AutoAgent Privacy Policy

Last updated: November 2026

Who we are

AutoAgent is a Shopify app that writes and publishes marketing content for your store: daily Facebook and Instagram posts, product Reels and weekly blog articles. It is a Web-Pex product. Contact: hello@web-pex.com.

What we collect

• Store information: your shop domain, store name, and the products you make available on your online store — used solely to generate content about your own catalog.
• App settings: tone of voice, brand voice text, posting schedule, what to post, and your brand logo and colour if you add them.
• Store contact: the store owner's name and email from Shopify, used for service emails about your installation (welcome, problems, uninstall). Marketing emails are sent only if you opt in under Settings, and you can opt out at any time.
• Telegram (optional): if you connect Telegram, the chat ID used to send you run summaries and receive your commands. Unlinking deletes it.
• Plan: whether you are on Free or Pro, your trial end date and your Pro post balance. Payments are handled entirely by Shopify; we never see card or bank details.
• Platform tokens: when you connect Facebook, Instagram, Pinterest, YouTube or TikTok, we store the access token needed to post on your behalf. Tokens are encrypted at rest (AES-256-GCM) and never logged.
• Content history: the posts and articles the app prepares and publishes for you (captions, images, Reel videos, links to the live posts), and AI usage metrics (token counts and cost) used for cost tracking.

Shopify permissions we request, and why

When you install AutoAgent, Shopify shows two permissions. Here is exactly what each one is used for:

• Read products (read_products): we read your product titles, descriptions, prices and images to write social posts, Reels and blog articles. AutoAgent can't change your products: it never edits, creates, deletes or reprices products, and never modifies your collections.
• Edit Online Store content (write_content): this is the permission Shopify's API requires to create and publish blog articles on your store blog. AutoAgent uses it exclusively for blog posts: each week's article is saved as a hidden draft in your blog until it publishes (or you skip it). It never edits your theme, homepage, navigation, or any other storefront page.

In short: AutoAgent reads product data and writes blog articles. Nothing else is touched, and every kind of post can be switched off in Settings at any time.

What we do not collect

AutoAgent does not collect, store, or process your customers' personal information. No customer names, emails, addresses, or order details are read or retained.

How content is generated

Product titles and descriptions from your store are sent to AI providers (Anthropic, Groq, Google, and OpenRouter as a backup when those are unavailable) to generate marketing copy. Only catalog data and your brand voice settings are shared — never customer data. Some free backup models may use requests to improve their service, which is why nothing beyond catalog data is ever sent. Branded image posts are drawn by AutoAgent itself from your product photo, name and price; no image service receives them.

AI scenes (Pro only): when you ask for an AI scene, the product photo, name and the chosen style are sent to an image model (Google Gemini, through OpenRouter) to create the scene. You approve every scene before it posts. Nothing is sent unless you create one.

Product Reels: short videos that AutoAgent makes itself from your product photos, name, price, logo and licensed music. No AI or video service receives your photos. The finished video is stored with our storage provider (Cloudflare R2) only so Facebook and Instagram can fetch it, and is deleted 3 days after it is posted, or within a few days if it is never posted. You can turn Reels off in Settings at any time.

Data deletion

Uninstalling AutoAgent from your Shopify admin immediately deletes your session, connected platform tokens, and settings. All remaining data (content history, usage logs, prepared images and Reel videos, and your Pro credit balance and history) is permanently deleted within 48 hours via Shopify's mandatory shop-redact process. You can also request immediate deletion by emailing hello@web-pex.com. Posts and articles already published stay on your Facebook Page, Instagram, Pinterest, YouTube channel and blog; you can delete them there. Drafts sent to your TikTok inbox stay there until you post or delete them in TikTok.

Facebook & Instagram data

When you connect Meta platforms, we store your Page ID, Page name, Instagram account ID, and an encrypted access token. We use them only to publish the content you configure. Disconnecting the platform in the app, or uninstalling the app, deletes these immediately. To request deletion of data associated with your Facebook account, uninstall the app or email hello@web-pex.com.

Pinterest data

If you connect Pinterest, we store your Pinterest account ID, the board you choose, and an encrypted access token. We use them only to list your boards (so you can pick one) and to create Pins of your own products: the product photo, title, description and a link to the product page, after you have previewed the post in the app. We do not read your followers, messages, analytics or other Pins. Disconnecting Pinterest in the app, or uninstalling the app, deletes this data immediately. To request deletion, email hello@web-pex.com.

YouTube data

If you connect YouTube, AutoAgent uses YouTube API Services. We ask Google for one permission only: uploading videos to your YouTube channel. We store an encrypted access token and, after the first upload, your channel's name and ID. We use them only to upload your own product Reels as YouTube Shorts (the video, the product name, your post's caption and a link to the product page), after you have previewed the post in the app. We do not read, change or delete your other videos, comments, subscribers or analytics, and we do not share this data with anyone. Disconnecting YouTube in the app, or uninstalling the app, deletes this data immediately. You can also remove AutoAgent's access at any time in your Google Account security settings (myaccount.google.com/permissions).

By connecting YouTube you agree to the YouTube Terms of Service, and Google's use of data is described in the Google Privacy Policy. AutoAgent's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

TikTok data

If you connect TikTok (a Pro feature), we ask TikTok for two permissions only: your basic profile (your TikTok ID, display name and avatar, shown on the Connections page so you can see which account is connected) and uploading videos to your TikTok inbox as drafts. We store your TikTok ID and an encrypted access token. We use them only to send your own product Reels to your TikTok inbox after they have posted on Facebook or Instagram. AutoAgent never posts to TikTok by itself: a draft is only published if you open it in TikTok and press Post. We do not read your videos, followers, messages or analytics, and we do not share this data with anyone. Disconnecting TikTok in the app revokes the access at TikTok and deletes this data immediately; uninstalling the app deletes it too. By connecting TikTok you agree to TikTok's Terms of Service.

How we protect your data

We treat access tokens for your Shopify store, Facebook, Instagram, Pinterest, YouTube and TikTok, and your store and contact details, as sensitive data, and protect them as follows:

• Encryption in transit: all traffic between your browser, AutoAgent, Shopify and the platforms you connect uses HTTPS (TLS).
• Encryption at rest: access tokens for Facebook, Instagram, Pinterest, YouTube and TikTok are encrypted with AES-256-GCM before they are stored, and are never written to logs. Our database (Neon) and video storage (Cloudflare R2) also encrypt all stored data at rest.
• Least access: we request only the permissions AutoAgent needs (for YouTube, upload only; for TikTok, drafts to your inbox only). Only the Web-Pex team members who run AutoAgent can access production systems, and application secrets are kept in our hosting provider's encrypted environment settings, never in our code.
• Verified requests: messages from Shopify are checked with Shopify's signature before we act on them, and every platform connection uses a signed, short-lived link that only works for your own store.
• Deletion: disconnecting a platform deletes its token at once (and for YouTube and TikTok also revokes it there); uninstalling deletes tokens and settings at once and everything else within 48 hours, as described above.
• Incidents: if we learn that your data has been accessed without permission, we will tell you without undue delay and take steps to stop it.

Sharing

We do not sell or share your data with third parties, other than the AI providers above (catalog data only), our hosting and storage providers (Vercel, Neon and Cloudflare, which only store data on our behalf), our email provider (Resend, for the emails described above), Telegram (only if you connect it), Shopify (for billing), and the platforms you explicitly connect.