This policy explains what data FOX.AUTOPILOT collects, what we use it for, how long we keep it, and what rights you have. It is written to comply with Thailand's Personal Data Protection Act B.E. 2562 (2019) and with Meta Platforms' requirements for applications that connect to advertising accounts.
FOX.AUTOPILOT
Registered e-commerce operator · Chanthaburi Province, Thailand
Commercial registration no. [registration in progress]
Privacy enquiries: privacy@foxautopilot.com
| Category | Details | Legal basis |
|---|---|---|
| Account data | Email, the name you provide, and a password stored as a one-way hash that cannot be reversed | Performance of contract |
| Facebook connection data | Ad account IDs and names, account status, and the access token issued by Meta, stored encrypted | Consent and performance of contract |
| Advertising performance data | Spend, revenue, purchases, clicks and other metrics retrieved from the Facebook Marketing API | Performance of contract |
| Rules you create | Conditions, active hours and actions you define | Performance of contract |
| System activity log | Every budget change or pause, with timestamp, before and after values, and the rule that triggered it | Legitimate interest (auditability and dispute resolution) |
| Payment data | Payment history and subscription status. We never store card numbers. All payment processing is handled by Stripe. | Performance of contract and legal obligation |
| Technical logs | IP address, browser type and access times, for system security | Legitimate interest |
We do not sell, rent or trade your data. We do not use your advertising data for anything beyond providing the service you requested.
When you connect with Facebook you see the exact permissions requested and grant them yourself. The permissions the system actually uses are:
| Permission | What it is used for |
|---|---|
ads_read | Reading performance data such as spend, revenue and purchases |
ads_management | Adjusting budgets and pausing or resuming campaigns, strictly according to your rules |
business_management | Listing the ad accounts you have access to, so you can choose which ones to connect |
The system does not access your personal Facebook profile — not your friends list, messages, or personal posts.
You can revoke access at any time, either inside FOX.AUTOPILOT or directly on Facebook under Settings & Privacy → Settings → Apps and Websites. Once revoked, the system stops accessing your ad accounts immediately.
We share data only as far as necessary to deliver the service, with these providers:
| Provider | Role | Data involved |
|---|---|---|
| Meta Platforms | Source of advertising data and destination of budget changes | Requests made on your behalf using your own token |
| Stripe | Payment processing | Email, amounts, and card details sent directly to Stripe — never through our systems |
| Google (Firebase Hosting) | Website hosting | Standard technical logs |
| Language-model provider (AI) | Explaining results in the assistant feature | Pre-computed summary figures only — no raw data, no identifying information |
We may also disclose data when required by a court order or a lawful request from a competent government authority, or where necessary to protect the rights and safety of other users.
| Data | Kept for |
|---|---|
| Account, rules and connections | While your account is active; deleted within 30 days of a deletion request |
| Facebook access tokens | Deleted immediately when you disconnect or delete your account |
| Advertising performance data | Up to 24 months, then deleted automatically |
| System activity log | 24 months, so you can audit past actions |
| Accounting and tax records | As required by Thai law — currently 5 years from the end of the accounting period |
Accounting records are retained because the law requires it, so they remain after account deletion. They are separated from usage data and access is restricted to what is strictly necessary.
Under Thailand's PDPA you have the right to:
Send requests to privacy@foxautopilot.com from the email address on your account. We acknowledge within 7 days and complete the request within 30 days, free of charge.
In the event of a personal data breach that poses a risk to your rights, we will notify Thailand's Personal Data Protection Committee within 72 hours and inform you without undue delay.
The public marketing pages use no tracking or advertising cookies. Inside the product we use only strictly necessary cookies: keeping you signed in, and remembering your theme and language preference, which are stored in your own browser and not sent to us.
Some providers listed in section 5 operate servers outside Thailand. Transfers are limited to what is necessary to deliver the service you requested, and we select providers that maintain internationally recognised data protection standards.
This service is intended for business operators aged 20 or over. We do not knowingly collect data from minors. If you believe a minor's data has been provided, please contact us so we can delete it.
For material changes we will notify you by email and display a notice in the product at least 30 days before they take effect. Minor wording changes are reflected by updating the date at the top of this page.
Privacy matters: privacy@foxautopilot.com
General enquiries: support@foxautopilot.com
If you are not satisfied with how we handle your request, you have the right to lodge a complaint with Thailand's Personal Data Protection Committee (PDPC).