Privacy Policy, Eagle AI Agency
Last updated: 14 October 2026
Eagle AI Agency provides marketing automation and social media publishing services to business clients. This policy explains what information we collect, how we use it, and the choices you have. Questions: matt@eagleagency.ai
Who this policy covers
Visitors to https://www.eagleagency.ai; users of the Eagle Content Hub at https://content.eagleagency.ai; and clients and prospective clients who work with us directly.
Information we collect
Account information. Your name, email address and the client company you are associated with. Accounts are created by us, not by public signup.
Social media account connections. The platform name, the account username or page name, a profile image URL, and an identifier supplied by our publishing provider.
We do not store your social media passwords, access tokens or refresh tokens. Authorization is handled by our publishing provider, Post For Me, and those credentials remain with them. We hold only a reference identifier that lets us publish on your behalf.
Content you create. Post captions, scheduled dates, approval decisions, notes, and any images or video you upload. Uploaded media is stored in a private, per-client storage bucket and served only through short-lived signed links.
Usage and technical data. Standard server and application logs, including IP address, browser type and timestamps, used to operate and secure the service.
How we use information
To operate the service (drafting, scheduling, approving and publishing posts to the accounts you connect); to authenticate you and keep accounts separated; to communicate with you about your account and support requests; to diagnose faults, prevent abuse and keep the service secure; and to meet legal and accounting obligations.
We do not sell your personal information, and we do not share it for advertising purposes.
How client data is separated
Each client company is a separate tenant. Access rules are enforced at the database level, not only in the interface. A client account can see only its own company's posts, media and connected social accounts. Eagle AI Agency staff accounts can access client workspaces in order to perform the services you have engaged us for.
Google account connection (Gmail)
For the LLM Project, the app reads replies to the follow-up emails it sent so it can stop emailing people who ask to be removed, and never changes or deletes mail.
If you connect a Google account on the PR Outreach or Podcast Outreach pages, we ask Google for one permission: to send email on your behalf (the Gmail scope https://www.googleapis.com/auth/gmail.send), plus your email address so we can show which account is connected. We do not ask for, and cannot use, permission to read, search, change or delete your email.
What we store: the email address of the connected account and the refresh token Google issues, held in encrypted secret storage on our server and never exposed to the browser. For each pitch you approve we keep the recipient, subject, body and send time, which you can see in the Sent and Pipeline tabs. We do not read or store anything else from your mailbox.
How we use it: only to send the pitch emails you approve, or that you schedule by turning on automation for a campaign you control, from your own address. Each send is logged. You can turn automation off at any time.
How to disconnect: click Disconnect on the campaign page, or remove Eagle Content Hub from your Google Account at https://myaccount.google.com/permissions. Either one ends our ability to send. Disconnecting in the Hub deletes the stored token.
Limited Use: Eagle Content Hub's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, and no person at Eagle AI Agency reads it except with your explicit permission, for security purposes, or to comply with the law.
Microsoft account connection (Outlook)
If you connect a Microsoft account (Outlook, Outlook.com or Microsoft 365) on the PR Outreach or Podcast Outreach pages, we request only these permissions: Mail.Send, User.Read, openid, email and offline_access. Mail.Send lets us send the pitches you approve, and User.Read lets us read the address of the connected account. We never read your inbox or any other mail.
What we store: the email address of the connected account and the refresh token Microsoft issues, held encrypted in secret storage on our server and never exposed to the browser. We use it only to send the pitch emails you approve, or that you schedule by turning on automation for a campaign you control, from your own address.
How to disconnect: click Disconnect on the campaign page in the Hub, or remove the app from your Microsoft account. For work or school accounts go tohttps://myapps.microsoft.com, and for personal accounts go tohttps://account.live.com/consent/Manage. Disconnecting in the Hub deletes the stored token.
Service providers
| Provider | Purpose | What it handles |
|---|---|---|
| Supabase | Application database, authentication and file storage | Account details, posts, uploaded media |
| Post For Me | Social media authorization and publishing | Social account authorization, post delivery |
| Lovable | Application hosting | Application traffic and logs |
| GoHighLevel | Website, CRM and client communication | Contact details, messages |
| Google Workspace | Email and documents | Business correspondence |
| Google (Gmail API) | Sending pitch emails from the Google account you connect | Connected email address, send permission token |
| Microsoft Graph | Sending pitch emails from the Microsoft account you connect | Connected email address, send permission token |
Social media platforms you connect (LinkedIn, X, Facebook, Instagram, YouTube, TikTok, Pinterest, Threads, Bluesky) receive the content you approve for publication and handle it under their own privacy policies and terms.
Data retention
We keep account and content data for as long as your engagement with us is active, and afterwards only as long as needed for legal, tax or dispute-resolution purposes. You can ask us to delete your data at any time and we will do so unless we are required to keep it. Disconnecting a social account removes our ability to publish to it. You can also revoke Eagle AI Agency's access directly from the social platform's own settings at any time. Disconnecting a Google account deletes the stored send token.
Your choices and rights
Depending on where you live, you may have the right to request a copy of the personal information we hold about you; ask us to correct information that is wrong or incomplete; ask us to delete your information; object to or restrict certain processing; or withdraw consent where our processing relies on consent. To exercise any of these, email matt@eagleagency.ai. We will respond within 30 days.
Security
Access to client data requires authentication, and permissions are enforced by database-level access rules. Uploaded media sits in private storage and is never publicly readable. Credentials for third-party services are held in secret storage and are not exposed to the browser. No system is perfectly secure, and we do not claim otherwise, but we treat client data as confidential and limit access to those who need it.
Children
The service is intended for business use. It is not directed at anyone under 18, and we do not knowingly collect information from children.
Changes to this policy
If we make a material change, we will update the date at the top of this page and, where the change is significant, tell affected clients directly.
Contact
Eagle AI Agency, matt@eagleagency.ai, https://www.eagleagency.ai