Privacy Policy

Version: 1.0 Effective Date: February 20, 2026 Last Updated: February 20, 2026

1. Introduction

Welcome to Pilotify. Pilotify ("we," "us," or "our") operates a SaaS platform designed to facilitate bilateral pilot management for organizations, connecting Innovators and Champions in structured engagement programs.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform at www.pilotify.app (the "Service"). Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the Service.

Company Details:

• Company Name: Pilotify
• Registered Address: Harluntie 5, 02600 Espoo, Finland
• Contact Email: contact@pilotify.app

2. Data Collection Scope

We collect the following categories of data:

2.1 Personal Identifiable Information (PII)

2.2 Analytics Data

We use anonymized and aggregated analytics where possible. Analytics data is collected through:

• Vercel Analytics (integrated)
• Microsoft Clarity (optional, subject to consent)

2.3 Room Content

As a core part of our Service, users create and manage "rooms" containing:

Note: Room content is associated with your workspace and controlled by workspace administrators.

3. How We Use Your Data

We use your data for the following purposes:

1. Service Delivery — To provide, maintain, and improve the Pilotify platform
2. Account Management — To create and manage your account, authenticate access
3. Communication — To send administrative information, respond to inquiries
4. Analytics — To understand usage patterns and improve user experience
5. Security — To detect, prevent, and address technical issues and fraud
6. Legal Compliance — To comply with applicable laws and regulations

We do not use your data for automated decision-making or profiling that produces legal effects.

4. Sub-processors

We work with the following third-party service providers (sub-processors) to deliver the Service:

Each sub-processor has been vetted for GDPR compliance and enters into appropriate data processing agreements with us.

5. Legal Basis for Processing

Under GDPR Article 6, we process personal data on the following lawful bases:

5.1 Consent (Art. 6(1)(a))

For optional features such as:

• Marketing communications
• Non-essential cookies and tracking
• Microsoft Clarity analytics

You may withdraw consent at any time via your account settings or by contacting us.

5.2 Contract Performance (Art. 6(1)(b))

Processing necessary to provide the Service as described in our Terms of Service:

• Account creation and management
• Room and workspace functionality
• Customer support

5.3 Legitimate Interest (Art. 6(1)(f))

Processing necessary for our legitimate interests, balanced against your rights:

• Security monitoring and fraud prevention
• Service improvement and analytics
• Network infrastructure maintenance

5.4 Legal Obligation (Art. 6(1)(c))

Processing necessary to comply with legal requirements:

• Tax and accounting obligations
• Response to lawful requests from authorities
• Financial record retention

6. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which we collected it:

When data is deleted, we ensure it is permanently removed from our active systems and take reasonable steps to delete it from backups within 90 days.

7. Your GDPR Rights

You have the following rights under the General Data Protection Regulation (GDPR):

7.1 Right to Access (Art. 15)

You may request a copy of the personal data we hold about you.

7.2 Right to Rectification (Art. 16)

You may request correction of inaccurate or incomplete personal data.

7.3 Right to Erasure — "Right to be Forgotten" (Art. 17)

You may request deletion of your personal data. See Section 8 for our deletion process.

7.4 Right to Restriction (Art. 18)

You may request restriction of processing in certain circumstances.

7.5 Right to Data Portability (Art. 20)

You may request your data in a structured, commonly used, machine-readable format.

7.6 Right to Object (Art. 21)

You may object to processing based on legitimate interests or direct marketing.

7.7 Rights Related to Automated Decision-Making (Art. 22)

You have the right not to be subject to decisions based solely on automated processing that produce legal effects.

To exercise any of these rights, please contact us at contact@pilotify.app.

8. GDPR Article 17 — Deletion Mechanism

8.1 How to Request Deletion

You can request data deletion by:

1. Account Settings: Deleting your account via Settings > Account > Delete Account
2. Email Request: Sending an email to contact@pilotify.app with "Data Deletion Request" in the subject line
3. Contact Form: Using the contact form on our website

For security, we may verify your identity before processing deletion requests.

8.2 What Gets Deleted

Upon deletion request, the following data is permanently removed:

Note: Workspace administrators may retain certain data if you were invited to a workspace you do not own.

8.3 Deletion Timeline

8.4 Exceptions

We may retain certain data where required or permitted by law:

• Billing records (7-year retention for tax purposes)
• Data necessary for legal claims or proceedings
• Data subject to legal hold obligations

9. Cookie Policy

9.1 What Are Cookies

Cookies are small text files stored on your device when you visit websites. They help remember your preferences and improve your experience.

9.2 Cookies We Use

9.3 Managing Cookies

You can control or disable cookies through your browser settings:

• Chrome: Settings > Privacy > Cookies
• Firefox: Options > Privacy > Cookies
• Safari: Preferences > Privacy > Cookies

Disabling essential cookies may affect Service functionality.

9.4 Third-Party Cookies

Our analytics providers may set cookies:

• Vercel Analytics: Sets anonymized performance cookies
• Microsoft Clarity: Sets session recording cookies (with consent)

10. Data Security

10.1 Technical Measures

10.2 Organizational Measures

• All team members with data access sign confidentiality agreements
• Annual data protection training
• Incident response procedures documented
• Security questionnaires completed for sub-processors

10.3 Data Minimization

We collect only the data necessary for the purposes outlined in this policy. We review our data collection practices regularly.

11. Data Breach Notification

11.1 Our Commitment

In the event of a personal data breach that affects your data, we commit to:

1. Notifying the relevant supervisory authority within 72 hours of becoming aware
2. Notifying affected users without undue delay when the breach is likely to result in high risk to their rights

11.2 Notification Contents

Our breach notification will include:

• Description of the nature of the breach
• Categories and approximate number of data subjects affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach

11.3 Your Responsibilities

If you become aware of a security incident involving your Pilotify account, please contact us immediately at contact@pilotify.app.

12. Children's Privacy

Pilotify is designed for business professionals and is not intended for use by children under the age of 16.

We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16 without parental consent, we will take steps to delete that data promptly.

If you believe a child has provided us with personal data, please contact us at contact@pilotify.app.

13. International Data Transfers

13.1 Transfer Mechanisms

Personal data may be transferred outside the European Economic Area (EEA) under:

1. Adequacy Decisions: Where the destination country has an EU adequacy decision
2. Standard Contractual Clauses (SCCs): We use the EU SCCs (Commission Decision 2021/914) for transfers to the US and other non-adequate countries

13.2 Data Location

• Primary storage: EU (Ireland via Supabase)
• Default processing: Within the EEA where possible

13.3 Your Rights

For international transfers, you retain all rights outlined in Section 7 of this policy.

14. Changes to This Policy

14.1 How We Communicate Changes

We may update this Privacy Policy from time to time. We will:

1. Post the updated policy on our website with a new "Last Updated" date
2. Notify users of material changes via email (for registered users)
3. Keep previous versions archived for reference

14.2 Your Rights on Changes

If you do not agree with material changes to this policy, you may:

• Exercise your right to deletion (Section 8)
• Contact us with concerns
• Stop using the Service

14.3 Non-Material Changes

Minor changes (such as updating sub-processor details) may be made without notice but will be reflected in the "Last Updated" date.

15. Contact Information

15.1 Questions and Concerns

For questions about this Privacy Policy or to exercise your rights, contact us:

Data Protection Contact: Jan-Kristian Westerlund Email: contact@pilotify.app Address: Pilotify, Harluntie 5, 02600 Espoo, Finland

15.2 Supervisory Authority

If you believe we have not handled your data in accordance with the GDPR, you have the right to lodge a complaint with the Finnish supervisory authority or the supervisory authority in your country of residence.

Finnish Office of the Data Protection Ombudsman (Tietosuojavaltuutettu):

• Website: https://tietosuoja.fi/en
• Email: tietosuoja@om.fi
• Address: Lintulahdenkuja 4, 00530 Helsinki, Finland

Effective Date: February 20, 2026

This Privacy Policy is provided for informational purposes and constitutes v1 for beta release. For production use, we recommend review by qualified legal counsel to ensure compliance with all applicable laws in your jurisdiction.