MXPilot Privacy Policy

Last Updated: April 25, 2026

This Privacy Policy explains how MXPilot, Inc. ("MXPilot," "we," "us," or "our") collects, uses, discloses, and protects personal information in connection with the MXPilot website, platform, applications, products, services, support, billing, marketplace, and related offerings (collectively, the "Services").

MXPilot is a performance co-pilot platform for marketing agencies and the Managed Brands in their care. The Services help agencies configure Agency Workspaces, Managed Brands, Credential Vaults, Client Onboarding Pages, Connected Sources, Automations, Performance Marketing Agents, attribution, recommendations, reports, dashboards, and Marketplace features.

1. Scope And Roles

This Privacy Policy is primarily about personal information that MXPilot handles for its own business purposes, such as website, account, billing, support, security, sales, marketing, Marketplace, and service-operations information.

When MXPilot processes Managed Brand Data, Managed Brand Credentials, Connected Source data, campaign data, business records retrieved from customer-authorized systems, prompts, configurations, files, or other Customer Content on behalf of an Agency or other customer, MXPilot generally acts as a processor, service provider, contractor, or similar role under the Platform Terms, Data Processing Addendum ("DPA"), customer instructions, and applicable agreements. In those cases, the Agency or customer is responsible for deciding what data to submit or connect, providing required notices, obtaining required consents, and responding to data rights requests unless the parties agree otherwise.

Not every category described below applies to every customer, Managed Brand, user, feature, integration, or workflow. The information MXPilot processes depends on how the Services are configured and used.

This Privacy Policy does not apply to third-party platforms, Connected Sources, websites, applications, or services that are not owned or controlled by MXPilot. Those third parties' own terms and privacy policies apply to their services.

2. Personal Information We Collect

Depending on how you use the Services, MXPilot may collect or process the following categories of personal information.

MXPilot does not require customers to submit sensitive personal information unless it is necessary for authorized Platform functionality, required by the applicable Connected Source or agreement, or expressly supported by MXPilot. Agencies and Authorized Users must not submit sensitive personal information unless they have the rights, notices, consents, and safeguards required for that use.

Payment-card or bank-account details may be collected and processed directly by our payment processor rather than by MXPilot. MXPilot may receive payment method metadata, transaction records, subscription status, invoices, payout or settlement records, and fraud or billing signals needed for billing and account administration.

3. How We Use Personal Information

MXPilot uses personal information as reasonably necessary to:

• provide, operate, secure, monitor, and improve the Services;
• create and administer Agency Workspaces, Managed Brands, accounts, roles, permissions, billing settings, and Marketplace settings;
• configure and operate Credential Vaults, Client Onboarding Pages, Connected Sources, Automations, Performance Marketing Agents, reports, dashboards, Activity Logs, attribution, recommendations, and Marketplace features;
• process subscriptions, Platform Credits, invoices, taxes, refunds, chargebacks, Marketplace settlement, and related billing activity;
• provide support, training, white-glove services, troubleshooting, service communications, and customer success;
• generate recommendations, outputs, reports, insights, drafts, attribution summaries, and other Platform outputs for review;
• detect, investigate, prevent, and respond to fraud, spam, abuse, security incidents, policy violations, unlawful activity, and technical issues;
• comply with law, legal process, contractual obligations, and our agreements;
• enforce our terms, protect our rights, and resolve disputes;
• conduct analytics, benchmarking, quality review, product development, and service improvement using personal information, Aggregated Data, or Deidentified Data as permitted by our agreements and law; and
• communicate with you about the Services, updates, security, support, events, surveys, and offers, subject to your choices and applicable law.

4. AI, Automations, And Outputs

The Services may use artificial intelligence systems, Automations, Performance Marketing Agents, and connected tools to analyze information, generate recommendations, draft content, configure workflows, run approved actions, and produce outputs.

Some AI features may allow an Agency or Authorized User to select, enable, connect, or configure a model provider, model family, inference provider, enterprise AI account, API key, or bring-your-own-model service. If MXPilot provides an AI feature through an MXPilot-contracted provider account, personal information may be disclosed to that provider as described in this Privacy Policy, the DPA, and the applicable subprocessor or material provider list. If you connect or use your own AI provider account, API key, enterprise account, or third-party AI service, that provider is generally your authorized third-party service or Connected Source, and its own terms, privacy policy, retention settings, training settings, and data-use configuration apply.

You are responsible for reviewing outputs and approving material actions before relying on them or allowing them to affect a Managed Brand, customer communication, campaign, budget, listing, attribution rule, external account, or other business decision.

MXPilot does not use Customer Content to train third-party foundation models through MXPilot-contracted AI provider accounts unless authorized by the customer or stated in applicable supplemental terms. Customer-selected AI provider accounts, API keys, enterprise accounts, and bring-your-own-model services may be governed by your own settings and provider terms. MXPilot may use Aggregated Data and Deidentified Data for analytics, benchmarking, product development, reporting, Marketplace quality, and business purposes, provided that the data does not identify a customer, Managed Brand, individual, or confidential campaign information.

5. How We Disclose Personal Information

MXPilot may disclose personal information to:

• service providers, processors, subprocessors, contractors, and vendors that help us provide hosting, infrastructure, security, analytics, customer support, communications, payment processing, credential/connectivity infrastructure, AI functionality, billing, tax, legal, compliance, and other business services;
• Connected Sources and third-party platforms when authorized by an Agency, Authorized User, Managed Brand representative, or Platform configuration;
• Agencies, Authorized Users, administrators, and Managed Brand representatives according to Platform roles, permissions, workflows, reports, dashboards, Activity Logs, and account settings;
• Marketplace participants where information is part of a Marketplace Listing, Marketplace transaction, Marketplace reporting, or Marketplace support workflow, subject to applicable settings and terms;
• professional advisors, auditors, insurers, legal counsel, and financial institutions;
• regulators, courts, law enforcement, government authorities, or other parties where required by law or legal process;
• parties involved in an actual or potential merger, acquisition, financing, investment, reorganization, bankruptcy, sale of assets, or similar transaction; and
• other parties with your direction, consent, or as otherwise described when the information is collected.

We do not sell personal information for money. We do not share personal information for cross-context behavioral advertising or process personal information for targeted advertising as those terms are used under applicable U.S. state privacy laws unless we provide the required notices and opt-out mechanisms.

6. Cookies And Similar Technologies

We and our service providers may use cookies, pixels, SDKs, local storage, log files, and similar technologies to operate the website and Platform, remember settings, authenticate users, secure sessions, analyze usage, improve Services, and support marketing or communications.

You can control cookies through your browser settings and, where available, through our cookie banner or preference tool. Some features may not work properly if you disable certain cookies.

7. Legal Bases For Processing

Where a legal basis is required, we process personal information based on one or more of the following legal bases:

• performance of a contract, including providing the Services and administering accounts;
• legitimate interests, including service operation, security, support, improvement, analytics, billing, and business communications;
• consent, where required for certain cookies, marketing communications, Connected Source authorizations, or other processing;
• compliance with legal obligations; and
• protection of rights, safety, and security.

8. Security

MXPilot maintains reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, use, disclosure, alteration, or destruction. These safeguards include access controls, authentication controls, encryption where appropriate, credential vaulting or equivalent secure credential-management systems, logging, monitoring, vendor controls, and incident-response processes.

For enterprise and DPA purposes, the MXPilot Security Measures Addendum describes technical and organizational measures in more detail.

No system can guarantee perfect security. Agencies and Authorized Users are responsible for account security, Authorized User management, credential hygiene, role and permission settings, Connected Source permissions, and approving appropriate scopes and access methods.

9. Retention

MXPilot retains personal information for as long as reasonably necessary to provide the Services, maintain accounts, comply with legal and contractual obligations, resolve disputes, enforce agreements, maintain security, prevent abuse, support business operations, and for the other purposes described in this Privacy Policy.

Retention periods vary depending on the type of information, account settings, customer instructions, legal requirements, backup practices, security needs, billing records, Marketplace records, Activity Logs, and the applicable agreement. Credentials may be deleted, revoked, or disconnected according to Platform functionality, Connected Source behavior, customer instructions, and applicable provider capabilities.

10. Your Choices And Rights

Depending on where you live and subject to applicable law, you may have rights to:

• access personal information we maintain about you;
• correct inaccurate personal information;
• delete personal information;
• receive a portable copy of personal information;
• opt out of targeted advertising, sale, or sharing of personal information;
• limit certain uses or disclosures of sensitive personal information;
• withdraw consent where processing is based on consent;
• appeal a decision regarding a privacy request; and
• not be discriminated against for exercising privacy rights.

To submit a request, contact us at legal@mxpilot.ai or use any privacy request method we provide. We may need to verify your identity and authority before responding. If your request relates to personal information we process on behalf of an Agency or customer, we may refer the request to that Agency or customer or respond according to our contractual obligations.

Authorized agents may submit requests where permitted by law. We may require proof of authorization and identity verification.

11. California And Other U.S. State Privacy Notice

Certain U.S. state privacy laws may require additional disclosures. The categories of personal information we may collect are described in Section 2. We may disclose those categories for the purposes described in Sections 3 and 5.

We use sensitive personal information only for purposes permitted by law, such as providing requested Services, securing accounts, processing payments, authenticating Connected Sources, preventing fraud, and complying with law. We do not use sensitive personal information to infer characteristics about individuals unless expressly disclosed and permitted by law.

12. International Transfers

MXPilot is based in the United States. Personal information may be processed in the United States and other locations where MXPilot or its service providers operate. If applicable law requires a transfer mechanism, we will use appropriate safeguards, which may include contractual terms or other lawful mechanisms.

13. Children

The Services are intended for business users and are not directed to children. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, contact us and we will take appropriate steps to delete it.

14. Changes To This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be posted with a new "Last Updated" date. If changes are material, we may provide additional notice as required by law or through the Services.

15. Contact Us

MXPilot, Inc.

Attn: Privacy

Austin, Texas, United States

Email: legal@mxpilot.ai

Support: support@mxpilot.ai