Privacy policy
Last updated: 14 October 2026 · DRAFT, to be confirmed by our legal adviser
This policy explains how OwnersPilot handles personal information. We serve customers worldwide, so it is written to meet the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act as amended by the CPRA (CCPA), and South Africa's Protection of Personal Information Act (POPIA). Where local law gives you more rights, those rights apply.
1. Who we are (controller / responsible party)
OwnersPilot is a trading name of OakTek (Pty) Ltd, a company registered in South Africa (registration number: [to be inserted], address: [to be inserted]). We are the "controller" under the GDPR, the "business" under the CCPA and the "responsible party" under POPIA.
Privacy contact / Information Officer: [name to be inserted], privacy@ownerspilot.com.
EU/UK representative (GDPR Art. 27 / UK GDPR): [to be appointed if required].
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Identifiers and contact details | Email address, first name (optional) | You (quiz, newsletter, checkout) |
| Business information | Industry, team size, country (optional), quiz answers about time-wasters, tools and goals | You (quiz) |
| Commercial information | Products bought, subscription status, country, tax details | Our merchant of record |
| Usage data | Aggregate, cookie-free page analytics; technical logs (IP address kept briefly for security) | Automatically |
Please don't enter client names, health information or other sensitive details in the quiz. We don't knowingly collect sensitive or special-category data, and we never collect full card details.
3. Why we use it and our legal bases (GDPR)
- To generate and send your AI plan: performance of a contract, or steps you asked for before one (Art. 6(1)(b)).
- Newsletter and marketing emails: your consent (Art. 6(1)(a); POPIA s69; ePrivacy/PECR). You can withdraw it at any time with the unsubscribe link in every email.
- Purchases, support, refunds: contract (Art. 6(1)(b)).
- Tax, accounting and legal duties: legal obligation (Art. 6(1)(c)).
- Security, fraud prevention and improving our service with aggregate data: legitimate interests (Art. 6(1)(f)).
4. AI processing
Your quiz answers (not your email address or name) are sent to Google's Gemini API to write your plan. While we use Google's free tier, Google may use submitted content to improve its products, which is why we ask you not to include personal or confidential details. We'll move to a paid tier that excludes training as soon as practical. No decisions with legal or similarly significant effects are made about you by automated means.
5. Who we share it with (processors / operators / service providers)
Cloudflare (hosting and serverless functions), Google (AI plan generation), Kit (email list), Resend (transactional email), Verpex (our business mailbox) and our merchant of record (Lemon Squeezy or equivalent), which processes payments and taxes. Each acts under a contract that limits use of your data. We do not sell or "share" your personal information for cross-context behavioural advertising, as those terms are defined in the CCPA. We have not done so in the past 12 months.
6. International transfers
We're based in South Africa and our providers are mainly in the USA and EU, so your information may be processed outside your country. For transfers from the EU/UK we rely on adequacy decisions (including the EU–US Data Privacy Framework where the provider is certified) or Standard Contractual Clauses. For transfers from South Africa we rely on POPIA s72.
7. Retention
Quiz plans: up to 12 months. Subscriber data: until you unsubscribe, plus 30 days. Purchase and tax records: 5 to 7 years, as the law requires. Security logs: up to 30 days.
8. Your rights
- Everyone: access, correction, deletion, withdrawing consent and unsubscribing from marketing at any time.
- EU/UK (GDPR): also restriction, objection (including to direct marketing), data portability, and the right to complain to your local data protection authority (UK: the ICO).
- California (CCPA/CPRA): the right to know, delete and correct; to opt out of sale or sharing (we don't sell or share); to limit use of sensitive information (we don't collect it); and not to be discriminated against for using these rights. You may use an authorised agent. We honour Global Privacy Control signals.
- South Africa (POPIA): also objection, and complaints to the Information Regulator (inforegulator.org.za).
Email privacy@ownerspilot.com. We'll verify your request and reply within 30 days (GDPR/POPIA) or 45 days (CCPA).
9. Cookies
We don't use advertising or tracking cookies. Our analytics (Cloudflare Web Analytics) are cookie-free. If that changes, we'll ask for consent first where the law requires it.
10. Security
We use HTTPS everywhere, least-privilege access and reputable providers. If a breach is likely to affect you, we'll notify you and the relevant regulators as the law requires.
11. Children
Our services are for business owners aged 18 and over. We don't knowingly collect children's data.
12. Changes
We'll post any changes on this page and, if they're significant, email subscribers.