Privacy Policy

1. Introduction

Welcome to CorePylot ("we," "our," or "us"), operated by CorePylot. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, and share your information when you use our AI-powered platform.

2. Information We Collect

2.1 Information You Provide

We collect information that you voluntarily provide, including:

• Account registration details (name, email address, company name)
• Google sign-in data if you authenticate via Google
• Email-integration credentials when you connect email accounts
• Configuration data for AI agents and knowledge bases
• Payment information processed through our payment processors (Fapshi and NOWPayments)

2.2 Automatically Collected Information

When you use CorePylot, we automatically collect certain information, including:

• Device and browser information (IP address, browser type, operating system)
• Usage data (pages visited, features used, time spent)
• Conversation data from interactions with AI agents
• Cross-agent memory used to maintain context across sessions
• Webchat visitor data from end-user interactions with your deployed agents

2.3 Third-Party Data

We may receive information from third-party services you connect to CorePylot, such as Telegram, WhatsApp, or other messaging platforms.

3. How We Use Your Information

We use the collected information for various purposes:

• Provide, maintain, and improve our services
• Process transactions and send related information
• Send administrative information, updates, and security alerts
• Respond to customer support requests
• Generate analytics and insights about platform usage
• Detect, prevent, and address technical issues or fraud
• Comply with legal obligations
• Personalize your experience and provide relevant content

4. Data Sharing and Disclosure

4.1 Service Providers

We may share your information with third-party service providers who perform services on our behalf, including:

• AI providers that process conversation data on our behalf (these providers operate under zero-retention policies and do not train on customer data)
• Payment processors (Fapshi and NOWPayments) for transaction processing
• Cloud hosting and infrastructure providers

4.2 Legal Requirements

We may disclose your information if required by law or in response to valid legal requests from public authorities.

4.3 Business Transfers

In connection with any merger, sale of company assets, financing, or acquisition, your information may be transferred to the acquiring entity.

5. Social Media and Messaging Integrations (Meta, WhatsApp, TikTok and LinkedIn)

CorePylot lets you connect social media and messaging accounts so you can publish content and talk to your audience from one place. When you connect a Meta, WhatsApp, TikTok or LinkedIn account, you authorize us to access it only as described in this section. We never see or store your passwords; you sign in on the platform directly.

Meta (Facebook, Instagram, Messenger and Threads)

If you connect a Facebook Page, an Instagram professional account or Threads, with your permission we access the following through Meta's APIs:

• Your Page, Instagram or Threads profile: name, username, profile picture and account identifier
• The ability to publish posts you create in CorePylot to your Page or account, and to delete posts you ask us to delete
• Comments on your posts, and messages sent to your Page or Instagram account (Messenger and Instagram Direct), delivered to us by Meta so your team or the AI agent you configure can read and answer them
• The ability to reply to comments, hide comments, and send replies and direct messages on your behalf, only within the rules Meta sets, including its 24-hour messaging window
• Follower counts and post performance statistics (such as reach, likes, comments and shares) for your own accounts

We use this information only to provide these features to you. The text of comments and messages is processed by the AI services described in this policy to draft or send replies that you have turned on. We do not sell data we receive from Meta, use it for advertising, or share it with third parties, and we handle it in line with the Meta Platform Terms. Your use of Facebook, Instagram, Messenger and Threads is also governed by Meta's Terms and Privacy Policy.

WhatsApp

If you connect a WhatsApp Business account, with your permission we access the following through the WhatsApp Business Platform, which is provided by Meta:

• Your WhatsApp Business account details: business name, phone number and account identifier
• Messages that people send to your WhatsApp number, with their phone number and name as shown on WhatsApp, and message delivery statuses
• The ability to send replies from your number, and, if you choose to use them, message templates and campaign messages to people who have agreed to receive them

We use this information only to provide conversations, the replies you or the AI agent you configure send, and campaigns you create. We only send campaign messages to people who have opted in, as the WhatsApp Business Messaging Policy requires. We do not sell this data, use it for advertising, or share it with third parties. Your use of WhatsApp is also governed by the WhatsApp Business Terms of Service and Privacy Policy.

TikTok

If you connect TikTok, with your permission we access the following through TikTok's APIs:

• Your TikTok profile: display name, username and profile picture (user.info.basic, user.info.profile)
• Your follower count (user.info.stats)
• Your published videos and their view, like, comment and share counts (video.list)
• The ability to post videos you create in CorePylot to your account (video.publish), only when you choose to publish or schedule them

We use this information only to show your connected account, publish the videos you choose, and show you the performance of your own videos. We do not sell it, use it for advertising, or share it with third parties. Your use of TikTok is also governed by TikTok's Terms of Service and Privacy Policy.

LinkedIn

If you connect LinkedIn, with your permission we access the following through LinkedIn's APIs:

• Your name, profile picture and LinkedIn member identifier (openid, profile)
• The ability to publish posts you create in CorePylot to your profile (w_member_social), or to a Company Page you administer (w_organization_social), and to see which Company Pages you administer so you can choose one (r_organization_admin), only when you choose

We use this information only to show your connected account and publish the posts you choose. We do not sell it, use it for advertising, or share it with third parties. Your use of LinkedIn is also governed by the LinkedIn User Agreement and Privacy Policy.

How we store and remove this data

Access tokens for these accounts are encrypted before they are stored. You can disconnect a Meta, WhatsApp, TikTok or LinkedIn account at any time in CorePylot, which deletes the stored tokens, or revoke CorePylot's access in the platform's own settings, which stops our access immediately. To ask us to delete other data we hold from these platforms, including stored comments and messages, contact us using the details below.

6. Data Security

We take reasonable steps to protect your personal information, including:

• Encryption of data in transit and at rest
• Access controls and authentication mechanisms

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

7. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy. Backups are deleted after one week. Certain information, such as billing and tax records, may be retained longer as required by applicable law.

8. Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal information
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your personal information
• Objection: Object to processing of your information
• Portability: Request transfer of your data to another service
• Withdraw Consent: Withdraw consent for data processing

To exercise these rights, including deletion and data export, send a verified request to info.corepylot@coreopslab.com. We will respond to verified requests in accordance with applicable law.

9. Cookies and Tracking Technologies

We use cookies and similar technologies to maintain your session and remember preferences. You can configure your browser to reject cookies, though some platform features may not function properly as a result.

10. Children's Privacy

CorePylot is not intended for use by children under the age of 18. We do not knowingly collect personal information from children under 18.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. When we transfer your information, we take steps to ensure appropriate safeguards are in place.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

13. Contact Us

If you have any questions about this Privacy Policy, contact us at info.corepylot@coreopslab.com.