Privacy Policy

TheoryCraft, a French société par actions simplifiée unipersonnelle (SASU) registered under number 107 873 754, is the controller of personal data processed by PilotMyX.

Privacy requests may be sent to [email protected] or to TheoryCraft, 59 rue de Ponthieu, 75008 Paris, France.

X account data includes your account identifier, username, display name, biography, profile image, timezone, follower count, connection permissions, and connection status.

Synchronized X data includes posts, replies, quoted or referenced posts, timestamps, available metrics, media information, edit information, and synchronization status.

Publishing data includes drafts, threads, scheduled times, publication status, quoted posts, uploaded media, and alt text.

MCP access data includes the names and permissions you configure, expiration and revocation dates, and last-use information.

Billing data received from Stripe includes customer, subscription, invoice, and transaction references; subscription status; selected plan; trial and billing dates; cancellation state; and tax or invoice information needed to operate your subscription. Stripe processes payment methods, billing details, and tax identifiers; PilotMyX does not store full card details.

Technical data can include IP address, browser and device information, security and account activity, errors, and diagnostic data. The public site can also use browser storage and measurement technologies described in the Cookie Policy.

We process account, X, publishing, MCP, and subscription data to provide the service you request, authenticate you, synchronize your data, calculate analytics, carry out publication instructions, and administer billing.

We process security, diagnostic, and limited usage data for our legitimate interests in preventing abuse, protecting accounts, debugging failures, measuring reliability, and improving PilotMyX.

We process transaction and tax records to comply with accounting, tax, fraud-prevention, and other legal obligations. Where consent is required for a particular measurement technology, that processing relies on consent.

We disclose data only as needed to operate PilotMyX, follow your instructions, comply with law, or protect the service. Providers can include X Corp for account connection and requested X operations, Stripe for subscriptions and billing, Hetzner for hosting, Cloudflare for network delivery and security, and Google for tags or audience measurement configured on the public site.

An MCP client receives the data and actions permitted by the token you create. The provider of that client processes data under its own terms and privacy practices. You should give each client only the permissions it needs.

We may disclose information to professional advisers, authorities, or other parties when reasonably necessary to establish or defend legal claims, meet a legal obligation, investigate abuse, or protect rights and safety. We may also transfer data as part of a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate safeguards.

Some providers may process personal data outside France or the European Economic Area. Where required, those transfers rely on an applicable adequacy decision, standard contractual clauses, or another lawful transfer mechanism.

Account, synchronized X data, analytics, drafts, publication records, and MCP configuration are generally retained while your account remains active. They are deleted or anonymized after account deletion except where a longer period is needed for security, dispute resolution, or a legal obligation.

Uploaded image files are retained while needed by a draft or pending publication and are removed after successful publication or explicit deletion. Limited publication information may remain where needed to preserve its status or meet legal obligations.

Account, security, and synchronization history is kept only for as long as reasonably needed to operate and protect the service, diagnose incidents, and resolve disputes.

Billing, invoice, and transaction records may be retained for up to 10 years where required for French accounting or tax obligations. Security and application logs are kept only for the period reasonably needed to diagnose incidents, protect the service, and meet legal obligations.

PilotMyX uses appropriate technical and organizational measures, including encryption and access controls, to protect personal data. No online service can guarantee absolute security. Revoke affected credentials and contact us promptly if you suspect unauthorized access.

Depending on applicable law, you may request access, correction, deletion, restriction, portability, or object to processing. Where processing relies on consent, you may withdraw that consent without affecting earlier processing.

You can disconnect X access, revoke MCP tokens, delete drafts and media, manage your subscription through Stripe, or request account deletion. Some records may be retained when required by law or necessary to establish or defend legal claims.

You may lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL) or another competent data-protection authority. We may verify your identity before completing a request.

PilotMyX does not sell personal data and does not share connected X data for cross-context behavioral advertising. People in jurisdictions that provide additional privacy rights may exercise them through the contact address above.

We may update this Privacy Policy as PilotMyX, its providers, or legal requirements change. The date at the top identifies the current version. Material changes will be communicated through an appropriate channel.

Questions or privacy requests may be sent to [email protected] .