AI DevPilot Privacy Policy

What we collect

We only collect what we need to provide the service:

• Account details: your name, email address and sign-in information.
• Work you create on the platform: ideas, specifications, code, test results and the settings of your workspace and Apps.
• Consulting requests: the name, email, company and description you send through the Consulting form.
• Contract details when you sign a Consulting agreement: legal entity name, business or tax number, billing address and email, the signer's name and title, the typed signature, and the time and IP address of signing.
• Calendar access, only if a consultant connects their Google account (see below).
• Technical information such as browser type, error reports and usage logs, used to keep the service secure and working.

How we use it

To run your workspace and Apps, reply to Consulting requests, prepare and record contracts and invoices, schedule sessions, send service emails, keep the platform secure, and meet our legal and tax obligations. We do not sell personal information and we do not use it for advertising.

Google Calendar

Consultants can connect a Google account so that scheduling a session creates a Google Calendar event with a Google Meet link and invites the client and the consultant. We use this permission only to create the session event and to cancel it if the session is cancelled — nothing else. We do not read your existing calendar entries.

AI DevPilot's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect at any time in AI DevPilot or from your Google Account's third-party connections.

How we protect your information

We protect personal information, and especially the Google user data described above, with these safeguards:

• Encryption in transit: every connection to AI DevPilot, and between AI DevPilot and Google, uses HTTPS (TLS).
• Encryption at rest: data is stored with providers that encrypt it at rest.
• Google access is kept in an encrypted secrets vault: the long-lived Google authorisation token is stored only in an encrypted vault (Supabase Vault), never in your browser and never in ordinary database tables. Only AI DevPilot's server functions can read it, and only to create or cancel the events you schedule.
• Short-lived Google access tokens are held in memory for a single request and are never stored.
• Minimal Google data: for each session we keep only the event's ID, its Google Calendar link and its Google Meet link. We do not read, copy or store any other calendar entries.
• Access control: the database enforces row-level security, so the Google connection records can be read only by AI DevPilot's server, not by any user of the app. Administrator accounts are prompted to turn on two-step sign-in.
• Disconnecting removes access immediately: when you disconnect Google, we revoke the authorisation with Google and permanently delete the stored token from the vault.
• No secondary use: Google user data is never sold, never used for advertising, never used to train AI models, and is not read by people except with your consent, for security, or where the law requires it.
• If we become aware of a data breach that is likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

Who can see it

Consulting requests are visible only to AI DevPilot consultants. Engagement details are visible only to the client's own users and the consultants assigned to the engagement. We use trusted service providers to run the platform, who process data on our behalf:

• Supabase (database, sign-in and file storage)
• Cloud hosting: DigitalOcean, Amazon Web Services, Microsoft Azure and Google Cloud
• Resend (email delivery)
• Anthropic (AI processing of the work you ask the platform to do)
• Stripe (payments, where you subscribe to a paid plan)
• Google (Calendar and Meet, only when a consultant connects it)

Where it is stored and for how long

Some providers may store or process data outside Australia. We keep information for as long as you use the service and as long as needed for legal, tax and contract records (for example, signed contracts and invoices), and then delete it.

Your choices

You can ask to see, correct or delete your personal information, or ask a question about this policy, by emailing [email protected]. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

Changes

If we change this policy we will update this page and the date below.