Legal

Privacy Policy

Autobricks AI

This policy covers everything Autobricks AI runs: this website (autobricks.ai and creators.autobricks.ai) and the Autobricks AI platform, the signed-in product at autobricksai.com and creators.autobricksai.com with its chat, Creators Hub, Auto Bots and API. It says what we collect, why, who sees it, how long we keep it, and how to have it removed. It is written to be read, not to cover us.

1. Who we are

Autobricks AI ("we", "us") is a Singapore business and the agentic AI wing of Hexcore Labs. We are the data controller for everything described here. Questions go to [email protected].

2. This website

Browsing autobricks.ai or creators.autobricks.ai collects nothing about you. The pages are static files, set no cookies, and run no analytics or advertising scripts.

The contact form is Hexcore Labs' form, shared across the group. If you send us a message through it we store what you typed (your name, email address, phone number, organisation, what you ticked and your message), the page you sent it from, and the time. It is read by the people at Autobricks AI and Hexcore Labs who answer enquiries, used to reply to you, and for nothing else. You receive a copy by email. We keep it until you ask us to delete it.

If you message us on WhatsApp, WhatsApp's own terms apply to that conversation.

3. Your account on the platform

When you create an account we hold:

  • Account data. Your name, email address and avatar, from Google Sign-In or from what you typed at sign-up, and a password hash if you set one. This identifies your account.
  • What you make. Chat messages, Creators Hub workflows, prompts, the files you upload, the images, video and audio the models generate for you, Auto Bot configuration, API calls, and a ledger of the credits each run used. This is what makes the product work: your workflows are yours, and they have to be kept somewhere to be re-run.
  • Payment data. Handled entirely by Stripe. We never see or store your card number, CVC or expiry; we receive a Stripe customer ID and transaction metadata (the amount and the time).
  • Technical data. IP address, browser type and timestamps in server access logs, kept for security and debugging.

4. How we use it

  • To provide, maintain and improve the platform.
  • To sign you in and keep your account secure.
  • To take payment and track credit usage.
  • To answer support and sales enquiries.
  • To send transactional email: account confirmation, receipts, and notice of changes to this policy or the terms.

We do not sell your personal data. We do not use it for advertising. We do not share it with anyone for their own marketing. We do not use your prompts, uploads or outputs to train models, ours or anyone else's.

5. AI model providers

Generating with a model, or chatting with one, sends your prompt and any reference files to the provider of that model (Anthropic, OpenAI, Google and others; each is named where you pick it). Each provider processes it under its own privacy policy, and we do not control what they do beyond what those policies say. Do not put passwords, financial details, health records or other sensitive personal data in a prompt. A workflow you share with a link is visible to anyone holding the link until you revoke it.

6. Connected social accounts and ad accounts

The Creators Hub scheduler publishes to, and reads results from, accounts you connect to it. Each connection uses that platform's official API and asks only for the permissions listed below; you can untick any of them in the platform's consent screen and the feature that needs it simply stays off. Access tokens are encrypted at rest, tied to your account alone, and never pooled or shared across users. They live only while the connection does: disconnecting a channel in the scheduler, or deleting your account, deletes the stored token within minutes. Nothing is ever posted, changed or spent without an action you took or a schedule you set.

Facebook Pages (via Meta Platforms, Inc.)

  • Permissions. pages_show_list, pages_read_engagement, pages_manage_posts, pages_manage_engagement.
  • What we read. The list of Pages you manage (name, ID, picture) so you can pick one, and that Page's insights: reach, impressions, engagement and follower counts, and the public like, comment and share counts on posts we published. Shown only to you, in the scheduler's Analytics tab.
  • What we write. The text, photo and video posts you compose and schedule, to the Page you chose, at the time you set; and replies to comments on those posts when you ask for them.
  • What we do not touch. Your personal profile and timeline, your friends, Messenger, or any Page you did not connect.

Instagram (via Meta Platforms, Inc.)

Connecting an Instagram Business or Creator account uses Meta's Instagram API with Instagram Login.

  • Permissions. instagram_business_basic, instagram_business_content_publish, instagram_business_manage_insights, instagram_business_manage_comments.
  • What we read. Your Instagram user ID, username, profile picture and account type; your account's insights (follower count, reach, impressions, profile views); and for the posts we published, their ID, caption, timestamp, permalink and like, comment, saved and reach counts, plus the comments on them so you can reply.
  • What we write. The images, videos and captions you schedule, published to your own account at the time you set; and replies to comments when you ask for them.
  • What we do not touch. Direct messages, private follower lists, or any account other than the one you connected.

Meta Ads (via Meta Platforms, Inc.)

  • Permissions. ads_read, ads_management.
  • What we read. The list of ad accounts you have access to, so you can pick one; the campaigns, ad sets and ads in it (names, IDs, status, budgets); and their performance: spend, impressions, clicks, reach, frequency, conversions and revenue as Meta reports them. We request no demographic or placement breakdowns. Shown only to you, in the scheduler's Ads tab.
  • What we write. Exactly two things, and only when you press the button: pausing or resuming a campaign, ad set or ad, and changing its daily budget. We do not create ads, audiences or payment methods, and we never spend on your behalf.

For all three, revoke from the scheduler (Disconnect next to the channel) or in the Facebook or Instagram app under Settings, Apps and Websites, Autobricks AI, Remove. Either revokes the Meta grant and deletes the on-disk token within minutes. See Data deletion for the full flow.

YouTube (via Google LLC)

Connecting a YouTube channel uses the YouTube API Services. By connecting, you agree to the YouTube Terms of Service, and Google's handling of your data is governed by the Google Privacy Policy. Our use of YouTube data adheres to the Google API Services User Data Policy, including its Limited Use requirements.

  • What we read (scope youtube.readonly). Your channel's display name, avatar and public statistics (subscriber, view and video counts), and a list of your recent uploads with their public view, like and comment counts. Shown only to you, in the scheduler's Analytics tab.
  • What we write (scope youtube.upload). We upload and publish the videos you compose and schedule to your own channel, at the time and visibility (public, unlisted or private) you choose.
  • What we do not touch. Other users' channels, comments authored by your audience, or any data about anyone other than you. We do not use YouTube data for advertising, and never to develop, improve or train AI or machine-learning models.
  • Revoking. Disconnect YouTube in the scheduler, delete your account, or remove Autobricks AI at myaccount.google.com/permissions.

LinkedIn profiles and Company Pages

  • Permissions. One LinkedIn sign-in connects your own profile and the Company Pages you manage, and you tick which of them to connect. For your profile: w_member_social, r_basicprofile, r_member_postAnalytics, r_member_profileAnalytics. For Pages: rw_organization_admin, w_organization_social, r_organization_social. A profile can also be connected through our earlier LinkedIn app (openid, profile, w_member_social), which reads your name and picture to label the channel and otherwise only publishes.
  • What we read. Your LinkedIn member ID and name, to label your profile's channel. Which LinkedIn Pages you are an admin of, and their names and IDs, so you can choose which Pages to connect; a Page's name is refreshed at least every eight weeks. When you open the scheduler's Analytics tab, shown only to you: the follower count of your profile or Page; for a Page, its totals for the last 12 months and its newest posts, including ones made outside AutoBricks (their text and their impressions, clicks, reactions, comments and reposts); for your profile, the totals across your posts and the numbers for the posts we published for you. We also check that a video we uploaded has finished processing before we post it.
  • What we write. The posts you write or approve and schedule in the scheduler (text, images and videos), published as your profile or the Page you chose, at the time you set.
  • What we do not touch. We never read or show the comments themselves, who reacted or commented, or any other LinkedIn member's profile data, and we never change your Page's settings or admins. We do not sell LinkedIn data, use it for advertising, or use it to train AI models.
  • What we store. Your member ID and name, each connected Page's ID and name, the access and refresh tokens (encrypted at rest), and the IDs and links of the posts we published for you. Analytics, including the text of a Page's posts shown with them, are fetched when you open the Analytics tab, reused for up to six hours, and never written to our database.
  • Revoking. Disconnect the profile or Page in the scheduler, or delete your account, and the stored tokens are deleted within minutes. Removing the AutoBricks apps in LinkedIn under Settings, Data privacy, Permitted services revokes them at LinkedIn's end.
  • LinkedIn's terms. Connecting a LinkedIn Page means you also agree to the LinkedIn Pages Terms.

TikTok, X and Reddit

The same pattern, with the minimum each platform allows for publishing: we read your profile name and picture to label the channel, publish what you schedule (TikTok user.info.basic, video.publish; X tweet.read, tweet.write, users.read, media.write; Reddit submit, read), and read back the public counts on those posts. Revoke from the scheduler or from each platform's connected-apps settings.

7. Google Workspace and the Google API Services User Data Policy

When you connect a Google Workspace account to an Auto Bot, Autobricks AI's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

  • We use Google user data only to provide the bot functionality you asked for.
  • We do not transfer Google user data to third parties except as necessary to provide or improve user-facing features, to comply with applicable law, or as part of a merger, acquisition or sale of assets, with notice to you.
  • We do not use Google user data for advertising.
  • We do not allow humans to read your Google user data unless you have agreed to it for specific messages, we need to for security (such as investigating abuse), the law requires it, or it is for our internal operations and then only once aggregated and anonymised.

Google data your bot fetches (email it sends at your request, calendar events, Drive files it creates, contacts, Sheets and Docs content) is stored only inside your own bot container, under your control. It is never copied to Autobricks-owned databases or analytics. Revoke at any time from the bot's page (Disconnect Google) or at myaccount.google.com/permissions; either deletes the on-disk credentials within minutes.

8. Training and engagements

If your company trains with us or engages us to build, what we hold about you is governed by the agreement for that work. Class-group messages are never published without permission, and where they are, the sender is not identifiable.

9. How long we keep it

  • Account data. While your account is open. Ask for it to be deleted, see Data deletion.
  • Chat conversations, workflows and outputs. Until you delete them, or your account. Deleted conversations are removed permanently.
  • Social and Google access tokens. While the connection is on; disconnecting wipes the token within minutes.
  • Credit ledger and billing records. For as long as Singapore tax law requires, anonymised once the account is gone.
  • Server logs. 90 days.
  • Contact-form enquiries. Until you ask.

10. Security

HTTPS everywhere, data encrypted at rest, session tokens in HttpOnly cookies, and access tokens for connected accounts encrypted on per-bot storage. Payments are handled by a PCI DSS Level 1 certified processor; no card data touches our servers.

11. Cookies

This website sets none. The platform sets one session cookie to keep you signed in. No tracking cookies, no analytics cookies, no third-party cookies.

12. Your rights

Under Singapore's Personal Data Protection Act you may ask what personal data we hold about you, have it corrected, have it exported, or have it deleted. On the platform you can delete conversations and workflows yourself and disconnect any connected account from the scheduler or the bot's page. For an export, a correction, or to delete the account itself, write to [email protected]: we confirm within two working days and complete the request within thirty. The full deletion flow is on the Data deletion page.

13. Age

The platform is for people 18 and over, or younger people using it under an organisation that is. We do not knowingly collect personal data from anyone under 18 on their own account; tell us if we have and we will delete it.

14. Changes

If this page changes, the date at the top changes with it. Anything that changes what we do with data you have already given us will be emailed to you first, and continued use after that is acceptance.

15. Contact

[email protected], or the contact form.