Privacy Policy

1. Controller

The controller is Jan Meier, Hulmenweg 82, 8352 Ricketwil (Winterthur), Switzerland, email: jan.hulmenhof@hotmail.com, phone: 079 413 13 63.

2. Data processed

• Account and company profile: email address, authentication data, company, contact, layout, and optional payment details, as well as logo and signature.
• Documents: content, line items, prices, and the contact and address data of your recipients; status of sending, approval, and signature.
• Communication: details from contact, demo, and support requests, as well as sent email metadata.
• Payment: product, amount, subscription, and transaction identifiers. Full card and bank details are processed by Stripe; OfferPilot does not store them.
• Usage and security: technical logs, timestamps, truncated or hashed network identifiers, error messages, and usage limits. This includes anonymised visitor statistics (page visited, timestamp, referrer) without cookies: a hashed network identifier roughly distinguishes returning from new visits, without identifying individual people.
• Origin of the visit: campaign parameters from links visited, in particular UTM source, medium, campaign, search term, and content. This information is temporarily stored in the browser during the visit and may be linked to the relevant record upon registration or a contact request.
• AI inputs: your instructions and the profile and document data required for the requested output.

3. Purposes and legal bases

We process data to provide accounts and documents, run AI features, send emails, process payments and subscriptions, respond to inquiries, and prevent abuse and attacks. We use campaign parameters to identify which advertising or referral brings inquiries and registrations to OfferPilot. The basis is the performance and preparation of your contract, legal obligations, your consent where required, and legitimate interests in a secure and functioning service. You can withdraw consent for the future at any time.

4. Service providers and recipients

• Supabase: database, private file storage, and account management. Passwords are managed by the authentication service as protected verification data and are not made available to OfferPilot in plain text.
• Netlify: hosting, delivery, and technical logs.
• Stripe: payment processing, fraud prevention, and customer portal.
• Resend and/or Google (Gmail): sending of transactional emails, depending on technical configuration via one provider or the other; marketing emails only with separate consent (opt-in) and with an unsubscribe option in every email.
• OpenAI and Anthropic: AI processing. Depending on the feature, inputs and necessary profile or document content are transmitted to the respective API service.

These providers may only process data for their respective task, unless their own legal obligations require otherwise. Personal data is not sold. If a provider changes, this policy will be updated.

5. Processing abroad

Depending on the configured region and sub-processor, data may be processed in or accessible from Switzerland, the European Economic Area, and the United States. For transfers to countries without an adequate level of data protection, we use, where required, recognised standard contractual clauses, contractual protection obligations, or an applicable adequacy mechanism. The current location and sub-processor information of the services named above should additionally be observed.

6. Retention period

Account, profile, and document data remain stored for as long as the account is in use. After a confirmed account deletion, active data is generally deleted or anonymised within 30 days; backup copies are generally overwritten within a further 90 days as part of the regular cycle. Contact, demo, and support requests are generally kept for at most 24 months after completion. Submitted UTM data follows the retention period of the associated request or account; pure session data in the browser ends with the browser session. Technical security and error logs, as well as the anonymised visitor statistics, are generally kept for at most 90 days, and in the event of a security incident until it is resolved and any necessary evidentiary periods have elapsed. Payment, contract, and accounting records are retained in accordance with statutory retention obligations, typically ten years. Legal obligations, legal claims, or ongoing proceedings may require longer retention in individual cases.

7. Data security

OfferPilot uses transport encryption, access-restricted accounts, and private file areas for logos and signatures. Access is restricted by role. However, no internet service can guarantee absolute protection. In the event of a relevant security incident, affected individuals and authorities will be informed in accordance with statutory requirements.

8. Cookies and local storage

No analytics or marketing cookies are used. Technically necessary cookies store the login and security state. Without them, protected account areas do not function. A consent button is not required for these necessary cookies.

OfferPilot additionally stores a few settings only locally in the browser (local storage, no cookies, no transmission to OfferPilot or third parties): display settings such as font size and theme, whether the introductory tour has already been seen, and a time counter that only shows the review prompt after extended active use. This information never leaves your device.

9. Your rights

Within the statutory scope, you can request information, correction, deletion, restriction, objection, or the release of your data, and withdraw consent. Please write to jan.hulmenhof@hotmail.com. You can also file a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC). The rights of other individuals and statutory retention obligations remain reserved.

10. Data of your own customers

If you enter your customers’ data into OfferPilot, you are responsible for its lawful collection and the necessary notification. OfferPilot processes this data to provide the service on your behalf. Further details are in section 8 of the Terms of Service and in the Data Processing Agreement.

11. Changes

This policy will be adjusted whenever processing activities, providers, or the legal situation change. In the event of material changes, we will inform you appropriately via the website or by email.