Privacy Policy
Last updated: 14 October 2026
On this page
1. Who we are
This policy covers the CopyPiloting website and client platform, run by Darini Rocha, trading as CopyPiloting, Tallinn, Estonia ("we", "us"). Questions about it go to copypiloting@gmail.com. We follow the EU General Data Protection Regulation (GDPR) when we handle personal data.
For your own account details and application, we decide how the data is used. For business information and content you put into the platform that may include other people's details (for example a customer's name inside a story or quote), we handle it on your instructions to provide the service, and we will sign a data processing agreement on request.
2. What we collect and why
| What | Examples | Why we use it |
|---|---|---|
| Application details | Business name, website, about and services page addresses, your name, email, optional phone and notes | To review your application and reply to you |
| Account details | Name, email, password (stored only as a protected hash by our login provider), role, sign-in times | To let you sign in and to keep your account secure |
| Business profile | Services, customers, voice and style notes, banned words and topics, key pages, call to action | To plan and write articles that sound like your business |
| Voice recordings and transcripts | Your spoken answers to the onboarding questions, and the text made from them | To fill in your business profile so articles sound like your business |
| Your content | Quotes, stories, credentials, writing examples, documents and files you upload, keywords you submit | To use in your articles and to share files with our team |
| Articles and activity | Drafts, edits, approvals, change requests, calendar choices, publishing days, plan limits | To deliver the service and show you what is happening |
| Records of changes | Who changed what and when, for approvals, role changes, limit changes and calendar moves | To keep the service accountable and to investigate problems |
| Anti-spam data | A one-way scrambled form of your internet address when you send an application (we do not store the address itself), and the time | To stop automated and repeated submissions |
| Support messages | What you write in help and request forms | To answer you |
We do not knowingly collect data from anyone under 18, and the service is for businesses.
Under the GDPR we need a legal basis for each use. We rely on: contract, to review your application and provide the service you ask for; legitimate interests, to keep the platform secure, prevent spam and keep records of changes; legal obligation, for example accounting records; and consent only where we ask for it separately, for example before you record your voice. Voice onboarding is optional, and we ask for your consent before you record. You can withdraw it at any time and type instead. We do not use your voice to identify you.
3. Who else handles your data
We use these services to run the platform. They process data only to provide their service to us.
| Service | What it does | What it receives |
|---|---|---|
| Supabase (through Lovable Cloud) | Database, login and file storage | All account, profile, article and file data |
| Lovable | Builds and hosts the web app, sends invitations and notices | Page requests and technical error information, your name, email address and the message |
| n8n | Runs the automations that plan and write articles | Business profile, keywords, article drafts |
| OpenAI | Writes and edits article text, turns spoken onboarding answers into text, and sorts them into your profile | The audio of your spoken answers while it is turned into text, and the text of your answers. The parts of your profile, keywords and examples needed for each article. We use its business API, which OpenAI says does not train on business customer data by default |
| Google Ads, Drive and Sheets | Keyword research and shared files | Keyword terms and any files you share with us |
We may share data when the law requires it, and with advisers under confidentiality. If our business is sold or merged, data may transfer to the new owner under this policy. We do not sell personal data and we do not use it for advertising.
4. Where data is kept and sent
Our primary database is hosted in the United States (US East, N. Virginia), so personal data of people in the European Economic Area is transferred outside it. Some of the services above are based in other countries, including the United States. When personal data leaves the European Economic Area, we rely on a legal transfer mechanism, such as the provider's certification under the EU-US Data Privacy Framework or standard contractual clauses.
5. How long we keep it
| Data | How long |
|---|---|
| Applications that are declined | 12 months after we decide, then deleted automatically. A copy stays in the change log (see below). |
| Anti-spam records | 30 days, then deleted automatically. These hold only a scrambled (hashed) version of a visitor's internet address, not the address itself. |
| Voice recordings | Deleted as soon as the text is made, and in any case within 24 hours. |
| Transcripts of spoken answers | Deleted 30 days after you submit your profile (or 30 days after the interview if you never submit it). The profile text itself stays as described below. |
| Account, profile, articles and files | Kept while your account is open. When an account closes, we delete this data when you ask us to. There is no automatic deletion yet. |
| Records of changes (audit log) | Kept. There is no automatic deletion yet. Entries can include a copy of the record that changed, such as a deleted application. |
| Backups | Kept on our database provider's own backup schedule, which we do not control. |
We keep some records longer where the law requires it, for example for tax or to defend a legal claim.
6. Your choices and rights
Under the GDPR you have the right to see the data we hold about you, correct it, have it deleted, export it, object to or limit some uses, and withdraw consent where we rely on it. You can edit your profile and examples yourself in the platform. For anything else, write to copypiloting@gmail.com; we answer within one month, as the GDPR requires. We may need to confirm who you are first.
7. Security
We protect data with the measures described on our Security page. No system is perfectly secure, so we also tell affected people and the right authorities if a breach happens, as the law requires. We follow the GDPR rules on breaches: if a breach puts people's rights at risk, we report it within 72 hours of becoming aware of it and tell affected people without undue delay where the risk is high.
8. Cookies
The site uses only the storage it needs to keep you signed in. See the Cookie Policy.
9. Changes
If we change this policy in a meaningful way we will update the date above and tell account holders by email.
10. Contact
Darini Rocha, trading as CopyPiloting, Tallinn, Estonia, copypiloting@gmail.com.