Legal
Privacy Policy
Last updated: August 2026
1. Who We Are
StockPilot AI is operated by a sole proprietor based in the Arab Republic of Egypt. Our website is metacloudai.com, and you can reach us at support@metacloudai.com. We are the data controller for the information described in this policy.
2. What StockPilot AI Does
StockPilot AI is a subscription tool that turns uploaded images into marketplace-ready metadata for stock platforms. It is a Chrome extension with a free tier and optional paid plans. This policy describes what information we collect and how we handle it.
3. Information We Collect
What we do NOT collect. Your images are the core of the product, and we deliberately do not store them. They are processed in memory in your browser and sent directly to our AI provider for analysis. They are never received or stored on our servers, and they are not used to train AI models. We also do not collect:
- Generated metadata: it belongs to you entirely.
- API keys: stored locally in your browser via Chrome's storage API.
- Payment card details: processed by Paddle, never seen or stored by us.
- Personal browsing history, bookmarks, or other unrelated data.
Account data. Your email address and license state when you create an account or purchase a paid plan.
Contact form submissions. Your name, email address, and message if you contact us through our website. Retained for 12 months.
Usage data. Anonymized feature usage metrics, such as the number of metadata generations per session. Telemetry is opt-in and off by default; you can disable it at any time in the extension settings.
4. How We Use Information
We use the information we collect to:
- Provide and maintain the Service, including generating metadata.
- Process billing and send receipts and account notifications.
- Prevent fraud and abuse and keep the Service fair.
- Comply with legal obligations.
We do not use your images to train AI models, and we do not store them after the request completes. Our AI provider operates a zero-data-retention policy.
5. Cookies
The website uses a small number of cookies for authentication and security. We do not use advertising cookies or third-party tracking cookies, and the website does not run analytics scripts.
| Cookie | Purpose | Duration | How to opt out |
|---|---|---|---|
| Supabase session cookie (HttpOnly) | Keeps you signed in on the site | Until sign-out or expiry | Sign out or clear browser data |
| OAuth nonce cookie | Binds the Google sign-in state to this browser, single use | A few minutes, cleared after login | Cleared automatically |
6. Third-Party Processors
We use the following providers to operate the Service:
| Provider | Purpose | Privacy policy |
|---|---|---|
| OpenRouter | AI generation | openrouter.ai/privacy |
| Paddle | Payments | paddle.com/legal/privacy |
| Resend | Transactional email | resend.com/privacy |
| Supabase | Authentication | supabase.com/privacy |
| Vercel | Website hosting | vercel.com/privacy |
7. Data Retention
Your images are discarded after the request completes. Contact form submissions are retained for 12 months. Usage metrics are anonymized. Account data is retained until you request deletion. Server logs are retained for approximately 30 days for security and debugging.
8. Your Rights
GDPR (EU/EEA and UK). You have the right to access, rectify, erase, restrict, and port your personal data, and to object to its processing. We process data on the basis of contract (to provide the Service), consent (where required), and legitimate interest (for security and fraud prevention). You may lodge a complaint with your local supervisory authority. We respond to requests within 30 days.
CCPA (California). You have the right to know, delete, and correct your personal information. StockPilot AI does not sell personal information.
To exercise any of these rights, email support@metacloudai.com.
9. International Transfers
Our providers are located in the United States, the EU, and the UK. Data may transit other regions as part of standard internet routing. Where personal data is transferred internationally, we rely on Standard Contractual Clauses and applicable adequacy decisions.
10. Children
The Service is not directed to children under 13, or under 16 in the EU/EEA, and we do not knowingly collect information from them. If you believe a child has submitted data to us, contact us and we will delete it.
11. Security
Traffic is encrypted in transit using TLS. Data at rest is encrypted by our providers. We never store your images, never see your payment card details, and use HttpOnly cookies for sessions. If a data breach affects your personal data, we will notify you as required by law.
12. Changes
We will post material changes to this policy with a new “Last updated” date and, where practicable, notify you by email. Please review this policy periodically.
13. Contact
Questions about this policy or your data? Email support@metacloudai.com. We respond within 30 days.
14. EEA/UK Supplement
If you are in the EU/EEA or the UK, in addition to the rights above you have the right to data portability (Article 20 GDPR), the right to restrict processing (Article 18), and the right to object to processing based on legitimate interest (Article 21). You may withdraw consent at any time where processing is based on consent. We rely on Standard Contractual Clauses for international transfers. As a sole proprietor, we rely on the operator contact above as the point of contact for all data-protection requests; we do not maintain a separate data-protection officer or EU representative at this time.