any time by clicking "unsubscribe" in any email we send. • Legal obligation (Art. 6(1)(c) GDPR) — where required by applicable law

We use your personal data to: • Create and manage your account • Provide, operate, and improve the Service • Publish posts to X on your behalf when you explicitly schedule or trigger a post • Send transactional emails (account notifications, billing receipts) • Send waitlist and launch-related emails (with your consent) • Detect and prevent fraudulent or unauthorized activity • Comply with legal obligations

We do not sell your personal data to any third party. We share data only with the following categories of processors, strictly for the purpose of providing the Service: • MongoDB Atlas (database hosting) — stores your account data and content; servers located in the EU where possible • Paddle (payment processing) — Paddle.com Market Ltd acts as Merchant of Record and processes subscription payments; subject to their own privacy policy • X / Twitter (social platform) — OAuth authentication and post publishing; subject to X's privacy policy • Vercel or equivalent hosting provider — hosts the Service infrastructure We require all processors to handle your data in accordance with GDPR and applicable data protection law. We may disclose your data if required by law, court order, or to protect the rights, property, or safety of the Operator, our users, or others.

We retain your personal data for as long as your account is active or as necessary to provide the Service. If you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required by law to retain it longer (e.g. billing records, which may be retained for up to 5 years under Polish tax law). Waitlist emails are retained until you unsubscribe or request deletion.

As a data subject under GDPR, you have the following rights: • Right of access — request a copy of the personal data we hold about you • Right to rectification — request correction of inaccurate or incomplete data • Right to erasure ("right to be forgotten") — request deletion of your data, subject to legal retention obligations • Right to restriction of processing — request that we limit how we use your data • Right to data portability — receive your data in a structured, machine-readable format • Right to object — object to processing based on legitimate interests • Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing To exercise any of these rights, contact us at karolordowski@gmail.com. We will respond within 30 days. You also have the right to lodge a complaint with the Polish supervisory authority: Urząd Ochrony Danych Osobowych (UODO) ul. Stawki 2, 00-193 Warszawa uodo.gov.pl

We use session cookies strictly necessary for authentication and to maintain your logged-in state. We do not use advertising cookies or third-party tracking cookies. We may use basic analytics (e.g. page view counts) without collecting personally identifiable information. If we introduce any analytics tool that processes personal data, this policy will be updated accordingly.

If you use the xpilot browser extension for Chrome ("the Extension"), the following additional practices apply: a) Authentication token After you connect the Extension to your xpilot account, an access token is stored locally in your browser (chrome.storage). It is sent exclusively to our servers (https://xpilot.ink) to authenticate your requests. Disconnecting or uninstalling the Extension removes the token from your browser. b) Website content The Extension reads the text of posts you draft in the X.com composer, and the ID of posts you explicitly act on, only when you use an Extension feature (post scheduling, AI grammar fix, auto-plug, or auto-repost). This content is transmitted to our servers solely to perform the action you requested and is processed as described in this policy. c) What the Extension does not do The Extension does not collect your browsing history, does not track your activity on X.com or any other website, does not read content other than what you explicitly act on, and does not sell or transfer any data to third parties. All other sections of this Privacy Policy apply equally to data processed via the Extension.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include encrypted connections (HTTPS), secure credential storage, and access controls. No method of transmission over the internet is 100% secure. We cannot guarantee absolute security, but we take reasonable steps to protect your data and will notify you of any breach as required by applicable law.

The Service is not directed at children under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected data from a minor, please contact us at karolordowski@gmail.com and we will delete it promptly.

Your data may be processed outside the European Economic Area (EEA) by our third-party processors (e.g. X/Twitter, Paddle). Where such transfers occur, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission, or we transfer to countries deemed adequate by the European Commission.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by displaying a notice within the Service at least 14 days before the changes take effect. The updated policy will be posted at https://xpilot.ink/privacy with a new "Last updated" date.

For any questions, requests, or complaints regarding this Privacy Policy or our data practices, contact us at: Karol Ordowski Skrzyszów 641, Poland Email: karolordowski@gmail.com Website: https://xpilot.ink We aim to respond to all requests within 30 days.