Privacy policy

This Privacy Policy explains what information PilotDeck (the "Service") collects, how we use
it, and the choices you have. It applies to your account and to the sites, content, and
integrations you manage through the Service. This is a good-faith description of our current
practices, not legal advice.

1. Information We Collect

- Account information — your name, email address, and a securely hashed password. We
never store your password in plain text.
- Billing information — subscription and payment details are handled by our payment
processor, Stripe. We store your Stripe customer and subscription identifiers and your
billing status; we do not store your full card number.
- Site and content data — the sites you connect, and the research, drafts, and published
content you create or approve through the Service.
- Connected third-party data — if you connect integrations such as Google Search Console
or a content management system (for example, via the PilotDeck WordPress plugin), we store
the connection credentials and the performance/content data needed to provide that
integration, limited to what you've authorized.
- AI assistant connections — if you connect an AI assistant such as Claude to the Service,
you choose one site and approve what the assistant can do. We record which assistant is
connected, to which site, the network address it last connected from, and a log of each request
it makes (the action used, whether it succeeded, and when). We do not store your conversations
with the assistant.
- Usage data — how you interact with the Service, such as pages visited, features used,
actions taken, device and browser information, and approximate location derived from your
IP address. We collect this using PostHog, a product analytics provider.

2. How We Use Your Information

We use your information to operate the Service: authenticate your account, generate and
publish content on your behalf, show you search-visibility and performance data, process
billing through Stripe, and communicate with you about your account.

We use usage data to monitor the performance and reliability of the Service, understand how
features are used, diagnose problems, and improve the product.

3. How We Share Information

We do not sell your information. We share it with:

- Stripe, to process payments and manage your subscription.
- PostHog, to provide us with product analytics. PostHog processes usage data on our
behalf and does not use it for its own advertising.
- Website analytics and session replay providers (Google Analytics, Microsoft Clarity, Umami
and Ahrefs), to help us understand how our website is used. Clarity records how visitors move
through and interact with website pages.
- Advertising partners (Meta and OpenAI), to measure and improve our ads. They may receive the
pages you visit and actions such as starting a trial or checkout, along with identifiers from
their cookies or ad links, your IP address and browser details. Meta may also receive a scrambled
(hashed) copy of your email address and account ID. These partners handle this data under their
own privacy policies.
- RB2B, which may use your IP address and its own data to identify visitors to our website as
people or companies, so that our team can follow up with them.
- AI model providers (such as Anthropic, OpenAI, Perplexity and fal), which process your site
details, brand profile, briefs and drafts to research, plan, write and illustrate content, and
to test how AI assistants answer the questions you track.
- Support, email and monitoring providers (such as Resend for email, Freshsales for customer
records, Sentry for error monitoring, Cloudflare for form spam protection and Zcal for
scheduling calls), to run and support the Service.
- Third-party services you choose to connect (for example, Google Search Console or your
CMS), only to the extent needed to provide that integration.
- AI assistants you choose to connect (for example, Claude). The assistant can read the
connected site's data in the Service (such as its content plan, briefs, drafts, verified
facts, AI visibility results, competitors, social posts, and usage) and make the changes you
approved (such as saving edited drafts or updating the brand profile, tracked questions, and
competitors, or giving feedback on social posts). It cannot publish to your website or access your other sites. Data you share
with an assistant is also handled under that assistant provider's own privacy policy.
- Infrastructure and hosting providers who help us operate the Service, under
confidentiality obligations.
- Where required by law, or to protect the rights, safety, or property of PilotDeck or
others.

Our analytics data is hosted by PostHog in the United States, and other providers listed above may
also process data in the United States. If you access the Service from
outside the United States, including from Canada, the United Kingdom, or the European
Economic Area, your usage data will be transferred to and processed in the United States,
where data protection laws may differ from those in your country. We rely on our providers'
standard contractual protections for these transfers.

4. Cookies & Tracking

Your session is kept using a browser-stored access token. We use PostHog to collect usage data,
which may set a first-party cookie or use browser storage to recognise your browser across sessions.
PostHog may also record how you use the Service, with text you type into forms hidden.

Our website and app also use the analytics, advertising and visitor-identification tools listed in
section 3, which may set cookies or similar identifiers, including advertising cookies. These tools
are on by default. To opt out of Google Analytics, Clarity, PostHog, the Meta Pixel and RB2B tracking on
our website, use Cookie Settings in the website footer.

5. Data Retention

We retain your account and content data while your account is active. If you cancel your
subscription, your content, setup, and history are removed at the end of the billing period
you already paid for, as described in our Terms & Conditions. Billing records may be retained
longer where required for legal, tax, or accounting purposes. Usage data is kept for up to
12 months from when it was collected, then deleted or anonymised. The log of requests made by
connected AI assistants is kept for the same period. The IP address, browser details, advertising
identifiers and landing page we store when you sign up or check out are removed after 12 months.

6. Security

We use reasonable technical and organizational measures to protect your information,
including password hashing and access controls. No method of storage or transmission is
completely secure, and we cannot guarantee absolute security.

7. Your Choices

You can review and update your account information from your account settings, and
disconnect a connected integration (such as Google Search Console, a CMS, or an AI assistant)
at any time. You can disconnect an AI assistant in Settings > Integrations, and its access
stops straight away. To
request deletion of your account and associated data, including usage data, contact us using
the details below.

8. Children's Privacy

The Service is not directed to individuals under 16, and we do not knowingly collect
information from children.

9. Third-Party Services

Integrations and providers we use, including Stripe, PostHog, Google Search Console, and your
content management system, are also governed by that provider's own privacy policy. We
encourage you to review them.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an
updated effective date above. Continued use of the Service after an update constitutes
acceptance of the revised Policy.

11. Contact

Questions about this Privacy Policy can be sent to [email protected].