Privacy Policy

Last updated 10 October 2026

Pilota helps you see what matters, plan your day, and keep on top of your messages. To do that well, it needs some of your data, and you deserve to know exactly what happens to it. This policy explains, in plain words, what Pilota (“Pilota”, “we”, “us”) collects, why, who else sees it, and how you stay in control.

Pilota is operated by Pilota ApS, CVR 46720776, Danneskiold-Samsøes Allé 41, 1434 Copenhagen K, Denmark. If you are in the EU/EEA or UK, we are the data controller for the data described here.

The short version

• Your data is yours. We never sell it, and we never use it for advertising.
• Your accounts stay private. Mail, calendar, Slack, and Teams content is shown to you live. We do not copy it into our database.
• Only you can see your Pilota data. Every record is locked to your account, and connection keys are encrypted.
• Your data lives in the EU. Our main database and file storage are in Frankfurt, Germany.
• AI helps, you decide. The AI services we use do not train their models on what we send them, and in Pilota the assistant asks you before it changes your data.
• You are in control. Disconnect a tool, remove an AI app, export your data, or delete your account in Settings, at any time.

The details follow below. Pilota is a young product, so connected accounts, particularly Google accounts, may sometimes need to be reconnected while we improve the service.

1. What we collect

What you give us

• Account details — your email address (used to sign in with a 6-digit code we email you) and your display name.
• Your content — the tasks, goals, notes/captures, tags, and preferences you create, the files you attach to tasks or assistant messages, files you ask Pilota to prepare, and your saved assistant conversations.
• Your agents — agents you configure, their saved instructions and capabilities, schedules you save, run history, generated results, proposed task changes, and your approval or rejection records. Scheduled runs are temporarily paused.
• Your chats with Pilota — we keep your chats so you can pick them up later. A chat you start from a task is kept with that task. Conversations in the Ask Pilota panel and the focus copilot are kept too, and you can read them again under Archive. A chat you start from a specific email, meeting, or message is kept the same way, with a general name (“Email conversation”, “Meeting”) rather than the item’s subject. Each chat stores what you typed and what Pilota answered. Deleting a task also deletes its chat, and disconnecting an account deletes the chats started from its items.
• Voice dictation — when you select the microphone in Ask Pilota or Add Task, your browser records up to 90 seconds of audio and sends it for transcription. We do not save the recording to your Pilota account or file storage. The returned transcript remains editable and becomes stored content only if you submit it in a message or task.
• AI apps you connect — when you allow an AI app such as Claude or ChatGPT to use Pilota, we keep a record of that permission: which app, when you allowed it, and the sign-in credentials our authentication provider issues to that app. A task or note that an app creates is marked with the app’s name. See section 4.
• Billing and credit data — your selected plan, subscription and payment status, invoices, refunds, credit balance and usage, Stripe customer and payment identifiers, tax location evidence, and any company or tax identifier you provide. We also keep the consent, withdrawal, and refund records needed to handle consumer requests. Stripe collects payment-card details directly. Pilota does not receive or store your full card number or CVC.

What comes from the tools you connect

When you connect Gmail, Google Calendar, Google Drive, Microsoft (Outlook mail, calendar, Teams and OneDrive), or Slack, Pilota reads a limited, read-only slice of your data to power the relevant screen. Here is what happens with it:

• We display this content live and do not store it. Email headers (sender, subject, date), a short mail preview line, calendar events, Slack direct messages and messages that @-mention you, and your Teams chats are fetched from the provider each time you open the screen and are shown in your browser — their contents are not written to our database. We do keep an opaque reference to items you act on — an identifier, not the item — so that something you have handled does not resurface and the same item cannot become two tasks.
• OneNote uses a limited cache. If you connect OneNote, we store page titles, notebook and section names, provider timestamps, and stable links. Automatic sync does not request a text preview or page body. Expanding a page does not request its text. We fetch one page body only when you select Read page in Pilota or Ask Pilota about page. We do not store the page body.
• Google Drive and OneDrive use a metadata cache. We store file names, file types, sizes, provider links and identifiers, created and modified timestamps, the connected account label, and sync cursor or status data. We use this data to show your file library, recent changes, and sync progress. We do not download or store file bodies. Connected cloud files do not use your Pilota file-storage allowance.
• The one exception is what you choose to save. If you turn an email or message into a task, the task title and any details you keep are stored as your own task content — because you asked us to create it.
• Connection credentials. To fetch on your behalf we store the connected account’s address/label, the read-only permissions you granted, and the access/refresh tokens — which are encrypted at rest and only ever used on our servers (see “How we keep your data safe”).

What we collect automatically

We keep minimal server and security logs (such as timestamps and error events) needed to run the service reliably and safely, and we use two service providers to keep Pilota running and improve it: Sentry for error monitoring (to find and fix crashes) and PostHog for product analytics (which features get used). Our analytics are cookieless — they use no tracking cookie or persistent analytics identifier on your device. If you turn analytics off, we save that choice on your device so it remains off after a reload. Analytics events are tied only to your account and never follow you across other sites. We do not use third-party advertising or cross-site tracking.

2. The permissions we ask for

We ask only for read-only access, and only for the tools you choose to connect:

Gmail, Google Drive, and Microsoft connections are paused for this launch. Pilota does not request new access or fetch new data from those services while they are paused. If you connected one earlier, you can disconnect it in Settings. The permissions below also describe earlier connections.

• Google Calendar — calendar.events.readonly (view your events).
• Gmail — gmail.metadata (message headers only: sender, subject, date and labels — never the body of your emails).
• Google Drive — drive.metadata.readonly (file metadata only, not file bodies).
• Microsoft — Mail.Read, Calendars.Read and Chat.Read for Outlook and Teams. OneDrive uses a separate, read-only Files.Read grant. OneNote uses a separate, read-only Notes.Read grant. You can connect either file service without granting Outlook or Teams access. Microsoft does not offer a metadata-only OneNote permission. Notes.Read can read page bodies, but Pilota does not request them during automatic sync.
• Slack — reading your direct messages and messages that mention you, so we can surface what needs your attention.

3. How we use your data

• To provide the service: store your tasks and preferences, score and prioritise your work, lay out your day, and surface messages that need you.
• To generate AI assistance (“Pilota’s read”, Ask Pilota, and agents you run) — see the next section.
• To secure the service, prevent abuse, debug problems, and communicate with you about your account.
• To provide paid plans, measure credit use, collect payment, issue invoices or credit notes, handle refunds and withdrawals, prevent payment fraud, and meet tax and accounting duties.

Our legal bases (EU/UK GDPR) are: performance of our contract with you (running the app you signed up for, including transcription that you request), your consent (each integration you connect, which you can withdraw at any time), our legal obligations for tax and accounting records, and our legitimate interests in keeping the service secure, reconciling payments, and preventing fraud.

4. How AI works with your data

Pilota uses AI to help you, and we keep it to what each feature needs. We do not send the raw contents of your email, calendar, Slack, or Teams to AI providers.

What we send

To power “Pilota’s read”, the Ask Pilota assistant, and an agent you run, we send the relevant details of your tasks and goals (such as title, description, steps, deadline and importance, including the names of files you attach to tasks or chats), the messages you type to the assistant, the instructions you saved for the selected agent, and the optional work profile you provide in Settings → About you (role, team, industry, organization name and size, country, and your goals for Pilota). Your year of birth is stored for your own settings only and is never sent.

“Pilota’s read” is generated automatically when you open your cockpit, and cached for the session. The assistant only runs when you message it. A chat you start from a task is sent with each new message in that conversation, so the assistant can follow the thread. When you start a new chat in the Ask Pilota panel, your first message and the assistant’s first reply are sent once more to name that conversation, so your saved chats are listed by subject rather than by the opening words you typed. This happens automatically, only on the first exchange, and you can rename any chat yourself.

OneNote page text is sent only when you explicitly select Ask Pilota for that page. Other connected content reaches AI only when you choose to save an item as a task. That task’s details are then processed like any other task you create.

Who processes it

Our AI provider is Anthropic (Claude), together with the infrastructure providers described here. With Vercel AI Gateway enabled, text requests use Claude through Google Vertex AI or Amazon Bedrock. This route requires EU inference, zero data retention, and no prompt training. It fails if no permitted route is available. The direct-provider recovery configuration uses Anthropic with one retry through OpenAI (GPT), which can process data outside the EU.

We use these providers under their commercial API terms, which state that content submitted through the API is not used to train their models. AI output can be wrong, so you stay in control: in Pilota, the assistant asks you to confirm before it acts on your data.

Using Pilota from Claude or ChatGPT

You can connect Pilota to an AI app you already use, such as Claude (by Anthropic) or ChatGPT (by OpenAI), and work with your tasks and notes from there. Nothing is connected unless you choose it on Pilota’s consent screen, and you can remove an app at any time in Settings → Connections → AI apps.

When you allow an app, it can read your Pilota data and add, change, or delete it, with the same access your Pilota account has. There is one exception: it can never see the credentials of the accounts you connected to Pilota, such as Google or Slack. We describe this access in full so that nothing comes as a surprise, so please connect only apps you trust.

For each request, the app sends Pilota only what that request needs, such as a task title or a deadline. Pilota never receives your conversation with the app. The Pilota data that the app reads, and the result of each request, go to that app’s provider and become part of your conversation there. The provider handles it under your own agreement with them and their privacy policy. They do not act on Pilota’s behalf, and this policy does not cover what they do with your conversation.

Your AI app usually asks you to confirm before it makes a change, or shows a Pilota card where you choose Add or Save. Whether and how it asks depends on the app and on your settings there, so Pilota cannot require it. For each request, we log only its name, its time, and any error, never its content.

A manual agent starts only when you select Run. It can read the board areas allowed by its capabilities. It stores a run record and its result. Proposed task changes are stored in a review queue and do not run until you approve them. Scheduled agents can start from a saved time without a new message from you. Scheduled runs are temporarily paused while we complete their legal and data-lifecycle controls. Future scheduled Workflow coordination will contain only opaque run identifiers and status values. Rich results stay in our owner-scoped EU database and are removed from temporary delivery storage after delivery or expiry.

When PDF reading is available and you attach a PDF stored in Pilota to an assistant message, the attachment notice tells you that sending the message lets Pilota read it. We extract text in an isolated, network-blocked Vercel processing environment. We keep a page-numbered text extraction with the file and send a limited part of that text through Vercel AI Gateway to a configured AI provider. PDF text uses Claude through Google Vertex AI or Amazon Bedrock. This route requires EU inference, zero data retention and no prompt training. The request fails if no route can meet those rules. We keep the selected provider and broad route region with the usage record. That record does not contain PDF text. Do not include health data, financial account information, or government-issued identifiers. We do not read cloud-file bodies. We do not use OCR, so scanned PDFs may have no readable text.

When you request voice dictation in Ask Pilota or Add Task, Pilota sends the recording through Vercel AI Gateway to SpaceXAI for transcription with grok-stt. This route requires zero data retention and prohibits prompt training. It allows no other provider or model, so the request fails if the approved route is unavailable. This voice route does not require EU-only inference. Audio can be processed outside the EU. The recording is processed temporarily in browser, application, Gateway, and provider memory. Pilota does not save it to its database or file storage. We keep only operational usage data, such as the model, provider, broad route region, duration, cost, and completion status. The transcript remains editable. Pilota does not send a message or create a task from it until you choose that action.

When you ask Pilota to prepare a PDF, Word document, PowerPoint presentation, or Excel workbook, the assistant selects exact Pilota source references for your approval. Pilota then assembles the file on our servers with a fixed template. The selected source text is not sent to an additional AI provider for this file-assembly step.

When you request an AI edit in Artifact Studio, Pilota sends the selected structured text, table values, formulas, chart data, and layout choice to the AI providers described above. The active section, slide, or sheet is the default scope. Pilota sends the whole structured file only when you select Whole file. Pilota does not send the original Office file, image data, private asset identifiers, brand settings, or database metadata. Pilota validates the result and shows a proposal. The proposal does not change your file until you select Apply, and you can undo it after you apply it.

5. Google user data — Limited Use

Pilota’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically: we only use your Google data to provide the calendar, mail, and Drive metadata features you connect; we do not sell it; we do not use it for advertising; and we do not use it to train generalised AI models. Gmail and Calendar content is fetched live and shown to you. Its contents are not stored on our servers. We store the limited Google Drive metadata described in section 1 while that connection is active. Beyond connection tokens and Drive metadata, we keep only an opaque reference to items you act on (for example, so an email you have already handled does not resurface, and turning the same one into a task twice does not create a duplicate). A reference identifies an item; it does not contain the item.

6. How we keep your data safe

• EU data residency — our primary account database and private file storage run in Frankfurt, Germany. The providers in sections 7 and 8 may process limited copies elsewhere.
• Isolation — row-level security scopes every record to your account, so one user can never read another’s data.
• Token encryption — the OAuth access and refresh tokens for your connected accounts are encrypted at rest (AES-256-GCM) with a key held only in our application environment, never in the database, and are used only on the server. Tokens never reach your browser. A small number of other connection values — such as a provider’s own sync-continuation cursor, which lets us fetch only what changed since your last sync — are not separately encrypted; they are protected the same way the rest of your account data is, by the isolation described above.
• Transport security — all traffic is served over HTTPS.

7. Who else sees your data

We do not sell your personal data. We share it only with the service providers (“subprocessors”) that help us run Pilota, under contract and only as needed:

• Supabase — database, authentication and storage (EU region, Frankfurt).
• Vercel — application hosting, isolated PDF text extraction, AI request and voice-transcription routing, and opaque Workflow coordination for scheduled agents when that feature is enabled.
• Stripe — checkout, payment processing, subscription management, invoices, payment recovery, fraud prevention, and tax calculation. Stripe receives the billing and payment data needed for those services.
• Resend — delivery of purchase confirmations and account-deletion notices. Resend receives the recipient email address and message content, including the purchase confirmation attachment.
• Anthropic and OpenAI — AI processing (see section 4 for how each is used).
• Google Vertex AI and Amazon Bedrock — Claude inference through Vercel AI Gateway, with the regional restrictions in section 4.
• SpaceXAI — zero-data-retention voice transcription through Vercel AI Gateway (see section 4).
• AI apps you choose to connect (for example Claude by Anthropic or ChatGPT by OpenAI) — only if you connect one, and only the Pilota data that app requests. These providers are not our subprocessors: you choose them, and they handle the data under their own terms (see section 4).
• Sentry — error monitoring and crash reporting (EU region).
• PostHog — cookieless product analytics (EU region).

The Google, Microsoft and Slack services are the sources you connect, governed by their own privacy policies. We may also disclose data if required by law or to protect the rights and safety of our users.

8. International transfers

Our primary account database and private file storage are in the EU. Our error-monitoring (Sentry) and product-analytics (PostHog) providers are configured to keep their data in the EU as well. Resend stores the purchase-confirmation and account-deletion emails it delivers in the United States. Other providers listed above — our AI providers, application host, and payment provider — also operate in the United States. Limited data described in sections 1 and 4, including task details, assistant messages, agent instructions, temporary voice recordings, opaque scheduled-run identifiers, and billing data, may be transferred outside the EEA. If you connect an AI app (section 4), Pilota sends the data that app requests to its provider, which may process it outside the EEA, including in the United States. This happens at your request, to provide the connection you asked for. We rely on the data-protection terms and transfer safeguards those providers offer, including Standard Contractual Clauses. If you would like details of the safeguards that apply to a specific provider, contact us at privacy@usepilota.com.

9. How long we keep your data

We keep your account data for as long as your account is active. Content fetched live from your connected tools is not retained, except for the limited OneNote, Google Drive, and OneDrive metadata caches described in section 1. We keep that metadata while its connection is active. OneNote page text and cloud-file bodies are not retained. A local PDF text extraction is kept while its source file is kept. A chat attached to a task is kept for as long as that task exists: delete the task and its chat is deleted with it. An uploaded file is kept while a task or chat still refers to it. Removing its final reference or deleting its final linked task or chat also deletes the stored file. A generated file stays in private Files while your account is active unless you delete it sooner. Files with an expiry date in Files are removed on that date unless you choose Keep in Files. A chat you start from a specific email, meeting, or message is kept until you delete it or disconnect the account it belongs to — it stores your conversation and a reference to the item, never the item’s contents. Agent instructions, run history, review records, and saved schedules are kept while your account is active. The permission you give an AI app is kept until you remove it or delete your account. A task or note keeps the name of the app that created it for as long as the item exists. Temporary scheduled-result delivery rows expire after 24 hours and are removed after successful delivery. Vercel Workflow event state for future scheduled runs contains opaque run identifiers and status values only and follows Vercel’s service retention controls. When you request account deletion, your account becomes unavailable and we retain its data for 30 days. After that date, final deletion starts. We remove the account and its files from our live systems after the required checks. Copies in backups may remain until those backups expire. You can cancel during the 30-day period by signing in and confirming that you want to keep the account. Early deletion requests are handled by email as described below.

Raw voice recordings are not saved to your Pilota account, database, or file storage. They remain available in browser memory only long enough to transcribe or retry the request and are cleared when transcription succeeds, you cancel, the request times out, or you leave the feature. The application and provider process the recording temporarily to return the transcript. The separate usage record contains operational metadata but no recording or transcript.

When account deletion becomes final, we remove the purchase confirmation email record and keep a minimal payment record. It contains the payment reference, purchase type, date, amount, currency, and tax. It has no Pilota account ID or email, but the payment reference can still identify a transaction in Stripe. We keep this de-identified record for five years after the end of the financial year in which you paid. Pilota’s financial year ends on 31 December. We then delete the record. We remove unused credits and credit usage history when account deletion becomes final. Stripe retains payment data under its own retention rules and privacy policy.

10. Your choices and rights

• Disconnect a tool — in Settings → Connections, at any time. We delete that account’s stored tokens, OneNote cache, cloud-file metadata, and sync state, and revoke Pilota’s access at the provider where the provider supports it (Google, Slack). If cleanup cannot finish, Settings shows a pending state and lets you retry. Microsoft does not offer a revocation endpoint, so although we delete our tokens and can no longer read anything, the authorisation remains listed in your Microsoft account until you remove Pilota there (Microsoft account → Privacy → App permissions).
• Remove an AI app’s access — in Settings → Connections → AI apps, at any time. The app can no longer read or change your Pilota data. Items it created stay in Pilota until you delete them. Pilota data that the app already read stays in your conversation with that app; remove it there with the app’s own controls.
• Delete your account — in Settings → Account. Here is what happens, step by step:
  • Right away: your account becomes unavailable, and we close billing. If closing billing fails, we retry hourly and show its status on the pending page.
  • For 30 days: we keep the account and its files, so you can change your mind. Sign in before the deletion date and choose Keep my account to restore the account and any unexpired credits. Existing credit expiry dates continue during this period. A closed subscription does not resume if you restore the account.
  • After 30 days: final deletion starts and finishes after the required checks. We then remove the account, its files, and unused credits from our live systems. Copies in backups may remain until those backups expire.
  • Connected accounts: we try to revoke Google and Slack access before erasure. If a provider does not confirm revocation after three attempts, we still erase your Pilota data; remove Pilota under that provider’s app permissions if access remains. Microsoft access may remain in your Microsoft account until you remove Pilota under Privacy → App permissions.
  • Payment records: we keep a minimal payment record without your Pilota account ID or email for five years after the end of the financial year in which you paid. Pilota’s financial year ends on 31 December. Stripe retains payment data under its own rules.
  • Before you go: you can download a data export from Settings before deletion becomes final. It includes your account data and links to private files that stay valid for one hour.
  • Sooner, if you prefer: to ask for earlier deletion, email hello@usepilota.com from your account email. We will verify your request and start deletion as soon as possible. Early deletion cannot be undone.
• Export your data — download an account data file from Settings. It includes your account data and links to private files that stay valid for one hour.

If you are in the EU/EEA or UK, you also have the right to access, correct, restrict, or object to the processing of your data, and to withdraw consent. Use the controls above, or simply write to us and we will help. You may also lodge a complaint with your local data protection authority.

11. Children

Pilota is not directed to children under 16 and we do not knowingly collect their data.

12. When this policy changes

We may update this policy as Pilota evolves. When we do, we change the “last updated” date above. For material changes, we tell you in the app or by email before they apply to you.

13. Contact

Questions or requests about your data are always welcome. Write to privacy@usepilota.com and we will get back to you. Data controller: Pilota ApS, CVR 46720776, Danneskiold-Samsøes Allé 41, 1434 Copenhagen K, Denmark.

Terms of Service