SecurePilot Back

Privacy Policy

Last updated: July 2026

This Privacy Policy explains how SecurePilot ("we") collects, uses, and protects personal information when you use our platform. We built SecurePilot for consultants who help their own clients with privacy and security compliance, so we hold ourselves to the same standards we help you meet.

1. Information We Collect

  • Account information: name, email address, and authentication data when you sign up.
  • Client data you enter: company profiles, security questionnaire answers, and domains you scan on behalf of your own clients.
  • Billing information: handled directly by Stripe — we do not store your card details.
  • Usage data: basic product analytics and error logs to keep the Service reliable.

2. How We Use Information

We use collected information to operate and improve the Service, generate the documents and scans you request, process payments, communicate with you about your account, and comply with legal obligations.

3. Third-Party Service Providers

We rely on the following processors to operate the Service: Supabase (database, authentication, hosting of your data), Vercel (application hosting), Anthropic (AI generation of policy documents), Stripe (payment processing), and Have I Been Pwned / VirusTotal (public breach and reputation lookups performed against the domain you scan). Each provider only receives the data necessary to perform its function.

4. Data Storage & Security

Data is stored in a Supabase-managed PostgreSQL database with row-level security enforced so that each account can only access its own data. We use encrypted connections (HTTPS/TLS) throughout the Service.

5. Data Retention

We retain your account data for as long as your account is active. If you delete your account, associated data is removed within a reasonable period, except where retention is required for legal, tax, or dispute-resolution purposes.

6. Your Rights

Depending on your location, you may have rights under Quebec's Act respecting the protection of personal information in the private sector (Law 25), Canada's PIPEDA, or the EU/UK GDPR — including the right to access, correct, or request deletion of your personal information, and to withdraw consent. To exercise these rights, contact us using the details in your account.

7. Cookies & Local Storage

We use essential cookies for authentication (via Supabase) and local storage to remember your language preference. We do not use third-party advertising trackers.

8. AI-Generated Content

Questionnaire answers and company profile details you provide are sent to our AI provider (Anthropic) solely to generate your requested documents. This data is not used by SecurePilot to train AI models.

9. Children's Privacy

The Service is intended for business use and is not directed at children. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service.

11. Contact

For privacy-related questions or requests, contact us using the support address listed in your account.