Privacy Policy

1. Who we are

BusinessPilot AI ("we", "us") is an AI finance copilot for companies doing business across borders: invoicing, compliance-ready document exports, contract analysis and natural-language interaction with financial data. BusinessPilot AI is operated from Dubai, UAE.

For any privacy question or request, contact us at support@pilotengine.ai. We aim to respond within 2 business days.

2. Data we collect

Account data: name, email address and authentication identifiers when you create an account, including through Google sign-in.

Workspace data: the business information you enter — customers, products, invoices, payments, contracts and related documents — plus usage data such as AI credit consumption and document volumes.

Stripe app data: if you install the BusinessPilot AI app from the Stripe App Marketplace, we receive the identifiers needed to operate the connection (your Stripe account ID), an OAuth access token and refresh token, and the invoice and customer data required to convert your finalized Stripe invoices into compliant documents.

Technical data: standard logs (IP address, browser type, timestamps) used for security, debugging and abuse prevention.

3. How we use your data

To provide the service: generate invoices and compliant export documents, run AI analyses you request, and operate your workspace.

To meter and bill usage: count AI credits and exported documents so plans and per-invoice partner billing work correctly.

To secure the platform: audit logs, fraud prevention and access control.

We do not sell your data. We do not use your workspace or invoice data to train AI models.

4. Stripe connection data

When you connect your Stripe account, your OAuth access and refresh tokens are stored encrypted on our servers and are never exposed to the browser, to other users, or to third parties. Only our backend uses them, and only to read the invoice, customer and account data covered by the permissions you granted.

Each finalized Stripe invoice is processed exactly once. We store the resulting compliant document and a reference to the Stripe invoice ID for deduplication and audit purposes.

If you uninstall the app or revoke access from your Stripe Dashboard, Stripe notifies us and we immediately mark the connection as revoked. You can also disconnect at any time from the partner console; this revokes the grant with Stripe and stops all further processing.

You may request deletion of your stored Stripe connection data at any time by contacting us.

5. AI processing

AI features (copilot answers, contract and invoice analysis) process the content you submit through vetted AI infrastructure providers, solely to produce the answer or analysis you requested. Prompts and results are tied to your workspace and subject to the same access controls as the rest of your data.

6. Subprocessors and hosting

We host the platform on managed cloud infrastructure (database, authentication and file storage) and use AI inference providers to power AI features. Data may be processed in the regions where those providers operate. We only work with providers that offer appropriate contractual and technical safeguards.

7. Retention

We keep your account and workspace data for as long as your account is active. Audit and billing records are kept for the periods required by applicable accounting and tax rules. When you delete your account or request deletion, we delete or anonymize personal data within 30 days, except where a longer retention is legally required.

8. Your rights

Depending on your jurisdiction, you may have the right to access, correct, export or delete your personal data, and to object to or restrict certain processing.

To exercise any of these rights, email support@pilotengine.ai from the address linked to your account. Workspace administrators can export their invoices and documents directly from the product at any time.

9. Security

Access to workspace data is enforced by row-level security on the database, role-based access control inside each workspace, and encrypted transport (TLS) everywhere. Credentials and third-party tokens are stored server-side only, never in the browser.

10. Changes to this policy

If we make material changes to this policy, we will update the date below and, where appropriate, notify you in the product or by email.