Last updated 2026-09-13. Effective immediately for the anonymous slice.
PromoPilot's anonymous slice lets you turn a business name, an offer, and a customer photo into three downloadable promotional graphics plus three short captions. The whole workflow is designed so that no personal data leaves your browser unless you choose to share the generated PNGs and captions yourself.
If you choose to buy the optional paid pack, the payment is processed by Stripe (Stripe Checkout). The Stripe-hosted form collects the minimum needed to take a card payment (name, email, billing address, card details). That data is held by Stripe under their privacy policy; PromoPilot never sees or stores your card number. PromoPilot stores only:
The paid pack's download token is HMAC-signed, scoped to one order, expires 24 hours after issue, and is single-use. Refunds are available within 7 days of purchase — see the terms page for the procedure.
The "Send me occasional PromoPilot product updates" checkbox is unchecked by default and is independent of any purchase. Ticking it records an explicit consent row storing the exact prose you agreed to, the version id, the source page, and the UTC timestamp. If a marketing email provider (Brevo) is configured, the consent is synced to the destination list; otherwise it is recorded locally and never sent. Unticking or never ticking has no effect on your free sample, paid pack, recovery, or refund. Every confirmation email contains a one-click unsubscribe link.
PromoPilot never performs a mailing-list import, never sends a campaign on your behalf, and never sends an abandoned-cart message without a separate explicit opt-in.
Captions are produced by a Workers AI model. The model is instructed to use only the fields you supplied, to keep each caption under 140 characters, and to avoid inventing prices, statistics, or testimonials. Replies are bounded and parsed safely server-side.
To protect the included AI allowance, the service enforces a per-minute request cap and a daily caption cap. If you hit a limit, try again after the indicated window.
Press Reset on the app page or close the tab. There is no server-side record of your photo, business name, or offer to delete. The aggregate counters contain no input data; the IP hash expires within two minutes of inactivity.
For a paid order, email the order id to the address listed on the merchant's profile and we will permanently delete the order row, the recovery tokens, the Stripe webhook event log entries, and the recovery email on file.
See the delete page for the full reset procedure and the terms page for the full refund and consent procedures.
This anonymous slice does not have a contact channel. Future revisions may add one; until then, no email is collected. For paid-pack questions (refunds, recovery, data deletion) see the terms page.