Autopilox Privacy Policy

Autopilox is operated by DEVELOPMENT AND NEW TECHNOLOGIES HUB P.C. (ΚΟΜΒΟΣ ΑΝΑΠΤΥΞΗΣ ΝΕΩΝ ΤΕΧΝΟΛΟΓΙΩΝ Ι.Κ.Ε.) under the OSQOM identity. The company is registered at Distomou 1, 18532 Piraeus, Greece, with VAT ID EL801496850 and G.E.MI. number 157992801000.

This policy applies specifically to Autopilox and its Google OAuth connection. It supplements, and is separate from, the general privacy notice for the OSQOM corporate website.

Autopilox is a private email-operations platform for authorised OSQOM teams. It lets administrators connect selected sender accounts, configure email campaigns and sequences, send messages and follow-ups, and detect replies, bounces and unsubscribe requests.

A Google account is not connected automatically. An authorised user must deliberately start the Google OAuth flow, choose the relevant account and approve the permissions shown by Google.

Autopilox requests the Google account email address so it can confirm that the connected Gmail mailbox matches the sender account selected by the administrator.

The Gmail send permission is used to send emails and follow-ups that an authorised Autopilox user has configured.

The Gmail read-only permission technically permits viewing Gmail messages and settings. Autopilox limits its operational use to mailbox identity checks and the message or thread information needed to recognise replies, bounces and opt-out requests. This can include message and thread identifiers, sender and recipient addresses, subject lines, selected email headers, dates and limited message snippets when required for classification.

Connection data may include the connected email address, granted OAuth scopes, connection status and timestamps, encrypted OAuth refresh token, encryption initialisation vector, token-refresh status and technical error records. Short-lived access tokens are used to communicate with Google APIs and are not intentionally retained as permanent records.

Operational email records may include recipient and sender email addresses, campaign or sequence identifiers, Gmail message and thread identifiers, RFC Message-ID values, selected headers, subject lines, timestamps and event classifications such as sent, replied, bounced or unsubscribed.

Autopilox also stores information entered directly into the service, such as sender settings, contacts, campaign content, templates, schedules and suppression choices. Autopilox does not intentionally import or retain the complete historical contents of a connected Gmail mailbox through this custom OAuth connection.

Autopilox's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google user data is not sold. It is not used for personalised advertising, creditworthiness decisions, unrelated profiling or the training of general-purpose artificial intelligence or machine-learning models. Human access is limited to cases where it is necessary for user-requested support, security investigation, legal compliance or service operation, and only by authorised personnel subject to appropriate confidentiality obligations.

Google data is not shared with independent third parties for their own marketing or commercial purposes. It may be processed by Google to provide Gmail and OAuth services, by Base44 and its underlying infrastructure providers to host and operate Autopilox, and by authorised OSQOM service providers that support security or technical operations under confidentiality and data-protection obligations.

Information may also be disclosed when required by law, a binding order, or when reasonably necessary to protect users, systems, legal rights or public safety. We do not sell personal data.

OAuth refresh tokens are encrypted using AES-GCM before storage. OAuth state is cryptographically signed, connections are made over HTTPS, and records containing Gmail credentials or Google-derived operational data are restricted to administrative access.

We apply proportionate technical and organisational safeguards, access controls, monitoring and incident-response measures. No internet transmission or storage system can be guaranteed completely secure.

OAuth credentials are retained while the corresponding Gmail sender connection remains active and for no longer than necessary to provide the service, resolve security or support issues, or meet legal obligations. Operational email metadata is retained while it is needed for campaign history, suppression, reply handling, security and accountability.

An authorised user may disconnect the Gmail sender, revoke Autopilox access in the Google Account permissions page, or request deletion by contacting osqom.com@gmail.com. Revocation prevents future Google API access. Following a verified deletion request, we will delete the relevant OAuth credential and Google-derived operational data within 30 days, except for limited records that must be retained for legal, security, anti-abuse or backup-integrity reasons. Residual backup copies are removed through the normal backup lifecycle.

Where the GDPR applies, processing needed to provide Autopilox and its requested functionality is based on performance of a contract or steps requested before entering a contract under Article 6(1)(b). Security, service reliability, fraud prevention and operational accountability rely on our legitimate interests under Article 6(1)(f). Processing required by law relies on Article 6(1)(c). Where consent is the appropriate basis, it may be withdrawn at any time without affecting earlier lawful processing.

Google OAuth approval controls access permissions but does not replace any consent or other legal basis required under applicable data-protection or electronic-communications law.

Some providers may process data outside the European Economic Area. Where required, we rely on an applicable adequacy decision, the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism, together with supplementary safeguards where appropriate.

Subject to applicable law, you may request access, rectification, erasure, restriction or portability of your personal data, or object to processing based on legitimate interests. You may also withdraw consent where processing relies on consent.

Send requests to osqom.com@gmail.com. We may ask for information needed to confirm identity and authority over the relevant account. You may lodge a complaint with the Hellenic Data Protection Authority at dpa.gr or with the competent authority in your country.

Autopilox is a business service for authorised professional users and is not directed to children.

We may update this policy when Autopilox functionality, Google permissions, service providers or legal requirements change. Material changes will be reflected by updating the revision date and, where appropriate, providing additional notice.

Privacy and data-deletion requests: osqom.com@gmail.com. General OAuth support: designagency.gr@gmail.com. Postal address: Distomou 1, 18532 Piraeus, Greece.