EarnPilot Privacy Policy

Last updated: 2026-08-16

This Privacy Policy explains how personal data is collected, used, shared and protected when you use EarnPilot (the “Service”), available at earnpilot.app. EarnPilot is an AI-avatar short-video (user-generated content, “UGC”) platform that builds an AI avatar for you - either a digital clone created from a short recording you provide, or a purely synthetic digital avatar - generates trend-based UGC videos, and can automatically post them to your connected TikTok account and, optionally, to other social networks. Through EarnPilot you promote affiliate products using our affiliate links and unique coupon codes and earn a share of the resulting commission; there is no follower minimum. AI-generated content is labeled as AI-generated, and affiliate content is marked as advertising (e.g. #ad).

Please read this Policy carefully. If you do not agree with it, do not use the Service.

1. Controller and Contact

The controller responsible for the processing of your personal data is:

ADVANCED CREATIVE AI TECHNOLOGY - FZCO (“ACAI”, “we”, “us”, “our”)
Registration No.: License No. 6255
Registered address: IFZA Business Park, DDP, PO Box 342001, Dubai, United Arab Emirates
Country: United Arab Emirates

Privacy / Data Protection contact: support@earnpilot.app.

Where we act as a controller under the EU/UK General Data Protection Regulation (GDPR), and where required, our Data Protection Officer or privacy representative can be reached at the address above. We have not appointed an EU/UK representative under Art. 27 GDPR at this time. Where such an appointment becomes legally required, we will designate a representative and state their name and address here. Until then, EU/UK users can reach us for all data-protection matters at support@earnpilot.app.

For certain processing (for example when we act on behalf of affiliate networks or payment providers, or where you use connected third-party platforms), other parties may be independent controllers or joint controllers. See Sections 5 and 6.

2. Categories of Personal Data We Process

We process the following categories of personal data:

a) Account and registration data. Name, e-mail address, password (stored in hashed form), username/handle, account settings, preferences, language, and communications with us (e.g. support requests).

b) Social account connection data. OAuth access and refresh tokens, account identifiers, handles/usernames, and permission scopes for TikTok and, optionally, other social networks (e.g. Meta/Instagram) that you connect. We use these to publish content and read basic account and performance data on your behalf.

c) Likeness and clone data (sensitive - see below). If you choose to create a digital clone, we process the short video recording of you, your image, voice and facial/body appearance, and derived models or representations used to generate your AI avatar. This data can uniquely identify you and is closely related to biometric data.

Important - sensitive/special-category data and explicit consent. Depending on how it is processed, your likeness/clone data may qualify as biometric or other special-category data under Art. 9 GDPR and comparable laws. We process it only on the basis of your explicit, separate consent, which you provide before the clone is created. You can revoke this consent at any time through your account settings or by contacting support@earnpilot.app; on revocation we will stop using your likeness to generate new content and will delete or irreversibly anonymize the clone model and source recording, subject to Section 7 (Retention). If you create a purely synthetic digital avatar (not based on your own recording), no likeness/biometric data of you is processed for that avatar.

d) Generated content. The AI-generated videos, scripts, captions, thumbnails and related metadata produced for you, including AI-generation and advertising labels applied to that content.

e) Affiliate, sale and attribution data. Affiliate links and unique coupon codes assigned to you, clicks, conversions, sales, commission amounts, attribution and performance metrics received from affiliate networks and merchants.

f) Payment and payout data. Data required to pay out your commissions and, where applicable, to charge for the Service. Payments and payouts are processed via Stripe (including Stripe Connect). Depending on your role and country, this may include bank/payout account details, tax identifiers, identity-verification data required by Stripe for anti-money-laundering and “know your customer” (KYC) obligations, and transaction history. Full card/bank credentials are handled by Stripe; we typically receive only limited transaction and status data.

g) Device, usage and analytics data. IP address, device and browser type, operating system, identifiers, log data, pages/screens viewed, interactions, referral data, approximate location derived from IP, and diagnostic/crash data.

h) Cookies and similar technologies. See Section 9.

We do not intentionally collect special-category data other than the likeness/clone data described above. Please do not submit unnecessary sensitive information through the Service.

3. Purposes of Processing

We process personal data for the following purposes:

To create and manage your account and authenticate you.
To build your AI avatar or digital clone and to generate UGC videos for you.
To publish and schedule content to your connected TikTok and other social accounts on your instruction.
To operate the affiliate program: assign affiliate links/coupon codes, track clicks, conversions and sales, calculate commissions, and detect fraud.
To process payments and pay out commissions via Stripe, and to meet related KYC/anti-fraud and tax obligations.
To label AI-generated and advertising content and to comply with platform, advertising and consumer-protection rules.
To provide customer support and communicate with you about the Service.
To measure, analyze and improve the Service, including performance and content analytics.
To ensure security, prevent abuse and fraud, and enforce our terms.
To comply with legal obligations and to establish, exercise or defend legal claims.
With your consent, to send marketing communications and to use non-essential cookies/tracking.

Where the GDPR applies, we rely on the following legal bases:

Performance of a contract (Art. 6(1)(b)) - to provide the Service, create avatars, generate and publish content on your instruction, operate the affiliate program, and process payouts.
Consent (Art. 6(1)(a) and, for special-category data, Art. 9(2)(a)) - for creating a digital clone from your likeness (explicit consent), for connecting third-party social accounts where required, for non-essential cookies/tracking, and for marketing. You may withdraw consent at any time with future effect; withdrawal does not affect processing already carried out.
Legitimate interests (Art. 6(1)(f)) - for security, fraud prevention, product improvement and analytics, and internal administration, balanced against your rights and interests. You may object as described in Section 8.
Legal obligation (Art. 6(1)(c)) - for tax, accounting, KYC/anti-money-laundering and other statutory obligations.
Establishment, exercise or defense of legal claims / substantial public interest (Art. 9(2)(f)/(g)) - where relevant for special-category data in the context of legal claims.

Because your likeness/clone data may constitute biometric or special-category data, we treat explicit consent as the primary basis for that specific processing, obtained separately before the clone is created and revocable at any time (Section 2(c)).

5. Recipients and Sub-processors

We share personal data with the following categories of recipients, only as necessary for the purposes above and under appropriate safeguards (including data-processing agreements where they act as our processors):

Affiliate networks and merchants - e.g. Awin, Impact, Admitad, AliExpress, eBay, and other networks/merchants - to operate affiliate links/coupons and attribute sales and commissions. Some of these act as independent controllers for their own tracking.
Payment and payout provider - Stripe, including Stripe Connect, for payments, payouts, identity verification and fraud prevention. Stripe processes certain data as an independent controller under its own privacy policy.
Social platforms - TikTok, Meta/Instagram and other networks you connect, to publish content and retrieve account/performance data via their APIs. These platforms are independent controllers for data processed under their own terms and policies.
AI and content-generation providers - cloud-based model, avatar/voice-generation and media-processing providers used to build your avatar and generate videos.
Hosting and cloud infrastructure - providers that host the Service, store data and process media.
Analytics and product-measurement providers - to understand and improve usage.
Professional advisers, auditors and authorities - where required by law or to protect our rights.
Corporate transactions - a successor entity in the event of a merger, acquisition, financing or sale of assets, subject to this Policy.

A current list of key sub-processors can be requested at support@earnpilot.app. We do not sell your personal data for money. Certain analytics/advertising cookie activity may be treated as a “sale” or “sharing” under some U.S. laws; see Sections 8 and 9.

6. International Transfers

We are established in the United Arab Emirates, and our recipients and sub-processors may be located in the UAE, the EU/EEA, the United States and other countries. This means your personal data may be transferred to and processed in countries outside your own, whose data-protection laws may differ.

Where we transfer personal data out of the EU/EEA or UK to a country without an adequacy decision, we implement appropriate safeguards, such as the European Commission’s Standard Contractual Clauses (SCCs) (and the UK International Data Transfer Addendum where applicable), together with supplementary measures as needed. The UAE has not received an EU adequacy decision, so these SCCs (and, for the UK, the IDTA/Addendum) are our primary transfer mechanism for such data. For transfers of personal data governed by UAE law, we rely on the mechanisms permitted under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, “PDPL”): transfers to jurisdictions recognized as providing an adequate level of protection or, absent that, appropriate contractual safeguards, your explicit consent, or another legal basis permitted by the PDPL and its executive regulations.

You may request more information about these safeguards using the contact details in Section 1.

7. Retention

We retain personal data only for as long as necessary for the purposes described in this Policy, and then delete or irreversibly anonymize it, unless a longer retention period is required or permitted by law.

Criteria and periods:

Account data - for the life of your account and for a limited period afterward: up to 24 months after account closure (to handle reactivation, disputes and legal claims).
Likeness / clone data (source recording and clone model) - kept only while needed to provide the avatar service and no longer than necessary; deleted or irreversibly anonymized within 30 days after you delete the clone or withdraw consent, with residual encrypted backups purged within a further 90 days.
Generated content - while associated with your account and as needed for the affiliate/advertising record: retained while linked to your account and up to 24 months afterward, unless you delete it earlier.
Affiliate, sale and payout records - as required for commission settlement, tax and accounting obligations: at least 5 years, and up to 7 years for corporate-tax records, from the end of the relevant financial year (UAE tax and accounting law).
Payment/KYC data held by us - as required by financial and anti-money-laundering law: at least 5 years after the transaction or the end of our business relationship.
Logs, analytics and security data - for a limited period: typically, up to 12 months, and up to 24 months for security and fraud-prevention logs.

Where data is retained solely to meet legal obligations or to defend legal claims, we restrict further processing accordingly.

8. Your Rights

Subject to the applicable law, you have the right to:

Access your personal data and obtain a copy;
Rectify inaccurate or incomplete data;
Erasure (“right to be forgotten”), including deletion of your clone/likeness data;
Restrict processing;
Data portability - receive certain data in a structured, commonly used, machine-readable format;
Object to processing based on legitimate interests, and to direct marketing at any time;
Withdraw consent at any time (including consent for your likeness/clone), with future effect;
Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, except as permitted by law (see Section 10);
Lodge a complaint with a supervisory authority (Section 14).

8.2 Rights under the CCPA/CPRA (California) and similar U.S. laws

If you are a California resident (or resident of a U.S. state with comparable law), you may have the right to:

Know/access the categories and specific pieces of personal information we collect, use, disclose and (if applicable) “sell” or “share”;
Delete personal information, subject to exceptions;
Correct inaccurate personal information;
Opt out of the “sale” or “sharing” of personal information and of targeted advertising;
Limit the use of sensitive personal information;
Non-discrimination for exercising your rights.

We do not sell personal information for money. Where required, we honor opt-out preference signals (e.g. Global Privacy Control) and provide an opt-out mechanism. You may use an authorized agent where the law allows.

8.3 How to exercise your rights

Contact us at support@earnpilot.app. We will verify your identity and respond within the timeframes required by applicable law. These rights may be subject to legal exceptions and limitations.

9. Cookies and Tracking

We use cookies and similar technologies (e.g. local storage, SDKs, pixels) to operate the Service, remember preferences, secure the platform, measure usage, attribute affiliate conversions, and - with your consent - for analytics and marketing.

Strictly necessary technologies are used to run the Service and do not require consent.
Analytics, advertising and other non-essential technologies are used only with your consent, where required, which you can give or withdraw via our cookie banner/preference center.

Some affiliate networks and social platforms may set their own cookies or receive data when you interact with links or embedded content, acting as independent controllers. You can also control cookies through your browser settings. For details of the specific cookies and providers we use, and to change your choices at any time, use the cookie banner and preference center available in the Service; you can also request the current cookie list at support@earnpilot.app.

10. AI-Generated Content and Profiling

EarnPilot uses artificial intelligence to build avatars/clones and to generate videos, scripts and captions based on trends, your inputs and performance data. We may analyze content and account performance to recommend topics, formats and products (profiling for optimization and fraud prevention).

AI-generated content is labeled as AI-generated, and affiliate content is marked as advertising (e.g. #ad), consistent with platform and consumer-protection requirements.
We do not use your data to make decisions that produce legal or similarly significant effects about you solely by automated means, except where permitted by law and with appropriate safeguards; where such processing occurs, you may request human review and contest the decision.
AI outputs can contain inaccuracies. You are responsible for reviewing content you publish and for complying with the terms of the platforms on which it appears.

11. Children

EarnPilot is intended only for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us personal data, contact support@earnpilot.app and we will delete it. Creating a digital clone requires that the likeness be that of the adult account holder who has given explicit consent.

12. Security

We implement appropriate technical and organizational measures to protect personal data, including encryption in transit, access controls, authentication, network security, monitoring and least-privilege practices, and heightened protection for likeness/clone data. Payment and payout data is handled by Stripe under its security and PCI-DSS controls. No method of transmission or storage is completely secure; we cannot guarantee absolute security. If a personal-data breach occurs, we will notify affected users and authorities where required by law.

13. Changes to This Policy

We may update this Policy from time to time. We will post the updated version with a new “Last updated” date and, where changes are material, provide additional notice (e.g. by e-mail or in-app). Where required, material changes affecting consent-based processing will take effect only after we obtain any necessary renewed consent.

14. Contact and Complaints

For any privacy question or to exercise your rights, contact:

ADVANCED CREATIVE AI TECHNOLOGY - FZCO
IFZA Business Park, DDP, PO Box 342001, Dubai, United Arab Emirates
E-mail: support@earnpilot.app

If you are in the EU/EEA, you have the right to lodge a complaint with the data-protection supervisory authority of your country of residence, your place of work, or the place of the alleged infringement. If you are in the UK, you may contact the Information Commissioner’s Office (ICO) (ico.org.uk). If you are in the UAE, the competent authority is the UAE Data Office, the federal supervisory authority under the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). We would, however, appreciate the opportunity to address your concerns before you approach an authority.

The governing law and jurisdiction for this Policy are: the laws of the Dubai International Financial Centre (DIFC).