Legal

Privacy Policy

Effective date: June 3, 2026

This document is provided for transparency and user safety. It is not a substitute for independent legal advice.

Cowl Pilot provides a Telegram-based assistant for Meta Ads monitoring, alerts, AI-generated briefs, report history, and QRIS top-ups. This Privacy Policy explains what information we collect, how we use it, and the choices available to users in Indonesia and other countries.

By using the Cowl Pilot Telegram bot, joining the early-access waitlist, connecting a Meta Ads account, or making a top-up, you acknowledge that we will process information as described in this Privacy Policy.

1. Operator and contact

The service is operated as Cowl Pilot. Cowl Pilot, Indonesia. A full legal mailing address may be provided for verified legal or regulatory requests.

For privacy, access, correction, deletion, withdrawal, or other personal data requests, contact privacy@cowlpilot.com. For general product support, contact support@cowlpilot.com.

2. Information we collect

Landing page and waitlist data: name, email, business information, advertising needs, messages submitted through forms, and related consent or attribution information.
Telegram data: Telegram user ID, username, display name, chat ID, bot commands, messages, callback actions, and delivery metadata needed to operate the bot.
Meta Ads data: OAuth connection data, ad account IDs and names, encrypted access token references, account status, currency, timezone, and advertising performance metrics such as spend, CTR, CPC, CPA, ROAS, actions, and action values.
Monitoring and report data: monitor configuration, scope, schedule, alerts, report history, notification events, job status, errors, AI prompts, AI outputs, and related payloads.
Payment data: payment references, QRIS checkout links, top-up amounts, payment status, paid time, ledger entries, and provider webhook payloads.
Technical, analytics, and security data: server logs, request metadata, diagnostics, error traces, abuse-prevention signals, browser/device data, cookies or pixels where enabled, and configuration metadata needed to keep the service reliable and secure.

3. How we use information

Respond to waitlist, sales, support, and product inquiries.
Create and maintain your Cowl Pilot account from your Telegram profile.
Operate Telegram bot features, menus, notifications, support flows, and report delivery.
Connect to Meta Ads with your authorization and read advertising data for monitoring, alerts, reports, and AI-generated recommendations.
Process QRIS top-ups, balances, service usage charges, refunds or disputes, and accounting records.
Improve service reliability, measure marketing performance, detect abuse or fraud, secure tokens and integrations, debug issues, and comply with applicable legal obligations.

4. Legal basis and consent

We process information based on your consent or acknowledgement through website forms, Telegram onboarding, and continued use; to provide the requested service; to protect legitimate operational and security interests; and to meet legal, tax, accounting, and dispute-resolution obligations. For users in Indonesia, we aim to follow applicable Indonesian personal data protection principles, including purpose limitation, transparency, retention limits, and respect for user rights where applicable.

5. Sharing and processors

We do not sell personal information. We may share or process information with third-party services that are necessary to operate Cowl Pilot or that you choose to connect.

Telegram, to receive commands and deliver messages, alerts, and reports.
Meta/Facebook Graph API, to authenticate authorized Meta Ads access and read advertising account and performance data.
Meta Pixel and/or Meta Conversions API, to measure landing page activity, waitlist submissions, and paid QRIS top-up events. Events may include browser/device data, event IDs, and hashed identifiers where applicable.
Payment providers such as MAYAR, to create QRIS checkout sessions, receive payment status webhooks, and reconcile top-ups.
OpenAI or another configured OpenAI-compatible LLM provider, to process advertising facts and metrics for AI-generated briefs and recommendations when enabled.
Hosting, database, logging, security, email, automation, spreadsheet, and support providers that help operate, secure, measure, and support the service.

6. Meta Ads tokens and permissions

Cowl Pilot is designed for read-only Meta Ads monitoring unless a future feature separately asks for and receives explicit approval for write actions. Meta access tokens are encrypted before storage. You should never share tokens in public groups or with unauthorized parties. You may revoke Cowl Pilot's Meta permissions through your Meta/Facebook account or business settings.

7. AI processing and recommendations

When AI features are enabled, advertising metrics, facts, and report context may be sent to an AI provider to generate briefs and recommendations. AI output is informational only, may be incomplete or inaccurate, and is not legal, financial, tax, or professional marketing advice. You remain responsible for campaign decisions and ad spend.

8. International transfers

Cowl Pilot users and vendors may be located in different countries. Information may be processed outside Indonesia or your country of residence by providers such as Telegram, Meta, payment processors, AI providers, hosting services, and analytics providers. We use vendors and operational practices intended to support lawful processing, but cross-border safeguards may depend on each vendor's terms, infrastructure, and applicable law.

9. Retention

Lead and waitlist data is retained while we evaluate, contact, onboard, or support potential users, unless deletion is requested and no retention obligation applies.
Account and Telegram profile data is retained while your account is active or as needed to provide the service.
Reports are designed to expire after a limited period, currently 7 days where implemented.
OAuth states and setup sessions are temporary and expire after a short period.
Payment, ledger, security, tax, accounting, dispute, and abuse-prevention records may be retained longer where required or reasonably necessary.
When you request deletion, we will delete or anonymize eligible data unless retention is required for legal, accounting, fraud-prevention, dispute, or security reasons.

10. Cookies, pixels, and web tracking

The landing page may use Meta Pixel, Meta Conversions API, form analytics, or similar measurement tools where configured. These tools help us understand visits, conversions, and marketing performance. If we add additional browser cookies or analytics tools that require separate notice or choices, we will update this policy and provide any legally required controls.

11. Your choices and rights

Request access to, correction of, or deletion of your personal data by contacting privacy@cowlpilot.com.
Withdraw from service use by stopping the Telegram bot and requesting account deletion.
Revoke Meta permissions through Meta/Facebook settings.
Object to or request restriction of certain processing where applicable law gives you that right.
Contact us with privacy complaints or questions. You may also have the right to contact a relevant data protection or consumer protection authority depending on your location.

12. Children

Cowl Pilot is not intended for children or for users below the legal age required to manage advertising accounts, authorize payments, or enter into service terms in their jurisdiction.

13. Security

We use technical and organizational measures intended to protect information, including encryption for Meta token storage, access controls, and operational monitoring. No system can be guaranteed completely secure, and users should also protect their Telegram account, Meta account, and payment credentials.

14. Changes to this policy

We may update this Privacy Policy as the service, vendors, or applicable laws change. The effective date will show when the latest version applies. Continued use of Cowl Pilot after an update means you acknowledge the updated policy.