# Privacy Policy

**MetaPilot · Legal**

_Last updated: August 9, 2026_

This policy explains what information MetaPilot collects, how we use it, and the choices you have. We collect only what we need to run the service.

---

## Information We Collect

- **Account data** — your name, email address, and organization details provided at sign-up.
- **Website content** — pages you submit for metadata generation, fetched and processed to produce structured data.
- **Connected accounts** — access tokens for third-party accounts (e.g., Cloudflare) stored encrypted at rest.
- **Billing data** — subscription and payment details processed by our payment provider (full card numbers are not stored).
- **Usage data** — logs and diagnostics to operate, secure, and improve the service.
- **Bot-protection signals** — Cloudflare Turnstile collects your IP address and browser/device characteristics from public forms to confirm human origin; runs invisibly with no user interaction required.
- **Analytics data** — page views, clicks, scrolling, and session recordings via Microsoft Clarity. Anonymous on public pages; associated with your account when signed in to the portal.

---

## How We Use Your Information

- To provide the service — generating and publishing structured data and Open Graph metadata.
- To manage your account, subscription, and billing.
- To deploy and manage integrations you enable (e.g., the Cloudflare Worker on your zone).
- To communicate with you about your account, security, and service updates.
- To secure the service and prevent abuse.

---

## Third-Party Services

We share data with service providers only as needed to run MetaPilot:

- **Cloudflare** — to deploy and manage the metadata-injector Worker on your zone.
- **Cloudflare Turnstile** — invisible bot protection on public forms.
- **Stripe** — to process subscriptions and payments.
- **Google (Vertex AI / Gemini)** — page content is sent to generate structured data.
- **Microsoft Clarity** — behavioral analytics (heatmaps and session recordings) across public pages and the portal.

**We do not sell your personal data.**

---

## Cookies and Analytics

We use cookies and similar technologies to keep you signed in and to run the service. Microsoft Clarity captures interactions across our public pages and portal — including page views, clicks, scrolling, and session recordings. Activity may be associated with your account when signed in to the portal; it is anonymous on public pages. You can limit this tracking through your browser settings or standard tracking-prevention tools.

---

## Bot Protection

Public forms are protected by **Cloudflare Turnstile** running in **invisible mode** — the check happens silently in the background, with no puzzle or tick-box required. Turnstile collects IP address, browser and device characteristics, and page-load signals, and may set a token or cookie to remember a passed check. Cloudflare does not use this data to build advertising profiles.

---

## Data Retention

Data is kept for as long as your account is active and as needed to provide the service. When you disconnect an integration or delete your account, associated credentials and data are removed, except where retention is required for legal or accounting obligations.

---

## Security

Industry-standard measures are used, including encryption of access tokens at rest and encrypted transport (HTTPS).

---

## Your Rights

You may access, correct, or delete your personal data, and disconnect integrations or close your account at any time. Contact us at the address below to make a request.

---

## Changes to This Policy

Material changes will be reflected by the "last updated" date above; where appropriate, you will be notified.

---

## Contact

Questions about privacy or your data: [contact@metapilot.io](mailto:contact@metapilot.io)