A1 Lane
Start free trial
Menu

Privacy Policy

Status: This policy is final as of its effective date, This policy also covers access through AI assistants (MCP), as the directory submissions require.

Effective date: October 29, 2026 Controller: A1Lane LLC, 19824 47th Ave NE, Lake Forest Park, WA 98155-1726, United States. Contact: [email protected]. No data protection officer or EU/UK representative is appointed at this time; an EU representative and a UK representative will each be appointed before the first workspace connects from that jurisdiction.

1. What A1 Lane is

A1 Lane is a hosted publishing service: users sign up, connect social media accounts they own or manage, upload content and schedule it; A1 Lane publishes it through each platform's official API and verifies the result by reading it back.

2. Data we process

Account data you give us: email address, name (optional), password (stored only as an argon2id hash), workspace names, member invitations (email, role).

Platform credentials obtained when you connect an account: access and refresh tokens or OAuth 1.0a tokens for YouTube, TikTok, Instagram, Facebook Pages, X and LinkedIn, plus the account identity needed to post (platform user or Page id, handle, display name). Credentials are encrypted at rest (AES-256-GCM) with a key held outside the data directory.

Content and delivery data: the media files and captions you upload; per-destination options and disclosure settings; delivery receipts (stage checkpoints, platform post ids and URLs, sanitised status codes, timestamps); the per-workspace event log. Platform error text is never stored; only numeric codes are.

Billing data: your Stripe customer id, subscription id, price id, plan, status and period dates. Card details are entered on Stripe's hosted pages and never reach A1 Lane.

Operational data: sign-in attempts and throttling counters (email + client address), operator events (sign-ups, resets, billing transitions), and — for the assistant integration — per-tool call counts, error codes and latencies.

Assistant (MCP) access: when you authorise an AI assistant, it receives a workspace-scoped token with the scopes you approve. The assistant can then do what that token allows (read posts and receipts, create drafts, schedule if you granted publish). Each tool call is logged with its name, outcome and latency. We do not receive your conversation; we receive only the tool calls the assistant makes.

  • To provide the service you signed up for (contract): accounts, publishing, receipts, notifications you configure.
  • To bill you (contract) via Stripe.
  • To keep the service secure (legitimate interest): throttles, audit logs, signed webhooks.
  • To send service emails (contract) — password resets, invitations, delivery alerts you opt into. No marketing email without consent. Marketing email is sent only to users who have opted in, and is never a condition of receiving service email.

4. Who receives data

  • The platforms you publish to receive your content and the identity of the connected account; nothing else.
  • Stripe receives your email and payment details for billing. Stripe's privacy policy (https://stripe.com/privacy) and data processing addendum (https://stripe.com/legal/dpa) govern the payment data Stripe processes.
  • Resend sends service emails on A1 Lane's behalf (password resets, invitations, delivery alerts). Resend's data processing addendum (https://resend.com/legal/dpa) governs the data Resend processes.
  • Your own link shortener (Bitly or Dub) receives the links you publish, if you configure one with your own key.
  • AI assistant providers receive only what their tool calls return, under the token you authorised.
  • Hosting: Amazon Web Services (Lightsail), US West (Oregon). Sub-processors: AWS (hosting), Stripe (billing) and Resend (email); Cloudflare provides DNS, edge and TLS as infrastructure.

No advertising, analytics or tracking services receive data. The public status page shows aggregate counts only.

5. Retention and deletion

  • Credentials are deleted when you disconnect an account or delete the workspace.
  • Workspace data (posts, receipts, media, events) is kept while the workspace exists. On cancellation or trial expiry it is retained for 30 days and then eligible for deletion. Deletion after the retention period is operator-confirmed — it is not automatic — and is completed within 30 days after the retention period ends.
  • Deleting your account deletes every workspace you own immediately. Members of other users' workspaces remain in those workspaces' member lists until removed by that owner.
  • Media you delete from the library is archived while any post still references it and purged when the last referencing post is deleted.
  • Operator and security audit logs are kept for 12 months; billing records are kept for 7 years for tax and accounting.
  • If you delete your account, we keep a one-way hashed record of the email address used to claim a free trial. The readable address is never stored in this record; it is kept indefinitely and used only to enforce our one-trial-per-billing-account rule.

6. Your rights

You can export your account (every workspace you belong to: accounts without credentials, media metadata, posts with receipts, batches, billing summary) and delete your account from Account settings at any time. For access, correction, objection or portability requests, or to lodge a complaint, email [email protected]. Where the GDPR or UK GDPR applies to you, you have the rights of access, rectification, erasure, restriction, portability and objection described there; where the CCPA/CPRA applies to you, you have the rights to know, delete and correct described there. We honour these rights for every user, whether or not the law in question applies to us. You may also lodge a complaint with your local data-protection supervisory authority.

7. Security

See the security page at https://a1lane.ai/security for the implemented measures (encryption at rest, hashed tokens, workspace isolation, signed webhooks, sanitised errors).

8. Platform terms

Use of the YouTube API Services is subject to the YouTube Terms of Service (https://www.youtube.com/t/terms) and Google's Privacy Policy (https://policies.google.com/privacy). Meta platforms: Meta's Platform Terms. TikTok: TikTok Developer Terms. X: X Developer Agreement. LinkedIn: LinkedIn API Terms. Data deletion requests arriving from a platform (for example Meta's Data Deletion Request callback) are handled via [email protected]: the connected account's credential is deleted and the workspace data is handled per section 5.

9. Children

A1 Lane is not directed at children under 18.

10. Changes

We will post changes here and email account owners before material changes take effect.