01Who we are and what this covers
MightyAutomation AI (“MightyAutomation,” “we,” “us”) provides an AI-powered marketing platform for small businesses at mightyautomation.ai and its subdomains, including the website builder, automations, content studio, Mighty CRM, media assets, integrations and the MightyAI assistant (together, the “Service”). We are based in Orlando, Florida.
This Privacy Policy explains what personal information we collect, how we use and share it, and the choices you have. It applies to:
- Visitors to our public website and community pages;
- Members — people who create an account and use the Service; and
- Your contacts — the customers, leads and subscribers whose information members store or process in the Service (see section 4).
If you do not agree with this Policy, please do not use the Service. Capitalised terms not defined here have the meaning given in our Terms of Service.
02Information we collect
Information you give us
- Account and profile — name, email address, password (stored hashed), company name, industry, ideal customer, goals and any answers you give during onboarding.
- Billing — plan, credit balance and transaction history. Card details go directly to our payment processor (Stripe); we never see or store full card numbers.
- Content — websites, pages, copy, images, audio, video, documents, prompts, chat messages and files you create, upload or generate in the Service, including your Brand Kit (logo, colours, fonts, voice notes).
- Lead and marketing forms — when you fill in a form on our site (for example “Start my setup”), we collect your name, email and the page or section you came from.
- Support and community — messages you send us, and posts or comments you make in our community spaces.
Information from connected services
When you connect a third-party account (for example Google Workspace, Slack, Dialpad, HubSpot, social networks), we receive the access tokens and the data those services return for the features you use — such as calendar events, spreadsheet rows, call logs or the ability to post on your behalf. We only request the permissions each feature needs, and you can disconnect at any time from Integrations.
Google user data. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only to provide the features you enable (sending email through your Gmail, logging to your Sheets, creating Drive files or Calendar events) and never for advertising or to train AI models.
Information collected automatically
- Usage and device data — pages viewed, features used, actions taken, timestamps, browser type, operating system, screen size, referring URL, approximate location derived from IP address.
- Session analytics — we use Microsoft Clarity to understand how visitors use our public site and app (heatmaps, session recordings with keystrokes and sensitive fields masked). See section 7 for cookies and controls.
- Logs and diagnostics — server logs, error reports and, for AI features, records of which model was used, how long it took and what it cost, so we can bill accurately and keep the Service reliable.
- QR code scans — when someone scans a QR code created in the Service, we record the time, device type and approximate location of the scan for the member who created it.
03How we use information
We use personal information to:
- Provide and operate the Service — create your account, build and host your website, run your automations, store your media, sync your integrations and deliver the MightyAI assistant.
- Personalise it to your business — your onboarding answers, Brand Kit and project brain shape what MightyAI produces for you. This context is used only within your own account.
- Bill you — process subscription payments, meter AI credits, show cost estimates and send receipts and low-balance notices.
- Communicate with you — service messages (security alerts, receipts, onboarding steps, changes to these terms) and, with your consent or where permitted, marketing messages about features, events and offers (see section 5).
- Improve and secure the Service — debug, analyse usage patterns, prevent fraud and abuse, enforce our Terms and protect our members and the public.
- Comply with law — respond to lawful requests and meet our legal obligations.
04Your contacts: data you process through the Service
Members use Mighty CRM, forms, campaigns and automations to store and communicate with their own customers, leads and subscribers (“Contact Data”). For Contact Data, the member is the controller (or “business”) and MightyAutomation is a processor(or “service provider”) acting on the member’s instructions.
That means:
- We process Contact Data only to provide the Service to the member and as described in our Terms — never for our own marketing, and never to build profiles across members.
- Members are responsible for having a lawful basis to collect Contact Data, for honouring opt-outs, and for complying with laws that apply to their messaging (for example CAN-SPAM, the TCPA for calls and texts, CASL, and GDPR/UK GDPR where relevant). The Service enforces do-not-contact flags on campaigns to help.
- If you are a contact of one of our members and want to access, correct or delete your information, please contact that member directly. If you contact us, we will forward your request to them and assist as required by law.
05Marketing communications and your choices
Our marketing to you
If you give us your email address (for example through a form on our site or by creating an account), we may send you onboarding tips, product news, event invitations and offers. You can opt out at any time by clicking “unsubscribe” in any marketing email or by emailing support@mightyautomation.com. We will still send transactional and service messages (receipts, security notices, changes to terms) because they are necessary to operate your account.
We do not sell your personal information, and we do not share it with third parties for their own direct marketing. We may use your email address to show you relevant content on advertising platforms (for example a custom audience on Facebook) and to measure our own campaigns; you can opt out of interest-based advertising through those platforms’ settings and the controls in section 7.
Text messages
If you provide a mobile number and agree to receive texts from us, message frequency will vary; message and data rates may apply; reply STOP to cancel or HELP for help. Consent to receive texts is not a condition of purchase.
Community and testimonials
Posts you make in our community are visible to other members. We only feature a member’s name, business or testimonial in our marketing with their permission.
06How AI features use your data
MightyAI generates websites, copy, images, audio and other outputs using large-language and image models from third-party providers (currently OpenAI, Anthropic and Google, and others we may add). To do that, the relevant prompt and context — for example your instruction, your Brand Kit, the page being edited or the image being changed — is sent to the provider to produce the result.
- Your content is not used to train models. We use provider APIs under terms that prohibit training on customer data, and we never use your content, project brain or Contact Data to train models ourselves.
- Bring your own keys. If you add your own API keys, requests for those tasks go directly to that provider under your agreement with them. Keys are stored encrypted in your private vault and are only readable by your project.
- Cost transparency. We record which model was used, tokens or images processed, and the cost, so we can show you estimates before a spend and an accurate credit history afterwards.
- You are responsible for outputs. AI can be wrong. Review generated content — especially anything factual, legal or medical — before you publish or send it.
09Data retention and deletion
- Account data is kept while your account is active. When you cancel, your workspace remains available for export for a limited wind-down period, after which it is deleted or anonymised, except where we must keep records for tax, accounting, fraud-prevention or legal reasons.
- Media, websites and project files are kept until you delete them or your account is deleted. Chat attachments are cleaned up periodically; anything you save to Media Assets is kept.
- Billing records are retained as required by law (generally seven years).
- Backups may hold copies for a short period after deletion.
You can export your project brain, files and history from the Service at any time. To delete your account, contact support@mightyautomation.com.
10Security
We protect your information with technical and organisational measures appropriate to the risk, including encryption in transit (TLS) and at rest, encrypted storage for API keys and secrets, row-level access controls so members only see their own data, least-privilege access for our team, and monitoring for abuse. Each member’s project is a private vault; nothing in it is shared with other members.
No system is perfectly secure. Please use a strong, unique password and keep your connected accounts secure. If you believe your account has been compromised, contact us immediately.
11Your privacy rights
Depending on where you live, you may have the right to:
- Access the personal information we hold about you and receive a copy;
- Correct inaccurate information;
- Delete your information;
- Port your data to another service;
- Object to or restrict certain processing, including direct marketing;
- Withdraw consent where processing is based on consent; and
- Not be discriminated against for exercising these rights.
California residents (CCPA/CPRA):the categories of personal information we collect are described in section 2; we collect them for the purposes in section 3; we do not sell or “share” personal information for cross-context behavioural advertising except as described in section 5, which you can opt out of. You may designate an authorised agent to make requests on your behalf.
EEA / UK residents: you may also lodge a complaint with your local data-protection authority. Where we transfer data outside your region, we rely on standard contractual clauses or other approved mechanisms.
To exercise any right, email support@mightyautomation.com from the address on your account. We will verify your identity and respond within the time required by law (generally 30–45 days).
12Children
The Service is for businesses and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.
13Changes to this Policy
We may update this Policy as the Service and the law evolve. We will post the new version here with a new effective date and, for material changes, notify you by email or in the app before they take effect. Continued use of the Service after the effective date means you accept the updated Policy.
14Contact us
Questions, requests or complaints about privacy:
MightyAutomation AI
Orlando, Florida, USA
support@mightyautomation.com