PostPilot User Agreement

1. Scope & User Registration

This User Agreement ("Agreement") establishes the terms under which authorized users access and operate PostPilot — BY GAATHA ("PostPilot", "the Platform"). Operated collaboratively by Gaatha Ventures Sh.p.k. (Albania, Europe) and Aidni Global LLP (India) within the GAATHA technology ecosystem, PostPilot provides enterprise multi-brand social media scheduling and communication services.

By creating an account, authenticating a session, or performing actions within PostPilot, you agree to comply with this Agreement, our Terms & Conditions, and our Privacy Policy. If you do not possess the authority to represent your organization or agree to these terms, you must not access the platform.

2. Organization Membership & Role Hierarchy

PostPilot enforces strict multi-tenant organization boundaries. Users belong to designated organization workspaces and are assigned discrete role permissions:

• Administrator (Admin): Complete administrative control over organization settings, member invitations, brand configurations, connected social accounts, and publishing schedules.
• Editor: Authorized to create, edit, and organize content drafts, upload creative assets, and propose scheduled posts for assigned brands.
• Reviewer / Viewer: Read-only access to inspect calendars, audit timelines, drafts, and historical analytics without scheduling or publishing privileges.

Users must not attempt to circumvent organizational barriers, access data belonging to other tenants, or elevate permissions beyond their authorized role.

3. Social Account Authorization & OAuth Delegation

When connecting third-party platforms (Facebook Pages, Instagram Professional Accounts, LinkedIn Company Pages, or WhatsApp Business Cloud API), you warrant that:

• You are an authorized administrator or account holder of the designated social asset with legal authority to bind that entity.
• You grant PostPilot permission to request, securely store, and utilize OAuth access tokens solely to inspect status, validate containers, and dispatch approved social broadcasts on your behalf.
• You understand that PostPilot never stores account passwords; authorization is managed exclusively through standard OAuth 2.0 cryptographic tokens.
• You retain the right to revoke PostPilot's authorization at any time directly through the platform or via third-party provider security settings (Meta Business Integrations or LinkedIn Permitted Services).

4. Content Ownership & Intellectual Property

You retain 100% ownership of all creative content, copy, graphics, images, video assets, and branding materials uploaded to or scheduled through PostPilot ("User Content").

By uploading User Content, you grant PostPilot a limited, non-exclusive license strictly to host, cache, format, and transmit the content to designated social endpoints as instructed by your publishing schedule. You represent and warrant that your content does not infringe on third-party intellectual property, privacy, or publicity rights.

5. Engineered Publishing Safeguards

PostPilot is built with a defense-in-depth safety engine. Users acknowledge and agree that:

• Publishing is gated by an active environment variable control (POSTPILOT_PUBLISHING_ENABLED). When set to 0, all scheduled releases execute in simulation mode.
• Simulated dispatches generate diagnostic records with distinct simulation identifiers (e.g. fb_post_sim_... or ig_container_sim_...) and are visibly distinguished from actual live destination dispatches.
• Activation of live publishing requires explicit owner authorization. PostPilot is not liable for delayed publishing if the safety gate is intentionally kept in simulated mode.

6. Account Security & Session Hygiene

Each user is responsible for safeguarding their login credentials and session integrity:

• Do not share passwords, session cookies, or CSRF tokens across individuals or external tools.
• Immediately notify the platform administration at office@gaatha.tech if you suspect unauthorized access or compromised credentials.
• Session cookies are defensively configured with SameSite=Lax and HttpOnly flags to prevent cross-site interception.

7. Prohibited Misuse & Acceptable Behavior

Users agree not to engage in any of the following prohibited activities:

• Automated scraping, reverse engineering, or exploiting platform APIs beyond documented usage.
• Dispatching unsolicited commercial messages, spam, or misleading marketing in violation of Meta WhatsApp Cloud or platform policies.
• Scheduling or distributing malicious software, phishing links, unlawful content, or hate speech.
• Attempting to probe, scan, or compromise PostPilot's server infrastructure or multi-tenant database.

Violation of these provisions may result in immediate suspension or termination of your organization account without prior notice.

8. Revocation, Termination & Contact

You may terminate this Agreement at any time by requesting deletion of your organization account and revoking connected social platform authorizations.