Privacy Policy

Autom8x is a service operated by Snoopy LLC, 14355 Francis Lane, Frisco, Texas 75035, United States ("Autom8x", "we", "us"). For account, billing, and usage information, Snoopy LLC is the data controller. For workspace content and data processed by the automations a business enables, that business is the controller and Autom8x processes the data on its documented instructions; business customers can request our data processing terms at singh@autom8x.ai.

The service is offered from the United States and is not currently directed to persons in the European Economic Area or the United Kingdom.

Account information. You sign in with a Google, Microsoft, or Apple account — Autom8x has no passwords. From your sign-in provider we receive your name, email address, and profile picture, and we use them to create and identify your Autom8x account. We do not receive your provider password, and signing in does not give Autom8x access to your files, mail, or any other content in that provider account.

Workspace content. What you and your team put into the platform: workspaces, team membership, automation subscriptions and their configuration, runs and their results, and approval decisions.

Connected accounts for automations. If you connect a provider account so an automation can use it, you approve that access on the provider's own consent page — it is always a separate, explicit grant, never something sign-in creates silently. The access tokens the provider issues are stored encrypted (AES-256-GCM envelope encryption). Automations never hold your credentials; the platform makes each provider call on their behalf and records what was done.

Usage and log data. Standard operational logs (request metadata, IP addresses, timestamps, errors) used to run, secure, and debug the service.

Autom8x uses only strictly necessary cookies: HttpOnly, Secure session cookies that keep you signed in to the web app, and short-lived values that protect the sign-in flow (such as OAuth state). We set no advertising, social media, or third-party analytics cookies. Because we do not track you across other sites, our sites do not respond differently to "Do Not Track" signals; because we do not sell or share personal information, a Global Privacy Control signal does not change how we already treat your data.

For sign-in, Autom8x requests only basic profile information from Google (name, email address, profile picture) and uses it solely to create and operate your account. If, in the future, an automation you enable requests access to additional Google data, that access will be requested separately on Google's consent screen and used only to provide the feature you enabled.

Autom8x's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, do not transfer it for advertising, and do not permit humans to read it except with your affirmative agreement, for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and anonymized and is used for internal operations.

To provide the service: run the automations you subscribe to, enforce your workspace's roles and approvals, show you what happened, and bill for what you use. To secure it: authentication, abuse prevention, and audit. To improve it: aggregate, de-identified usage analysis. We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use your data for advertising of any kind.

Only service providers that host and operate the platform for us, each processing data in the United States under an agreement with us: Supabase (authentication and database), DigitalOcean (application hosting), Vercel (website hosting), Backblaze (encrypted off-site backups), and Datadog (operational logs and monitoring). We will update this policy before adding or replacing a subprocessor category.

Your sign-in provider (Google, Microsoft, or Apple) and the providers you choose to connect for automations are independent services governed by their own privacy policies — they are not our service providers.

We disclose information if required by law, and in a merger or acquisition we would require the successor to honor this policy.

Your data is retained while your account is active. You can delete your account from Settings; deletion removes your account data from live systems promptly, and nightly encrypted backups rotate on a fixed schedule, so deleted data leaves the backup set as those backups age out. Operational logs are kept for a limited period for security and debugging. Billing records are kept as long as tax and accounting law requires. Disconnecting a connected provider account revokes and deletes its stored tokens immediately.

All traffic is encrypted in transit (TLS). Provider tokens are envelope-encrypted at rest under keys held separately from the database. Access is workspace-scoped and fails closed: an unconfigured or unauthorized path refuses rather than degrades. If we learn of a breach of security affecting your personal information, we will notify affected account holders and, where required, regulators without undue delay and in accordance with applicable law; where we process workspace content on a business customer's behalf, we will notify that customer without undue delay after becoming aware of the breach.

You can access, correct, export, or delete your personal information. Account deletion and workspace export are available directly in Settings, and you can make any request at singh@autom8x.ai. We respond to verifiable requests within the time applicable law requires and will never discriminate against you for exercising a right.

In the preceding 12 months we collected these categories of personal information: identifiers (name, email address, account IDs, IP address); commercial information (subscriptions and billing records); internet or network activity (log and usage data); professional information (your workspace and role); audio/visual information (your profile picture); and sensitive personal information limited to credentials for the provider accounts you choose to connect, stored encrypted. We collect them directly from you, from your sign-in provider, from providers you connect, and automatically from your use of the service; we disclose them for business purposes only to the service providers listed above; we retain them as described in Retention and deletion.

We do not sell personal information and we do not share it for cross-context behavioral advertising, as those terms are defined by the California Consumer Privacy Act, and we have not done either in the preceding 12 months. We have no actual knowledge of selling or sharing the personal information of consumers under 16. Because we do not sell or share personal information, we do not provide a "Do Not Sell or Share My Personal Information" link, and we use sensitive personal information only to provide the service you request. Submit requests at singh@autom8x.ai or in Settings; an authorized agent may act for you with signed permission. If you live in a state whose privacy law grants an appeal right and we decline your request, you may appeal by replying to our decision, and if we deny the appeal we will tell you how to contact your state attorney general.

The service is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided us personal information, contact singh@autom8x.ai and we will delete it.

The date at the top is the date this policy was last updated. We review this policy at least once every 12 months. Material changes are announced by email or in the product before they take effect; non-material clarifications take effect when posted. Prior versions are available on request.

singh@autom8x.ai · Snoopy LLC, 14355 Francis Lane, Frisco, Texas 75035, United States.