SchedPilot

GDPR overview

The word GDPR appears nowhere on the site: zero occurrences across twenty stored files, text and HTML alike. There is no Article 27 representative, no named data protection officer, no DPA published or offered, no sub-processor list, no stated legal basis for processing and no mention of international transfers or standard contractual clauses. What the privacy policy does offer in practice comes close to the underlying rights: you can request an exported file of the personal data held about you, and request its erasure, by writing to support@schedpilot.com. Account deletion, by contrast, happens only by email to admin@schedpilot.com, with no self-service route. The Chrome Web Store listing for the publisher's own extension places the operation in Romania, which would put it squarely inside the GDPR's scope — yet the site never says so.

Who owns the data?

The privacy policy, effective 6 March 2026, states that users can see, edit or delete their personal information at any time, the username excepted, and that website administrators can also see and edit that information. Personal data can be exported on request, and erased on request except for records kept for administrative, legal or security reasons. On the content you publish, the terms say nothing at all: they claim SchedPilot's own text, graphics, logos and software as the company's intellectual property, but never assign, licence or restrict the posts, images and videos you push through the platform. Raw YouTube video files are not stored — the app calls the API in real time.

Reuse rights

Google and YouTube data is accessed through OAuth 2.0 with explicit consent — email, first and last name, profile picture, video list and channel metadata — and is used only to authenticate the account, display videos in the interface and schedule or manage YouTube content. The publisher commits to no advertising use, no third-party analytics and no user profiling on that data, and states that it does not share, sell, transfer or disclose it to third parties beyond what YouTube needs to carry out the action you requested. Data reaches the social platforms only when you authorise a connection or schedule a post. Elsewhere, site comments collect your IP address and user agent for spam detection, a hashed email may go to Gravatar (Automattic), your IP is included in password-reset emails, and GPS EXIF metadata in uploaded media may be processed and can then be exploited by the destination platforms. Nothing on the site addresses model training on customer data, in either direction. Since the terms never claim ownership of what you publish, nothing described there stops you from reusing your own captions, images and videos wherever you like, and no permission mechanism is set out.

Data retention & training

Hosting summary

The site declares no hosting country and no hosting region, and claims no certification — neither SOC 2, ISO 27001 nor HIPAA. What it does describe are technical measures: HTTPS on all transfers, OAuth 2.0 for platform connections, access tokens encrypted with AES-256, role-based access controls limiting internal access to sensitive data, and regular security audits and infrastructure reviews. The platforms' OAuth tokens are held server-side and encrypted, and the publisher states that agents never see platform credentials. Webhook payloads are signed, and IP allow-listing is offered as an option on paid plans. One element does not come from the publisher: the domain's IP address, 92.113.16.213, resolves to Frankfurt, Germany, on the network of Hostinger International Limited. That is a network observation rather than a declaration, and it tells you where the site answers from, not necessarily where customer data, tokens and media are stored. Anyone who needs a documented jurisdiction for their data will have to ask, because nothing on the site answers the question.