Privacy Policy

1. Who we are

Squad AI (squadai.company, with the app at my.squadai.company) gives a business owner an AI team: agents that plan and do work for their company. A separate product, Squad AI Assistant (assistant.squadai.company), is a personal assistant; section 9 covers what is specific to it.

This policy explains how we handle personal data when you use our website, the Squad AI app and the Assistant. For questions or requests, email support@squadai.company.

Operator and data controller: Topic Pillars LLC
Address: Newark, Delaware, United States

2. The short version

• We use your data only to provide the service you asked for.
• We do not sell your data, use it for advertising or use it to train AI models, ours or anyone else's.
• Connection credentials (tokens and API keys) are encrypted, never shown back in your browser and never given to AI models.
• Outward actions, such as publishing, replying or changing a store or ad account, wait for your approval by default.
• You can disconnect any platform or delete your company at any time. See Delete your data.

3. What we collect

• Account: your name, verified email address and Google account ID, which we receive when you sign in with Google. Sign-in is with Google only, and sign-up is by invitation.
• Your company workspace: what you create in Squad AI: the company profile, goals, projects, plans, files you upload, the work and outputs of your agents, your decisions and approvals, and KPI readings.
• Connection credentials: access and refresh tokens and API keys for the platforms you connect. They are encrypted, kept in a managed secrets vault at our cloud hosting provider, never shown back to the browser and never given to AI models.
• Billing: Stripe handles card payments. We never see or store full card numbers. We store your plan, invoices and credit balance.
• Technical logs: requests and errors, which we use for security and troubleshooting.
• Cookies and local storage: a session cookie, short-lived cookies that protect sign-in and platform connections (OAuth state), and a cookie that remembers the selected company. Your language and theme are kept in your browser's local storage. We use no advertising cookies and no third-party analytics or ad trackers on the website or in the app.

4. Data from platforms you connect

Squad AI reads from or acts on a platform only when you connect it, and only for the accounts you choose.

Meta: Facebook Pages and Instagram professional accounts

Connected with Facebook Login. We read the list of your Pages and Instagram accounts, their posts and media, comments, and Page and Instagram insights (reach, views, engagement and followers). We write only two things, publishing a post or reel and replying to a comment, and only after you approve each one in Squad AI. Until then it is held for your approval. If you connect a Meta ad account (the Meta Ads connector), we read its performance.

Google

Connected with Google OAuth: Search Console (read), Google Analytics 4 (read), Google Ads (read; pausing or enabling, changing a budget or creating a paused draft campaign only after your approval), and Google Calendar or Google Drive where you connect them.

Squad AI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Read the Google API Services User Data Policy. Google user data is not used for advertising, is not sold and is not used to train AI models. People at Squad AI do not read it, except with your permission, for security purposes or when the law requires it.

Salla and Zid online stores

Connected by installing our app or with OAuth. We read store information, orders, products, customers and sales summaries. Changes, such as a product's price, stock or status, or creating a coupon, happen only after you approve each one.

Order and customer records can contain personal data of the store's customers (names, emails, phone numbers and addresses). For that data the merchant is the controller; Squad AI processes it only to do the work the merchant asks for.

Other tools you connect

Tools you connect with your own keys follow the same rules: we read what the work needs, and outward actions wait for your approval by default. Examples: Stripe, PayPal and Tap (read-only), HubSpot, Salesforce, Zoho, Mailchimp, Klaviyo, Brevo, WordPress, Webflow, Wix, Intercom, Zendesk, Freshdesk, GitHub, GitLab, Slack, Telegram and WhatsApp.

5. How we use data

We use data only to provide the service you asked for: to plan, do and report your company's work and to measure your goals, and to keep that service secure and working.

• We do not sell data.
• We do not use it for advertising.
• We do not use it to train AI models, ours or third parties'. The AI providers below process it under API terms that exclude training.

6. AI processing

Squad AI's agents run on AI models from established AI model infrastructure providers, under business terms that do not allow them to use your data to train their models and that limit retention to what is needed to provide and secure the service. Data from your connected Meta, Google, Salla and Zid accounts is processed only by these providers, and only to do the work you asked for.

7. Who processes data, and where

We use carefully selected service providers (sub-processors) that process personal data on our behalf, under written contracts, only on our instructions and with appropriate security measures. They fall into these categories:

• AI model infrastructure providers: run the AI models behind Squad AI's agents. Processing can take place in the European Union and the United States.
• Cloud hosting and storage providers: host the app, the database, files, backups and the encrypted credentials vault. Your workspace data is stored in the European Union (Ireland).
• Payment processor (Stripe): handles card payments, subscriptions and invoices on its own secure checkout page.
• Email and messaging delivery providers: send sign-in, notification and report emails, and the messages you choose to receive in connected messaging apps.
• Isolated browser infrastructure: short-lived, isolated browser sessions, hosted in the European Union, when an agent needs to use a website for you.
• Sign-in and the platforms you connect: Google for sign-in, and Meta, Google, Salla, Zid and other platforms only as you connect them, under their own terms.

International transfers: when a provider processes personal data outside your country or the European Economic Area, for example in the United States, we rely on safeguards recognised by law, such as the European Commission's Standard Contractual Clauses (SCCs) or an adequacy decision, together with the provider's contractual security and confidentiality commitments.

Sub-processor list: a current list of our sub-processors is available on request, and is provided to business customers under our Data Processing Agreement (DPA). Write to support@squadai.company.

8. Security

• Data is encrypted in transit (TLS).
• Connection credentials are encrypted at rest.
• Each company's data is isolated at the database level (row-level security).
• Staff access is limited.

9. Squad AI Assistant

Squad AI Assistant (assistant.squadai.company) is a separate personal-assistant product. Besides the providers above, it may route a chat to additional AI model infrastructure providers, and it uses an internal scorer to pick the right model for each message. Data from platforms connected to Squad AI is not sent to these additional providers.

10. How long we keep data, and deletion

• Workspace data is kept while your account and company exist.
• Disconnecting a connection deletes its stored credentials immediately.
• Deleting a company (in Settings) erases its workspace data from our primary database right away. Billing and accounting records (invoices, payments and the credit ledger) are kept as long as tax and accounting law requires. Database backups roll off within 14 days.
• When you uninstall Squad AI from Salla or Zid, or remove Squad AI in Facebook (Settings & privacy > Settings > Apps and websites > Remove), we disconnect and delete the stored access tokens for those accounts.
• If you send a data deletion request from Facebook, we delete the Meta connections and tokens linked to your Facebook user and give you a confirmation code that you can check on our data deletion page.
• To delete your whole account, email support@squadai.company. We answer within 30 days.

11. Your rights

You can ask to access, correct, delete or export your data, object to or restrict how we process it, and withdraw your consent at any time (for a connected platform, by disconnecting it). You can also complain to a data-protection authority. To use these rights, email support@squadai.company.

12. Children

Squad AI is not for people under 18.

13. Changes to this policy

We post updates on this page with a new “Last updated” date. We tell you about material changes in the app or by email.

14. Contact

Questions about this policy or your data: support@squadai.company.