Privacy Policy

BusinessPilotOS is operated by PAPPLE WORLD FZE LLC, Ras Al Khaimah, United Arab Emirates. In this policy, "we" means that company. You can reach us at support@businesspilotos.com.

For the account details of people who sign up, we decide why and how the data is used. For the business records a customer enters into a workspace (their own customers, jobs, invoices and so on), we act on that customer's behalf, and the customer decides what goes in.

Account details you give us when you sign up:

• your name and email address
• your business name
• your password, which we keep only as a one-way bcrypt hash, never in readable form

Business records you or your team enter into your workspace, such as customers, leads, quotes, bookings, jobs, invoices, payments, expenses, tasks, tickets and time entries. They may include personal details of your own customers and staff, such as names, emails, phone numbers and addresses.

An audit log of changes made in your workspace: who did what, to which record and when. For some actions, such as deleting an AI business-memory note, the log keeps a copy of what was removed.

AI Copilot history, if the Copilot is used: the question, the answer, the error if there was one, the model used and token counts, kept so that usage limits and support work.

Sign-in protection counters: to slow down password guessing we count recent sign-in and sign-up attempts per email address and per network address. The keys are stored as hashes, not as readable emails or IP addresses, and each counter covers a short window.

Basic technical data our hosting provider handles to serve the service, such as IP address, browser type and request logs.

Messages you send us by email.

The public website does not run advertising or analytics trackers, and we do not sell personal data. We do not use your business records to train our own models. The product does not currently send automatic emails or messages to your customers.

• Provide, secure and support the service you signed up for
• Keep each business's records separate from every other business's records
• Keep the audit log and protect sign-in against abuse
• Reply to your questions and tell you about important changes to your account or these policies
• Investigate abuse, errors and security problems

We do not send marketing email unless you have asked for it.

We use only the cookies the sign-in system needs to keep you signed in safely. The public pages, free tools and demo do not need an account, and the free tools run in your browser, so what you type into them is not sent to us. Details are in our Cookie Policy.

We use a small number of providers to run the service. They process data only to provide their service to us:

• Vercel: Hosting and delivery of the website and application. Always.
• Supabase: Managed PostgreSQL database that stores workspace records. Always.
• Google (Google Maps): Shows a map where a page displays an address, for example the Contact page. Only on pages that show a map.
• Anthropic: Produces answers for the optional AI Copilot. Only if the AI Copilot has been enabled on the service, and only when a member uses it.

The full list, with the data each one receives, is on our Subprocessors page. We may also disclose information if the law requires it, or to protect the rights, safety or security of our users or the service.

The AI Copilot is optional and is available only if it has been enabled on the service. When a member asks it a question, we send Anthropic the question and recent turns of that conversation, together with a summary of your organisation drawn from your own records: its name and currency, summary figures, calculated insights and the notes in your business memory. Anthropic returns the answer. Its handling of that data is governed by its own terms and privacy policy. The Copilot only reads; it does not change records or contact anyone.

Our providers may store and process data in countries other than your own. We choose providers that protect data with reasonable technical and organisational safeguards, and we will describe the main storage location for account data on request.

We keep account and workspace data for as long as your account is active. Invoices and payments are voided rather than deleted inside the product, so your financial history stays intact. When you ask us to delete your account or specific personal data, we will delete it or make it anonymous, except where we must keep something to meet a legal duty or to protect the integrity of financial and audit records. Sign-in protection counters expire on their own within their short windows.

Access to each workspace is limited to its members and checked on the server for every request, with permissions based on each person's role. Passwords are hashed, sign-in attempts are rate-limited, and connections use HTTPS. No online service can promise perfect security, so please use a strong, unique password and tell us straight away if you suspect your account has been misused. If we learn of a personal data breach that affects your account, we will tell you without undue delay. See our Security page for more.

If you put your own customers' or staff's personal data into BusinessPilotOS, you decide what to enter and why, and you are responsible for having a lawful basis for doing so and for telling those people how you use their data. We process that data on your behalf to provide the service. If you need a data processing agreement, email us.

You can ask us to access, correct, export or delete personal data we hold about you, or object to how we use it, by emailing support@businesspilotos.com. We may need to confirm who you are first. If data protection law such as the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) or the EU or UK GDPR applies to you, you may have further rights, including the right to complain to your data protection authority. We will respond within a reasonable time. If your data sits in another business's workspace, we may refer you to that business, which decides how its records are used.

The service is for businesses and is not directed at children. Do not create an account if you are under 18.

We may update this policy. The date at the top shows when it last changed. If a change is significant we will tell account holders by email or inside the product.

PAPPLE WORLD FZE LLC, Ras Al Khaimah, United Arab Emirates. Email: support@businesspilotos.com.