Legal
Last updated: 18 June 2026
ContentPilot is a social media content management platform operated by Ellipse Studio (ABN 30 556 897 505) ("we", "us", "our"), an Australian business. This Privacy Policy explains how we collect, use, store, and protect your information when you use ContentPilot at ctpilot.com (the "Service").
By using the Service, you agree to the practices described in this policy. For any privacy-related questions, contact us at hello@ellipsestudio.com.au.
Account Information
When you register, we collect your email address and a hashed password. We never store your password in plain text.
Client and Brand Data
You may enter information about your clients including their business name, industry, brand voice, target audience, and website. This data is stored securely and used solely to generate and publish content on their behalf.
Social Media Access Tokens
When you or your clients connect a social media account (Facebook, Instagram, Google Business Profile), we receive and store OAuth access tokens issued by those platforms. These tokens allow us to publish content on your behalf. All tokens are encrypted at rest using AES-256-GCM encryption before being written to our database — we cannot publish to your accounts without an active, valid token that you have granted.
Content and Media
We store posts, captions, blog content, hashtags, and images generated or uploaded through the platform. This content belongs to you and your clients.
Payment Information
Payments are processed by Stripe. We do not store your credit card number or payment details. We receive transaction confirmation and store your Stripe Customer ID to manage your subscription.
Usage Data
We collect basic usage data — such as which features you use, when agent runs are triggered, and credit usage — to operate and improve the Service.
We use the information we collect to:
We do not use your data or your clients' data to train AI models. We do not sell your data to third parties.
When you connect a Facebook Page, Instagram Business account, or Google Business Profile, we store an encrypted access token that allows us to publish content on your behalf. We request only the minimum permissions necessary to publish and manage posts. We do not access your private messages, contacts, follower lists, or any data beyond what is required to publish.
You can revoke our access at any time from within the Service (Connections page) or directly through each platform's security settings. Revoking access deletes the stored token immediately.
ContentPilot relies on the following third-party services to operate. Each is subject to their own privacy policy:
All data is stored in Supabase-managed PostgreSQL databases hosted on AWS infrastructure. Media files are stored in Supabase Storage. Social media access tokens are encrypted at rest using AES-256-GCM before being written to the database, and decrypted only when needed to publish content.
We use encrypted connections (HTTPS/TLS), access controls, and regular security reviews. No method of internet transmission is 100% secure, and we cannot guarantee absolute security.
Data is stored on servers in the United States (AWS). If you are located in the EU or Australia, your data may be transferred internationally. By using ContentPilot, you consent to this transfer.
We retain your data for as long as your account is active. If you close your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or accounting purposes (such as billing records, which are kept for 7 years under Australian law).
Social media access tokens are deleted immediately upon disconnection of a platform or account closure.
We use essential session cookies to keep you logged in and maintain application state. We do not use advertising or third-party tracking cookies. Stripe and Supabase may set their own cookies governed by their respective privacy policies.
You have the right to:
To exercise any of these rights, contact us at hello@ellipsestudio.com.au. We will respond within 30 days.
ContentPilot complies with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). If you believe we have mishandled your personal information, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
If you are located in the European Economic Area (EEA), our legal basis for processing your data is: contract performance (providing the Service you signed up for), legitimate interests (improving the platform, preventing fraud), consent (connecting social accounts), and legal obligation where required. You have the right to lodge a complaint with your local data protection authority.
Content you and your clients create using ContentPilot — including AI-generated posts, images, and blog content — belongs to you. We do not claim any ownership over content generated through the Service.
ContentPilot, its design, code, and all non-user-generated content remain the intellectual property of Ellipse Studio. You may not copy, reproduce, or reverse-engineer any part of the platform without our written permission.
ContentPilot is not intended for anyone under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.
We may update this Privacy Policy from time to time. We will update the "Last updated" date at the top, and where changes are material, notify you by email. Continued use of ContentPilot after changes constitutes acceptance of the updated policy.
For any privacy-related questions, requests, or complaints: