Legal

Privacy policy

Last updated 4 November 2026

This policy explains what Brand Autopilot (“we”, “us”) collects when you visit this site, use the platform, or connect a social media account to it, why we collect it, and the choices you have. We collect only what the service needs, and we never sell personal data. We handle personal data in line with Kenya's Data Protection Act, 2019.

Who we are

Brand Autopilot is a product of Utawazi Dev. & Branding Limited, a company registered in Kenya, which is the data controller responsible for personal data processed through the service.

When a business uses Brand Autopilot to manage its own customers' data, such as WhatsApp contacts or comments on its posts, that business decides why the data is used and we process it on its behalf.

What we collect

• Your account: your name, email address, sign-in credentials (passwords are stored only as salted hashes), passkeys, two-step verification settings, profile details you add, and the companies and roles you belong to.
• Company details: the company's name, website and social media handles, and a short company profile drafted from public web pages, which the owner reviews before it is saved.
• Your content: brand blueprints, interview answers, documents you upload to build a blueprint, briefs, drafts, posts, review notes, images and videos, and your publishing schedule. We remove location and camera details from images and videos when you upload them.
• Connected social accounts: when you connect Facebook, Instagram, LinkedIn, TikTok, YouTube, WhatsApp Business or a WordPress or Ghost blog, we receive the account, page or site name and ID and the access tokens or keys it issues. These are sealed (encrypted) so only our publishing service can use them.
• Data from the networks about your posts: engagement numbers such as likes, reach and views for posts we published, for up to 30 days after posting, and, where you use the inbox, the comments people leave on those posts, including the commenter's public name.
• WhatsApp contacts: for WhatsApp broadcasts, the phone numbers and names your business adds, with a record of each contact's opt-in and of each message sent. People who reply STOP are opted out automatically.
• Payments: the plan and period bought, amounts, currency, Paystack's payment reference and status, and, only if the owner chooses to save a card, Paystack's reusable card authorisation (sealed) with the card type, last four digits and expiry date. We never receive or store full card numbers or M-Pesa PINs.
• Activity and security records: an audit log of actions in each workspace, sign-in and rate-limit records, AI usage counts, and server logs with request IDs, used to keep the service secure and working.
• Contact form: the name, email, company, topic and message you send us, used only to reply.

Why we use it, and on what basis

• To provide the service you signed up for (performance of a contract): accounts, drafting, approvals, publishing, the inbox, analytics, billing and support.
• To keep it secure and working (legitimate interests): rate limits, audit logs, fraud and abuse prevention, and fixing faults.
• To meet legal duties (legal obligation): tax and accounting records, and answering lawful requests.
• With your consent: the weekly growth brief email, saving a card for renewals, and, for WhatsApp, each contact's opt-in. You can withdraw consent at any time.

We do not use your data for advertising, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

AI processing

Drafts, content plans, blueprint suggestions, company profiles, growth briefs and suggested comment replies are written by Claude, an AI model made by Anthropic. We send only what each task needs, such as the brief, the brand blueprint, or the comment being answered. Under Anthropic's commercial terms, this data is not used to train its models. See AI and automation for details.

Cookies

We use only cookies the service needs. We use no advertising or third-party tracking cookies. Our cookie policy lists each one.

Who we share data with

• Social networks and blogs (Meta for Facebook, Instagram and WhatsApp; LinkedIn; TikTok; Google for YouTube; your WordPress or Ghost site), when you connect an account and when we publish a post or reply you approved.
• Anthropic, which provides the Claude AI model, including its web search for drafting company profiles.
• Paystack, which processes M-Pesa and card payments. Paystack handles your payment details under its own privacy policy.
• Hosting and email providers, such as DigitalOcean for servers and file storage, and our email provider for invitations, notices and replies.
• Have I Been Pwned, to check new passwords against known breaches. Only the first five characters of a one-way hash of the password are sent, never the password itself.

These providers may process data outside Kenya. Where they do, we rely on the safeguards the Data Protection Act requires, such as contractual protections. We share data with authorities only when the law requires it.

How long we keep it

• Account and workspace data: for as long as the workspace is active.
• Invitations: they expire within 30 days.
• Media files: until the company deletes them or, if its owner agreed a retention policy, until they are retired under that policy after notice.
• Social account tokens: until the account is disconnected, which deletes them at once.
• Payment records: as long as tax and accounting law requires.
• When a workspace closes or you ask us to delete your data, we delete it within 30 days, apart from records we must keep by law.

Your rights

Under the Data Protection Act, you have the right to:

• be told how your data is used, which is what this policy does;
• see the personal data we hold about you, and get a copy;
• have wrong or incomplete data corrected;
• have data deleted;
• object to processing, or ask us to restrict it;
• receive your data in a portable format;
• withdraw consent you gave, at any time.

Email privacy@utawaziea.com, or use our contact page with the topic “Privacy or data deletion”. We may ask you to confirm your identity first. If you are not happy with our answer, you can complain to the Office of the Data Protection Commissioner of Kenya.

To delete data a social network shared with us, see Data deletion.

Security

Each company's data is kept separate by checks in the app and row-level security in the database. Connections are encrypted, access tokens are encrypted, and sign-in supports passkeys and two-step verification. Security describes our measures. If a breach puts your data at risk, we will tell you and the Data Protection Commissioner as the law requires.

Children

The service is for businesses and is not meant for anyone under 18. We do not knowingly collect children's data.

Changes

If we change this policy, we will update the date above and tell account holders about significant changes before they take effect.