Privacy Policy

1. Who we are

AEO Autopilot (the Service) is operated by lukeduff.co.uk (Antigravity), a sole trader based in Sunderland, United Kingdom (we, us, our). We are the data controller for the personal data described in this policy. For any privacy question or request, contact us at hello@lukeduff.co.uk.

2. What this policy covers

This policy explains what personal data we collect when you visit our website or use the Service, why we collect it, the legal bases we rely on, who we share it with, how long we keep it, and the rights available to you under the UK GDPR and the Data Protection Act 2018.

3. The data we collect

• Account data. Your name, email address and organisation details, handled through our authentication provider when you sign up or sign in.
• Billing data. Subscription plan, billing status and payment metadata. Card details are handled entirely by our payment processor and never reach our servers.
• Service data. The brands, domains, buyer prompts, scan results and generated content you create in the Service. Where you connect a publishing integration, we store the credentials you provide, encrypted at rest.
• Usage and technical data. Privacy-friendly, aggregated analytics about how pages perform and are used. Our website analytics do not use tracking cookies and do not build advertising profiles.
• Communications. The content of emails you send us and our replies.

4. How and why we use your data

• To create and secure your account and provide the Service (performance of a contract).
• To run scans, generate content and publish it where you ask us to (performance of a contract).
• To take payment and manage your subscription (performance of a contract).
• To send service and security notifications, including visibility-drop alerts (legitimate interests and performance of a contract).
• To keep the Service secure, prevent abuse and debug problems (legitimate interests).
• To meet legal and accounting obligations (legal obligation).

5. Sub-processors we share data with

We do not sell your personal data. We share it only with the service providers that make the Service work, each acting as a processor under contract:

• Clerk — authentication and organisation management.
• Supabase — database hosting for your account and Service data.
• Vercel — application hosting and privacy-friendly analytics.
• Stripe — payment processing and subscription billing.
• Resend — transactional and alert email delivery.
• AI search and data providers — including OpenAI, Perplexity, Google (Gemini) and DataForSEO, which process the buyer prompts you track in order to return results and generate content.

When you publish content to your own website (for example WordPress), that content and the credentials you supply are sent to the destination you configure, under your control.

6. International transfers

Some of our providers process data outside the United Kingdom. Where they do, the transfer is protected by appropriate safeguards such as UK adequacy regulations or the International Data Transfer Agreement (or equivalent standard contractual clauses).

7. How long we keep it

We keep account and Service data for as long as your account is active. If you close your account, we delete or anonymise personal data within a reasonable period, except where we are required to retain records (for example billing records) to meet legal obligations.

8. How we protect it

Access to Service data is scoped to your organisation. Integration credentials are encrypted at rest, connections are served over HTTPS, and we apply security controls including request validation and least-privilege access. No system is perfectly secure, but we work to protect your data in line with recognised good practice.

9. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• ask us to correct inaccurate data;
• ask us to delete data (subject to legal retention);
• object to or restrict certain processing;
• request a portable copy of data you provided; and
• withdraw consent where we rely on it.

To exercise any of these, email hello@lukeduff.co.uk. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk, though we would appreciate the chance to resolve your concern first.

10. Cookies

We use a small number of strictly necessary cookies to keep you signed in and secure. Our analytics are cookieless. We do not use advertising or cross-site tracking cookies.

11. Children

The Service is for business use and is not directed at children under 16. We do not knowingly collect data from children.

12. Changes to this policy

We may update this policy from time to time. When we make material changes we will update the date above and, where appropriate, notify you by email.

13. Contact

Questions about this policy or your data? Email hello@lukeduff.co.uk.