POLICY INFORMATION
Privacy Policy
Effective date: October 30, 2026
Operator and effective date
Effective date: October 30, 2026
1. Responsible operator and contact
PILOTALL is operated by İsmet Akdenizli, an individual founder operating from Türkiye, at postal contact published in Contact. The verified product founder/contact is İsmet Akdenizli. Contact akdenizlismet@gmail.com for privacy questions or rights requests. Website: https://getpilotall.com. Intended service markets: United States-based professional accounting firms, CPAs, tax professionals, bookkeeping offices and insurance agencies. The operator is responsible for account, service administration and security processing it determines. For personal information an office enters about its clients or staff, the office determines its authorized purposes, and PILOTALL processes that information to provide the instructed service. Any additional processing agreement required for a customer or market must be in place before that regulated use is offered. This policy does not assert certification, an appointed data-protection officer, or an EU/UK representative that has not actually been appointed.
2. Current service and information processed
The current production release uses hosted Supabase authentication and PostgreSQL office records, with Render application hosting. Operational information is not confined to the founder's local computer. Public signup, verified office onboarding and Lemon Squeezy checkout are available. Depending on the enabled operation, we process account identity and contact information; confirmation and session information; office name, profession, membership and role; client records; task titles, statuses, deadlines and assignments; document metadata; approval requests and decisions; and operational audit/security information. A device or hosting provider may also process IP address, request, browser and security-event information necessary to deliver and protect the service. Information comes from the account holder, authorized office members, authentication/hosting systems and the office's authorized use of the product. If you provide another person's information, you must have authority to do so and provide any required notice. Do not submit unnecessary taxpayer identifiers, credentials or confidential documents through support email. Private file upload/storage/scanning, office AI, marketing campaigns and unattended background delivery remain disabled. Verified account confirmation/recovery, security/billing notices and internal-team/client-portal invitation paths send essential transactional email through Resend. This involves recipient addresses and necessary account/invitation content; actual delivery also depends on the receiving mail provider. No disabled provider is described as an active recipient of office content.
3. Purposes and legal bases where applicable
We use information to authenticate users, maintain office membership, provide authorized office records and reports, prevent cross-office access, enforce approvals, respond to requests, investigate security incidents and maintain necessary evidence of operations. We do not use office content for advertising or claim an enabled AI-training program. Where data-protection law requires a legal basis, account/service processing is performed as necessary to provide the requested contract, security and misuse prevention rely on legitimate interests where that basis is available and proportionate, and necessary legal-record handling relies on applicable legal obligations. Consent is used when a particular optional processing requires it; optional processing is not silently activated. For office-controlled client data, the office must establish its own lawful basis and instructions. These descriptions do not assert that one legal basis covers every person or market.
4. Service providers and disclosures
Current core providers are Supabase (authentication and database services) and Render (application hosting). The authenticated Supabase project settings identify its region as West US (Oregon), and the reviewed Render application service is also in Oregon, United States. Those project regions do not establish that every provider support operation, diagnostic log or backup copy stays in that region. We do not promise data residency outside the verified project-region facts. Supabase Auth sends transactional authentication email through Resend using the verified getpilotall.com sender domain. This involves recipient addresses and authentication-message content. Essential account, security/billing notice and internal-team/client-portal invitation emails are sent through Resend. This involves verified recipient addresses and necessary account/invitation content. Marketing and scheduled email remain disabled. The existing support mailbox is hosted by Gmail/Google; contacting support sends the information in your message through that email provider. It is not a secure document intake channel. Lemon Squeezy processes purchases as merchant of record. Its buyer/payment processing and privacy terms apply when it processes a purchase. We may disclose information to an authorized office representative, necessary service providers, or a competent authority when lawfully required, and may preserve necessary evidence for security or legal claims. We do not sell personal information or disclose office information to unrelated offices. Before activating an additional provider or materially different use, we will assess safeguards and update the relevant disclosures.
5. Locations and international transfers
Hosting, authentication and support can involve countries outside the user's own country. No claim of a particular adequacy decision, executed contractual transfer mechanism or local-only processing is made without verification. Where applicable law requires a transfer safeguard, the operator must verify and implement it before offering that processing to the affected market. Contact the published address for the currently verified provider/location details and any applicable safeguards. Intended markets and operator jurisdiction are recorded in the confirmed operator information.
6. Retention criteria and deletion
Core office records are retained while needed to supply the authorized office workspace and until an authorized deletion or closure request is processed, subject to legitimate security, legal, dispute and record-retention constraints. We assess the purpose, customer instructions, account status, applicable duties, legal holds, record dependencies and others' rights. We do not retain records merely because storage is available. Ending a trial, founder grant or subscription does not automatically erase records. Document retention/hold controls and audit dependencies may prevent immediate deletion. Security and dispute evidence may remain when needed for those purposes; when those grounds end, the information should be deleted or anonymized through the authorized process. Requests are assessed individually and the applicable outcome and constraints communicated. Deletion of a primary record does not establish erasure of every backup or provider log. Current hosted backup-retention/recovery coverage has not been certified. When handling an erasure request, we identify any residual copies and applicable retention restrictions rather than promise immediate universal deletion. There is no unverified fixed backup-purge schedule in this policy.
7. Cookies, browser storage and security
The reviewed application uses necessary session cookies and browser storage for authentication, navigation, request integrity and safe operation. Session cookies are Secure and HttpOnly, and private responses use no-store controls. No advertising/marketing analytics integration was enabled for this release. Additional nonessential tracking must be separately assessed and, where required, consented to before activation. Verified safeguards include HTTPS, server-validated sessions, active membership checks, role restrictions and database row-level security. These reduce risk but do not guarantee perfect security. Disabled file scanning is not presented as an active safeguard. No independent certification or blanket hosted restoration guarantee is claimed.
8. Rights, requests and complaints
Depending on applicable law, you may request access, correction, deletion, restriction, portability, or object to specified processing; withdraw consent where consent is the basis; and complain to the competent data-protection authority. Contact the published privacy address. We verify identity and office authority proportionately and respond within applicable legal deadlines. A request relating to office-controlled client records may need to be directed to or coordinated with the office. You may ask for the reasons for a refusal or limitation. Providing the information necessary for authentication and office authorization is required to use private features; without it, access cannot be established. The reviewed release does not perform automated decisions producing legal or similarly significant effects, does not offer live office AI, and is designed for authorized professional offices rather than children. Changes affecting processing will be described in an updated policy with a current effective date; material new uses require any applicable additional notice or permission.
Professional workspace records
Depending on the office’s use, workspace records can include CRM contacts, services, tags, custom fields, document metadata/version snapshots, operator-written proposals, signature-preparation metadata, explicitly shared portal messages, client-proposed contact updates, reviewed imports and internal membership/seat-change history. These are office records, not proof of file upload, legal signature execution or payment. File upload/scanning, paid AI, marketing campaigns and unattended jobs remain disabled. Essential transactional email is available. Browser push requires separate opt-in and qualification.
Optional browser notifications
If you opt into Web Push as an internal office user, PILOTALL stores the browser subscription endpoint, encryption keys and your user/office binding to route alerts. The browser vendor's push service processes delivery routing, connection metadata and the encrypted generic notification payload. Chrome delivery has been qualified using Google Firebase Cloud Messaging (FCM); other browsers depend on their own support and permission requirements. Notification text contains no client names, document contents or private office messages. You can unsubscribe or revoke your registered devices. Notifications are sent on demand while the workspace is active; continuous background delivery is not guaranteed on the current hosting tier.
BUILD TRUST INTO THE WORK
Start with a verified workflow.
Explore the product and its current limits before connecting a provider.
Read the getting-started guide →