Privacy Policy

1. Who We Are

ColdPilot, Inc. is a cold email outreach platform. For data protection purposes:

• When you send outreach campaigns through our platform, you are the Data Controller and we act as a Data Processor on your behalf for the recipient data you upload or process.
• When we collect and process data for our own business operations, analytics, compliance, and marketing, we act as a Data Controller.
• If you are a recipient of an email sent through ColdPilot, your primary relationship is with the sender who contacted you. Please review that sender's privacy policy for information about their data practices. We process recipient data only as necessary to provide email delivery, reply detection, and deliverability services to our Users.

2. Personal Data We Collect

The personal data we collect depends on how you interact with us and the capacity in which you engage with our Services.

2.1 Account and Billing Data (Collected Directly)

• Identity: name, email address, and password (stored as a secure hash).
• Contact: email address used for login, notifications, and support.
• Billing: payment card details handled by our PCI-DSS compliant payment processor. We store only a tokenized reference, never full card numbers.
• Connected inboxes: credentials or OAuth access tokens for the email accounts you connect (Gmail, Outlook, or SMTP). Passwords for SMTP accounts are never stored in plaintext.
• Preferences: sending schedules, warm-up settings, rotation settings, and feature configurations.
• Communications: support requests and correspondence.

2.2 Campaign and Recipient Data (You Provide)

• Recipient data: email addresses and any other fields you import (e.g., first names, company names) for your outreach lists.
• Campaign content: email sequences, subject lines, templates, and AI-generation prompts you write.
• Reply data: replies your connected inboxes receive, used for reply detection and thread tracking.

2.3 Data Collected Automatically

• Log data: IP address, browser type, operating system, pages viewed, API requests, and error logs.
• Analytics: session duration, feature interactions, dashboard engagement, and performance metrics.
• Cookies: see Section 8 below.

2.4 Data from Third Parties

• Email verification providers: validity status and reason for email addresses you ask us to verify.
• OAuth providers: account identifiers and granted scopes when you connect Gmail, Outlook, or Google Workspace accounts.

3. How We Use Personal Data

We use personal data for the following purposes:

• Providing and operating the Services: sending your campaigns, warm-up, rotation, reply detection, verification, and analytics.
• Onboarding and account management: creating accounts, authenticating users, and managing connected inboxes.
• Billing: invoicing, collecting payments, and managing subscriptions.
• Security, fraud prevention, and compliance: detecting unauthorized access, enforcing our Acceptable Use Policy, and meeting legal obligations.
• Improving the Services: analyzing usage patterns, developing features, and conducting research.
• Communications: transactional emails (confirmations, notifications, alerts), product updates, and responding to support requests.
• Legal and business purposes: resolving disputes, enforcing agreements, and facilitating business transactions.

4. Legal Bases for Processing

We process personal data on the following legal bases, depending on the purpose:

• Contract: processing necessary to provide the Services you requested, including account management, sending campaigns, and billing.
• Legitimate interests: security, fraud prevention, product improvement, and direct marketing, balanced against your rights and interests.
• Legal obligation: compliance with applicable laws, such as anti-spam and record-keeping requirements.
• Consent: where required (for example, optional marketing communications), which you may withdraw at any time.

5. How We Share Personal Data

We do not sell personal data. We do not share data with third parties for their own marketing purposes. We share data only as described below.

• Email delivery and infrastructure providers: we share necessary recipient and message data with service providers that deliver your emails on our behalf. These parties process data for us under written agreements.
• Payment processors: we share necessary billing data to process payments and subscriptions.
• Verification and analytics services: we share data with providers that verify email addresses or help us understand platform usage.
• Legal and regulatory authorities: where required by law, court order, or valid legal process.
• Business transfers: in connection with a merger, acquisition, financing, or sale of our business, with notice to affected parties as required by law.
• Protection of rights and safety: where necessary to prevent fraud, protect platform security, or protect the rights and safety of ColdPilot, our Users, or the public.

6. Use of Google Gmail Data

ColdPilot's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

When you connect a Gmail inbox through Google OAuth, we access your Gmail account solely to perform the functions you request: sending outreach emails on your behalf and reading replies and threads to detect responses and keep your campaign conversations accurate. This access is limited to the minimum scopes required (send, read, and modify your own Gmail messages and threads).

Specifically, we may read and write to your Gmail messages and threads for the purpose of sending, tracking, and mirroring your outreach conversations. We do not read the full content of unrelated messages for advertising or other unrelated purposes. We do not sell Gmail data or transfer it to third parties except as necessary to operate the service (e.g., storing it on our encrypted servers) or as required by law.

Gmail data is used only for providing and improving the ColdPilot service. You can disconnect your Gmail account at any time from your dashboard. Data may be retained while your account is active or as required for legal and security purposes, and is deleted when you close your account or remove the connected mailbox.

7. Data Retention

We retain personal data for as long as necessary to fulfil the purposes described in this policy and to comply with our legal obligations. Key retention periods include:

• Account data: for the duration of your active account and a reasonable period thereafter for legal and operational purposes.
• Campaign and recipient data: for the duration of your account or until you delete them from your dashboard, subject to legal retention requirements.
• Billing records: as required by applicable tax and accounting law.
• Log and analytics data:for a limited period (typically 30–90 days) unless retained for security investigations.
• Marketing data: until you opt out or request deletion.

Upon expiration of applicable retention periods, we will securely delete or anonymize your data.

8. Cookies and Tracking Technologies

We use cookies and similar technologies (pixel tags, web beacons, local storage) on our website and dashboard for the following purposes:

• Essential cookies: required for platform functionality, authentication, and security. These cannot be disabled without affecting the Services.
• Functional cookies: remember your preferences and settings across sessions.
• Analytics cookies: help us understand how visitors and Users use our platform.
• Security cookies: used for fraud detection and protection against unauthorized access.

You can manage cookie preferences through your browser settings. Disabling essential cookies may affect platform functionality.

9. Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. Our security measures include:

• Encryption of data in transit (TLS) and at rest.
• Access controls limiting data access to personnel who require it for their role.
• Secure credential storage for connected email accounts.
• Regular security assessments and incident response procedures.
• Two-factor authentication where supported.

No method of transmission over the Internet or electronic storage is 100% secure, but we work to protect your data.

10. International Data Transfers

ColdPilot is headquartered in Nigeria. In the course of providing our Services, personal data may be transferred to and processed in other countries where our infrastructure, email delivery, and service providers are located. Where required, these transfers rely on contractual safeguards, including standard contractual clauses, or other approved transfer mechanisms.

11. Your Rights

Subject to applicable law, you have the following rights in relation to your personal data:

• Right to access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to deletion: request erasure of your data, subject to legal retention obligations.
• Right to data portability: request your data in a structured, machine-readable format.
• Right to object: object to certain processing activities, including direct marketing.
• Right to restriction: request that we restrict processing in certain circumstances.
• Right to withdraw consent: where processing is consent-based, withdraw it at any time without affecting the lawfulness of prior processing.
• Right to complain: lodge a complaint with your local data protection authority.

Contact us at [email protected] to exercise these rights. We will respond within 30 days. We may need to verify your identity before processing your request.

12. Children's Privacy

Our Services are directed to businesses and are not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us immediately at [email protected] and we will take prompt steps to delete it.

13. Third-Party Sites and Services

Our platform may contain links to third-party websites or integrations. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you access through our platform.

14. Changes to This Policy

We may update this Privacy Policy from time to time as our Services evolve or as required by law. When we make material changes, we will notify you by email or by posting a prominent notice on our website. The effective date at the top of this document reflects the date of the most recent revision. Your continued use of the Services after changes are posted constitutes your acceptance of the updated policy.

15. Contact Us

If you have questions about this Privacy Policy or the way we handle your data, contact us at [email protected].