Privacy Policy

Effective date: 18 August 2026 Last updated: 18 August 2026

Prospect Miner, LLC, doing business as Total Automation ("Total Automation", "we", "us"), operates TotalAutomation.ai, a managed social media automation service. This policy explains what information we collect, why we collect it, who we share it with, and what control you have over it.

If you have questions, our contact details are at the end.

1. Who this policy covers

This policy covers three groups, and what we do differs for each:

• Subscribers — businesses who pay for our service.
• Visitors — anyone browsing our website or joining our waitlist.
• People who interact with a subscriber's social media — for example, someone who comments on a post we published for a subscriber. We process limited information about these people on our subscriber's behalf, and the subscriber decides how it is used.

2. Information we collect

2.1 Information you give us

Account and billing information. Your name, business name, email address, postal address, phone number, and industry. Payment card details are collected and stored by our payment processor, not by us — we receive only a token, the last four digits, and the transaction result.

Your brand configuration. The Style Guide you complete at signup: tone of voice, target audience, content preferences, topics to avoid, posting frequency, and visual preferences.

Content and media you upload. Photos, videos, and any text or topic direction you provide.

Waitlist submissions. Email address, business name, industry, and which plan interests you.

2.2 Information we receive from social media platforms

When you connect a social media account, you authorise us through that platform's official login process. We then receive, on your behalf:

• An access token permitting us to act for your connected account
• Your page or profile identifiers and basic account details
• The media library associated with your connected pages
• Posts we publish, and their performance data — reach, impressions, likes, shares, clicks, and engagement rate
• Comments left on those posts, including the commenter's display name, the comment text, and the time it was posted

We never receive or request your social media password.

2.3 Information collected automatically

Standard web and service logs: IP address, browser type, pages viewed, and timestamps. We also record operational events — when a workflow ran, whether it succeeded, and errors it produced.

3. How we use information

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

We do not use your content, your audience's data, or your performance data to train general-purpose AI models. Performance analysis is confined to your own account and used only to improve your own results.

4. Artificial intelligence and sub-processors

Our service uses third-party AI and infrastructure providers. To generate and review content for you, we send them the material necessary to do that work — your Style Guide, topic direction, draft copy, and media. We do not send them your billing details or your account credentials.

Each provider's own privacy policy governs its handling of that information, and is linked below.

We keep this list current. Each provider is bound by its own terms and, where required, a data processing agreement.

5. How we protect your social media credentials

This deserves its own section, because it is unusual and it matters.

Your social media access tokens are never stored in plaintext anywhere in our systems. Specifically:

• Tokens are encrypted with AES-256-GCM before storage, using a unique cryptographic nonce for every write.
• Encrypted tokens live in Cloudflare Workers KV, isolated per subscriber. Each token is cryptographically bound to its own storage location, so a token cannot be moved between subscriber accounts without failing authentication.
• The encryption key is held in a separate secrets store, never alongside the data it protects.
• Our operational database stores connection status only — whether an account is connected, and when. It holds no credential data.
• Tokens are never written to logs, never committed to source control, and released only over an authenticated request at the moment they are needed.

No system is perfectly secure, and we do not claim otherwise. But credential custody is designed to fail safe.

6. Comments and other people's information

When we reply to comments on your behalf, we process the commenter's display name and what they wrote, in order to classify the comment and compose a relevant response.

We only ever respond to people who contacted you first. We never initiate contact, never message people who have not engaged, and never harvest audience lists. Comments classified as hostile, sarcastic, spam, or a genuine complaint receive no automated reply — complaints are flagged for a human instead.

For this information, the subscriber is the controller and we act as processor on their instructions. If you are a commenter and want your information removed, contact the business whose page you commented on, or contact us and we will pass the request on.

7. Data from Meta platforms (Facebook and Instagram)

This section describes how we handle information obtained through Meta's platforms ("Platform Data") and applies in addition to the rest of this policy.

7.1 What Platform Data we process

When you connect a Facebook Page or Instagram Business account, we process:

• Access tokens authorising us to act for the connected account
• Page and Instagram account identifiers and basic account details
• Media in the connected account's library, where you have asked us to reuse it
• Posts we publish on your behalf, and their insights — reach, impressions, engagement, clicks, and shares
• Comments on those posts, including the commenter's display name, comment text, and timestamp

7.2 How and why we process it

We process Platform Data solely to deliver the service you have asked for: publishing content you have approved, replying to people who comment on it, reporting performance to you, and improving the content strategy for your own account. We process it only as described in this policy and in accordance with applicable law and Meta's Platform Terms and Developer Policies. Nothing in this policy supersedes or conflicts with those terms.

7.3 What we do not do with Platform Data

• We do not sell, license, or purchase Platform Data.
• We do not use it for advertising targeting, and we do not share it with data brokers, advertising networks, or monetisation partners.
• We do not build profiles of individuals from Platform Data.
• We do not attempt to decode, de-anonymise, or reverse-engineer any anonymised or aggregated data Meta provides.
• We do not use Platform Data to train general-purpose AI models.

7.4 How to request deletion of your Platform Data

You can have your Platform Data deleted in any of the following ways, and you do not need a paid account to make a request:

1. Disconnect the account from your subscriber console. The stored access token is deleted immediately and we stop processing data for that account.
2. Remove our app from your Meta account directly — go to Facebook Settings & Privacy → Settings → Apps and Websites, or Instagram Settings → Website Permissions, and remove Total Automation. This revokes our access immediately without contacting us.
3. Email us at legal@prospectminer.ai with the subject line Data Deletion Request, stating the Facebook Page or Instagram account concerned. We will confirm receipt and complete deletion within 30 days.

7.5 When we delete Platform Data without being asked

We delete Platform Data promptly when any of the following occurs:

• Retaining it is no longer necessary for the legitimate business purpose it was collected for
• You close your account or the service through which it was obtained is discontinued
• You or the account holder request deletion
• Meta requests deletion to protect a user
• Applicable law requires deletion

Deletion covers our operational database, our encrypted credential store, and our backups on their normal rotation cycle.

8. How long we keep information

9. How to delete your data

Beyond the Meta-specific routes in section 7.4:

• Disconnect a social account — from your subscriber console. The stored access token is deleted immediately.
• Delete your whole account — email legal@prospectminer.ai. We will delete your account data within 30 days, apart from records we must keep for legal or tax reasons.
• Revoke access from the platform itself — you can remove Total Automation from any connected platform at any time through that platform's own settings, without contacting us. Doing so immediately ends our ability to act on your behalf.

10. Your privacy rights

Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, receive a portable copy, opt out of its sale or sharing, and not be discriminated against for exercising any of these rights.

We do not sell personal information and we do not share it for cross-context behavioural advertising, including under the Nevada Privacy of Information Collected on the Internet from Consumers Act and the California Consumer Privacy Act.

If you are in the European Economic Area or the United Kingdom, you also have the right to object to or restrict processing and to lodge a complaint with your supervisory authority. Where we process personal information about you, we do so to perform our contract with you, to meet legal obligations, or on the basis of legitimate interests in operating and securing the service.

To exercise any right, contact us using the details below. We will verify your identity before acting and will respond within the period required by applicable law.

11. International transfers

We operate from the United States, and our service providers may process information in the United States and other countries. Where information is transferred out of the European Economic Area or the United Kingdom, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses.

12. Cookies

Our website uses only the cookies and local storage necessary to make the site work and to remember your display preferences. We do not use advertising cookies and we do not run third-party trackers on our marketing site.

13. Children

Our service is for businesses and is not directed at anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.

14. Changes to this policy

We may update this policy as the service changes. When we do, we will revise the "Last updated" date above. If a change materially affects how we handle your information, we will notify you by email or through your subscriber console before it takes effect.

15. Contact us

Prospect Miner, LLC d/b/a Total Automation PO Box 10547 Zephyr Cove, NV 89448 United States

Email: legal@prospectminer.ai