Privacy Policy

1. Information we collect

• Account information — name, work email, organisation, role and authentication details.
• Content you provide — the notes, transcripts, documents and other material you upload or generate in the service (“Your Content”).
• Usage information — how you interact with the service, including server logs, device and browser data, and diagnostic information.
• Billing information — plan, billing contact and transaction records. Card details are handled entirely by our payment provider (Paystack) and are not stored by us.

2. How we use information

• To provide, secure and support the service, including generating and governing your documents.
• To operate accounts, process payments and manage subscriptions.
• To improve reliability, performance and features.
• To communicate with you about the service, and — only with your consent where required — about relevant updates.
• To comply with legal obligations and enforce our Terms.

3. Lawful basis (POPIA)

We process personal information where it is necessary to perform our contract with you, to pursue our legitimate business interests in a balanced way, to meet legal obligations, or where you have consented. You may withdraw consent at any time where processing is based on consent, by contacting us at info@processpilot.cloud.

4. AI processing and sub-processors

To provide AI features, Your Content may be processed by trusted third-party providers acting as our operators. We only share what is needed to deliver the service, under contractual data-protection obligations. Our sub-processors are:

• Anthropic (USA) — AI document generation and assistant features. Anthropic’s API terms confirm that API inputs and outputs are not used to train their models.
• Supabase / AWS (USA) — cloud database, authentication and file storage.
• Google and Microsoft (USA) — optional single sign-on, used only if you choose to sign in with your Google or Microsoft account.
• Vercel (USA) — application hosting and edge delivery.
• Paystack (Nigeria / South Africa) — payment processing. Card details are handled by Paystack; we do not store them.
• GoDaddy (USA) — transactional email delivery.

We do not sell your personal information, and we do not use Your Content to train AI models — our own or any third party’s — unless you explicitly opt in.

5. Automated decision-making

Process Pilot uses AI to generate, summarise and review documents at your request. This processing is a tool that assists you — it does not make decisions about you as a data subject. No automated decision with legal or similarly significant effect is made about any individual through the service. The AI assists you, and you remain responsible for reviewing and approving its output before you rely on or publish it.

6. Data retention

We keep personal information for as long as your account is active and as needed to provide the service. After account cancellation, we retain Your Content for 30 days so you can export it, then delete it except where retention is required to meet legal, accounting or security obligations. You can request earlier deletion of Your Content by contacting us.

7. Security

We use appropriate technical and organisational measures to protect personal information, including role-based access controls, tenant isolation between organisations, encryption of data in transit, and row-level security policies in our database. No system is perfectly secure, but we work to protect your information and to respond promptly to incidents.

8. Your rights

Subject to applicable law, you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete personal information.
• Request deletion of your personal information.
• Object to or restrict certain processing.
• Lodge a complaint with a supervisory authority.

Under POPIA you may also lodge a complaint with the Information Regulator of South Africa. To exercise your rights, contact us at info@processpilot.cloud.

9. International transfers

Some of our sub-processors process data in the United States (see section 4). Where personal information is transferred outside South Africa, we take steps to ensure an adequate level of protection consistent with POPIA, including contractual safeguards with each provider.

10. Cookies and similar technologies

We use only essential cookies and similar technologies that are strictly necessary to operate the service:

• Authentication cookies — set by our authentication provider (Supabase) to keep you signed in securely across pages.
• Organisation preference — a cookie that remembers which organisation you last selected, so you return to the right workspace.
• Theme preference — stored in your browser’s local storage (not a cookie) to remember your light or dark display choice.

We do not use analytics cookies, advertising cookies, or any third-party tracking. Because we use only essential cookies that are strictly necessary for the service to function, we do not require your consent for these cookies under POPIA or ECTA. If we introduce non-essential cookies in the future, we will ask for your consent before setting them.

11. Children

The service is not directed at children under 18 and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time and will post the updated version on this page with a revised date. If we make material changes, we will notify you by email or through the service.

13. Contact and Information Officer

For privacy questions, data subject requests, or to contact our Information Officer:

• Information Officer: Graham Jones
• Email: info@processpilot.cloud
• Optimise Solutions (Pty) Ltd, registration number 2026/817424/07
• 19 Aberfoyle Road, Nottingham Road, KwaZulu-Natal, South Africa